Privacy Policy

1. Who looks after your data

vene.win is run by Tio Vené, a technology teacher, who is the controller of the personal data processed here. For any privacy matter, including exercising your rights, write to [email protected].

As a small-scale processing agent (Brazilian ANPD Resolution CD/ANPD No. 2/2022), vene.win has not appointed a formal data protection officer; the email above is the contact channel for data subjects and authorities.

2. What data we collect

• Sign-in with Google: your name, your email (and whether Google verified it) and your Google account identifier. We never receive or store your Google password.
• Platform use: the courses you enrolled in, your progress in each lesson and the history of that progress.
• Lesson request: the requester's name, email, WhatsApp (optional), the student's age, interest, message (optional) and the page language. We don't ask for the student's name.
• WhatsApp conversations: if you message Tio Vené through the site's button, he receives your number, profile name and messages, used only to reply and arrange lessons.
• Technical access data: IP address, browser, date, time and pages visited, processed by the delivery network (Cloudflare) and the server to deliver the site and protect it from attacks.
• Payments: when Tio Vené creates a charge, we store the payer's name and email, the description, the amount and the status. Payment happens on the InfinitePay checkout; from InfinitePay we receive only the confirmation (payment method, amount paid, installments and the receipt link).

We don't collect card or bank account data (InfinitePay keeps it), sensitive data (such as health, religion or biometrics) or precise location, and we don't use third-party analytics or advertising tools.

3. Why we use it and on what legal basis

• Creating and running your account and the study platform: performance of a contract or of pre-contractual steps at your request (LGPD, art. 7, V; GDPR, art. 6(1)(b)).
• Replying to lesson requests: your consent, given in the form, and pre-contractual steps for a contract you asked about (LGPD, art. 7, I and V; GDPR, art. 6(1)(a) and (b)). You can withdraw your consent at any time.
• Keeping the site secure, preventing abuse and making backups: legitimate interests, limited to what is necessary (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).
• Charging for lessons, confirming payment and sending the receipt: performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)).
• Notifying Tio Vené by email of lesson requests and payments: the same bases as the request and the charge.
• Meeting legal obligations and orders from authorities: legal obligation (LGPD, art. 7, II; GDPR, art. 6(1)(c)).

We don't make automated decisions about you, build profiles or use your data for advertising. The sign-in and form data are needed for these services: without them you can't sign in to the platform and we can't reply to your request.

4. Children and teenagers

vene.win is made for students, including children and teenagers, and always processes their data in their best interests, as required by Brazil's LGPD (art. 14) and Child and Adolescent Statute.

• Lesson requests for students under 18 must be sent by a parent or legal guardian. The form asks only for the student's age, not their name.
• Platform accounts for students under 18 require a guardian's permission. For children under 13, or under the age of digital consent in your country (up to 16 in some EU countries under GDPR art. 8), the account may only be used with a parent's or guardian's consent, for example through a Google account supervised with Family Link.
• We don't knowingly collect data from children under 13 without verifiable parental consent, as required by COPPA in the United States. If we learn that this happened, we delete the data.
• A parent or guardian may at any time ask to access, correct or delete a minor's data by writing to [email protected].

5. Who we share it with

We don't sell, rent or trade your personal data. It only passes through service providers needed to run the site:

• Google: handles sign-in and only sends vene.win the data you approve on Google's screen (name, email and account identifier).
• Cloudflare: the delivery and protection network between your browser and the server.
• WhatsApp (Meta): carries the messages you send through the site's button, under WhatsApp's privacy policy.
• Oracle Cloud: hosts the server and the database, in Brazil.
• InfinitePay (CloudWalk): processes payments made through the charge link, under its own privacy policy.
• Google (Gmail): sends the email notifications to Tio Vené and the receipt to the payer.

We may also provide data to authorities when the law or a court order requires it.

6. International transfers

Data is stored in Brazil. Google and Cloudflare may process it in other countries, such as the United States. These transfers rely on the safeguards provided by law, such as the standard contractual clauses adopted by these providers (LGPD, art. 33; GDPR, Chapter V), and, where applicable, on the need to provide the service you asked for.

If you use the site from outside Brazil, your data is transferred to Brazil so that it can work.

7. How long we keep it

• Account and progress: for as long as the account exists. After a deletion request, we delete them within 15 days.
• Lesson requests: deleted automatically 12 months after they are sent, or earlier if you ask.
• Charges and receipts: for the period the law requires for payment and tax records (usually 5 years).
• Database backups: the 14 most recent, replaced daily. Deleted data leaves the backups within 14 days.
• Technical access data: for the shortest time needed for the site's security, unless the law requires longer.

8. How we protect it

• An always-encrypted connection (HTTPS).
• No password of our own: authentication is done by Google, and the session cookie is encrypted and protected from scripts (HttpOnly).
• Protection against forged form submissions (CSRF), an application firewall and security headers.
• Administrative access limited to Tio Vené, and collection of only the minimum data needed.

If a security incident may cause significant risk or harm, we will notify the affected people and the authorities within the legal deadlines (LGPD, art. 48; GDPR, arts. 33 and 34).

9. Cookies and browser storage

vene.win uses only strictly necessary cookies. We don't use advertising, analytics or third-party cookies, so we don't show a cookie consent banner.

• rullst_session: keeps you signed in to the platform. Lasts up to 30 days and can't be read by scripts.
• rullst_csrf: protects forms against forged submissions. Removed when you close the browser.
• rullst_locale: remembers the language you chose in the platform's language selector. Lasts 1 year.
• tiovene_oauth: stores the Google sign-in security challenge for up to 10 minutes.
• Local storage (localStorage): the browser keeps your light or dark theme choice and copies of calendar pages so the Back button works quickly. This data stays on your device only.

You can delete cookies and local storage in your browser settings; without rullst_session you will need to sign in again.

10. Your rights

Under the LGPD (art. 18), the GDPR (arts. 15 to 22) and similar laws, you may ask, free of charge, for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data or data processed unlawfully, and deletion of data processed on the basis of consent;
• portability of your data in a structured format;
• information about who we share your data with;
• withdrawal of consent, without affecting what was done before;
• objection to processing based on legitimate interests.

To exercise any right, write to [email protected]. We may ask you to confirm your identity. We reply within 15 days (the GDPR allows up to one month).

You may also complain to a data protection authority: in Brazil, the ANPD (gov.br/anpd); in the European Union, the authority in your country; in the United Kingdom, the ICO.

California residents (CCPA/CPRA): we collect identifiers (name, email and Google account), contact details, education information (course progress) and technical access data, for the purposes described above. We don't sell or share personal information for cross-context behavioral advertising and we don't use sensitive personal information. You have the right to know, correct and delete your data, without discrimination for exercising these rights.

11. Links to other websites

The calendar links to the official websites of competitions and to other services. They have their own privacy policies, and vene.win doesn't control what they do with your data.

12. Laws this policy follows

This policy was written to comply with Brazil's LGPD (Law No. 13,709/2018), Internet Civil Framework (Law No. 12,965/2014) and Child and Adolescent Statute (Law No. 8,069/1990); the GDPR (Regulation (EU) 2016/679) and the UK GDPR in Europe; the CCPA/CPRA and COPPA in the United States; and Latin American data protection laws such as those of Argentina (Law No. 25,326), Chile (Law No. 19,628, amended by Law No. 21,719), Colombia (Law No. 1,581/2012) and Mexico (LFPDPPP). Where these laws differ, we apply the rule that protects you most.

13. Changes to this policy

We may update this policy when the site changes. The date at the top shows the version in force; important changes will be announced on the site.