Privacy Policy

Account data. When you sign in via Google, we receive your name, email address, and profile photo from Google. We store this information in our database for as long as your account is active.

Activity data. When you use the client portal or admin dashboard, we store your project comments, approvals, library uploads, and timestamps of actions you take.

Applicant data. If you submit a job application via the Careers section, we collect: your name, email, country, primary discipline, years of experience, links you choose to share (LinkedIn, portfolio, demoreel, social networks), CNPJ status and number (if Brazilian and you provide it), and any cover-letter text you submit. Submission requires explicit consent under LGPD Art. 7(I).

Academy lead data. If you sign up via the Academy welcome form, we collect: your name, email, age, the program you're interested in, and your LGPD consent stamp. Adult-only: Academy is 18+; we record your 18-or-older self-certification alongside your age. Academy playback data (when a video is played, by whom, for forensic attribution of any leaked material) is collected only after you sign in and a program access grant has been issued.

Contact-form data. If you message us via the contact form, we collect your name, email, optional company, the message content, and your consent stamp, plus the submitting IP for abuse forensics — used solely to respond to your inquiry.

Technical data. We use a single session cookie (__session) to keep you signed in. We do not use marketing trackers, analytics cookies, or third-party advertising.

• Execution of a contract (Art. 7, V) — to provide the Service you signed up for.
• Legitimate interest (Art. 7, IX) — to operate, secure, and improve the Service.
• Legal obligation (Art. 7, II) — for financial records required by Brazilian tax law (Receita Federal).
• Consent (Art. 7, I) — for any optional features clearly identified as such.

We share data only with the following service providers, who process data on our behalf under contract:

• Google LLC / Firebase — hosting, authentication, database, file storage. Servers may be located outside Brazil.
• Google Cloud Vertex AI — optional AI-assisted features (e.g. spam filtering on submitted messages). Receives only the specific content being processed; inputs are not used to train Google's models. Servers may be located outside Brazil.
• GitHub, Inc. — source-code hosting; does not receive client data.
• (future) Stripe — payment processing, when and if paid features are introduced.

All transfers outside Brazil comply with LGPD Art. 33 (international data transfer).

• Account data: kept for as long as your account is active, plus 30 days after deletion to handle support requests.
• Project / activity data: kept until you or the project owner deletes it.
• Applicant data: kept for two (2) years from the date of submission, then automatically deleted unless you have been hired, have opted into a longer retention, or applicable law requires otherwise. You may request earlier deletion at any time by emailing careers@uppercut.studio; we comply within 15 days per LGPD Art. 19.
• Academy lead data: kept for two (2) years from your last activity (submission, sign-in linked to the lead, or program participation), then deleted. Earlier deletion by request via academy@uppercut.studio.
• Contact-form data: kept for two (2) years from your message, then deleted. Earlier deletion by request via contact@uppercut.studio.
• Academy playback data (audit log of which user played which lesson, when, and the forensic watermark imprinted on that play): kept for two (2) years from the play event. Used solely to attribute any leaked copy of exclusive material to the originating user.
• Financial records (invoices, payment receipts): kept for 5 years per Brazilian tax law.
• Backup snapshots: kept for 90 days for disaster recovery, then irrecoverable. Additionally, a 7-day point-in-time recovery (PITR) window protects against accidental writes and corruption.

You have the right to:

• Access your data
• Correct incomplete or outdated data
• Delete your data (subject to retention periods above)
• Port your data to another service in a structured, commonly-used format
• Withdraw consent at any time
• Object to processing based on legitimate interest
• Be informed of subprocessors

To exercise any of these rights, email rodrigo@uppercut.studio (or careers@uppercut.studio for applicant-data requests). We respond within 15 days per LGPD Art. 19.

We use a single essential session cookie (__session) to keep you signed in. It is not used for tracking. You can clear it at any time via your browser settings; doing so will sign you out.

The Service is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

We rely on Firebase's encryption-at-rest and encryption-in-transit. Access to our backend systems is gated by Google authentication and role-based permissions. Backups are encrypted before leaving production systems.

We follow industry-standard practices but cannot guarantee absolute security. If a personal data breach occurs that meets LGPD's reporting threshold (Art. 48), we will notify affected users and the Autoridade Nacional de Proteção de Dados (ANPD) within a reasonable time.

We may update this Policy from time to time. Material changes will be notified via email to active users at least 30 days before they take effect. The current version's effective date is at the top of this page.

Data Protection Officer / Encarregado: Rodrigo da Costa
Email: rodrigo@uppercut.studio

For LGPD-specific complaints, you may also contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.