Privacy Policy

1. Introduction

Partiu Desenvolvimento de Software Ltda ("Partiu Formatura", "we", "us", "our") respects your privacy and is committed to protecting the personal data you entrust to us. This Privacy Policy describes how we collect, use, store and share your information when you use our platform, mobile apps and related services (collectively, the "Service").

By using the Service, you agree to the practices described in this Policy. We recommend that you read this document carefully. If you have any questions, please contact us through the channels listed at the end of this document.

This Policy was prepared in accordance with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and other rules applicable to the protection of personal data in Brazil.

If you live in the United States or Canada, the notices in our Privacy Center also apply to you and describe the rights you have under U.S. state privacy laws (including the CCPA), PIPEDA, and Quebec's Law 25. See section 15.

This English version is provided for convenience. In the event of any conflict, the Portuguese version prevails, except for the U.S. and Canadian notices in the Privacy Center, which are written in English and govern for residents of those countries.

2. Data We Collect

We collect different categories of personal data, depending on how you interact with the Service:

2.1 Registration Data

Information you provide directly when creating an account or subscribing to the Service, including: full name, email address, phone number, taxpayer ID (such as the Brazilian CPF or CNPJ), name of the educational institution and details of the graduating class or graduation committee.

2.2 Usage Data

Information collected automatically while you use the Service, such as: IP addresses, browser and device type, operating system, pages visited, access times, time spent and actions taken within the platform.

2.3 Payment Data

Information required to process financial transactions. Payments are processed through third-party partners such as Stripe, MercadoPago, Asaas and PagSeguro. We do not store full credit or debit card data on our servers. We only keep transaction identifiers and partial information (last 4 digits of the card, card brand) for reconciliation purposes.

2.4 Biometric Data

If you choose to use the facial recognition feature to organize and search photos in galleries, we will collect facial biometric data. This collection happens only with your express and specific consent, requested before the feature is enabled. You can withdraw this consent at any time.

2.5 Uploaded Content

Photos, videos, documents, logos and other files you upload to the platform as part of your use of the Service. This content is stored securely and associated with your account or class.

3. How We Use Your Data

We use your personal data for the following purposes:

• Provide and maintain the Service: create and manage your account, keep the platform running and provide technical support.
• Process payments: collect installments, issue bank slips (boletos) and PIX charges, and process credit card transactions through our payment partners.
• Send communications: deliver transactional notifications (payment confirmations, installment reminders, event updates) and, with your consent (opt-in), marketing communications and news about the Service.
• Improve the platform: analyze usage patterns to enhance features, fix errors and develop new functionality.
• Facial recognition in galleries: when you enable this feature with explicit consent, we use facial recognition technology to organize and simplify photo search in event galleries.
• Comply with legal obligations: meet applicable legal, regulatory, tax and audit requirements.

4. Legal Basis for Processing (LGPD)

Under Article 7 of the Brazilian General Data Protection Law (LGPD), the processing of your personal data is based on the following legal grounds:

• Consent (Art. 7, I): for biometric data (facial recognition), marketing communications and non-essential cookies. You can withdraw your consent at any time.
• Performance of a contract (Art. 7, V): to provide the contracted Service, including account management, payment processing and platform features.
• Legitimate interest (Art. 7, IX): for platform improvements, Service security and fraud prevention, always respecting your rights and expectations.
• Legal obligation (Art. 7, II): to comply with applicable tax, accounting and regulatory requirements.

5. Data Sharing

We may share your personal data with third parties in the following situations:

• Payment processors: Stripe, MercadoPago, Asaas and PagSeguro, to enable financial transactions.
• Infrastructure and storage: Amazon Web Services (AWS) and other cloud providers used to host data and files securely.
• Email providers: SendGrid and similar services to send transactional notifications and authorized communications.
• Legal authorities: when required by law, court order or legal proceeding.

We never sell, rent or trade your personal data to third parties under any circumstances. All third parties with whom we share data are contractually required to protect it in accordance with appropriate security standards.

Client portfolio confidentiality: The CONTRACTOR will not publicly disclose, or disclose to third parties, the name, brand, contact details, employees or any other information related to its clients for commercial, advertising, reference or prospecting purposes, unless the respective client has given prior authorization.

6. Storage and Security

We adopt appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or alteration:

• Encryption in transit: all communications between your device and our servers use the TLS (Transport Layer Security) protocol.
• Encryption at rest: sensitive data stored in our databases and storage systems is encrypted.
• Access control: access to personal data is restricted to employees and service providers who need that data to perform their duties, using multi-factor authentication and the principle of least privilege.
• Monitoring: we continuously monitor our systems to detect and respond to security incidents.
• Backups: we keep regular backups in geographically distributed environments to ensure data availability.

7. Your Rights (LGPD Art. 18)

Under Article 18 of the LGPD, you have the following rights regarding your personal data:

• Confirmation and access: confirm whether we process your data and obtain access to the personal data we hold about you.
• Correction: request the correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion: request the anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD.
• Portability: request the transfer of your data to another service provider, upon express request.
• Deletion: request the deletion of personal data processed based on consent, except where retention is required by law.
• Information about sharing: be informed about the public and private entities with which we share your data.
• Withdrawal of consent: withdraw your consent at any time, free of charge and through a simple process.

8. Cookies

We use cookies and similar technologies to improve your experience on the platform. The cookies we use fall into the following categories:

• Essential cookies: required for the basic operation of the platform, such as authentication, security and session preferences. They cannot be disabled.
• Analytics cookies: help us understand how you use the platform, so we can identify improvements and fix issues. They use aggregated and anonymized data.
• Marketing cookies: used to show relevant content and measure campaign effectiveness. They are only enabled with your consent.

You can manage your cookie preferences at any time through your browser settings. Disabling non-essential cookies may affect some platform features. Please refer to your browser's documentation for specific instructions on managing cookies.

9. Data Retention

Your personal data will be kept for as long as necessary to fulfill the purposes for which it was collected, according to the following criteria:

• Active account: your data is kept while your account is active and the Service is in use.
• After account closure: after the account is closed, we will keep your data for 5 (five) years to comply with legal, tax, accounting and regulatory obligations.
• Biometric data: facial recognition data will be deleted within 30 days after consent is withdrawn or the account is closed, whichever comes first.

After the retention periods, the data will be deleted or irreversibly anonymized.

10. Children's Data

The Service is intended for people aged 18 and over. We do not knowingly collect personal data from individuals under 18 without the verifiable consent of their parents or legal guardians.

If we become aware that we have collected data from a person under 18 without proper consent, we will take immediate steps to delete that information from our systems.

If you are a parent or legal guardian and believe your child has provided personal data to the Service, please contact us at privacidade@partiuformatura.com.br so we can take the appropriate action.

11. International Data Transfers

Some of our service providers, such as Amazon Web Services (AWS) and Stripe, may process and store data on servers located outside Brazil, including in the United States and Europe.

In these cases, we ensure that international data transfers take place with adequate levels of protection, in accordance with Article 33 of the LGPD, through:

• Standard contractual clauses that ensure protection equivalent to Brazilian law.
• Certifications and commitments by service providers to international data protection frameworks.
• Additional technical measures, such as encryption and access controls.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service or applicable law.

In the event of significant changes, we will notify you by email at least 30 (thirty) days in advance before the changes take effect. Continued use of the Service after the effective date of the new version will constitute your acceptance of the changes.

We recommend that you review this page periodically to stay informed about how we protect your data.

13. Data Protection Officer (DPO)

In accordance with Article 41 of the LGPD, we have appointed a Data Protection Officer (DPO, "Encarregado") as the point of contact between the company, data subjects and the Brazilian National Data Protection Authority (ANPD).

The DPO is available to answer questions, receive requests from data subjects and act as the communication channel with the ANPD.

14. Contact

If you have any questions, concerns or requests related to this Privacy Policy or the processing of your personal data, please contact us:

If you are not satisfied with our response, you can file a complaint through our Ombudsman Portal.

15. Residents of the United States and Canada

The following notices supplement this Policy and prevail over it where they give you more protection:

• U.S. State Privacy Rights: our Notice at Collection under the California Consumer Privacy Act and the disclosures required by the other state privacy laws.
• Your Privacy Choices: we do not sell or share personal information and we honor Global Privacy Control.
• Canadian Privacy Rights: PIPEDA, Quebec's Law 25, and the Alberta and British Columbia PIPAs.
• Biometric Data Policy and Children and Students.

For residents of those countries, response times follow local law: 45 days in the United States and 30 days in Canada, as described in the Privacy Center.