Last updated: January 1, 2025 | Effective date: January 1, 2025
Learpy Tecnologia Educacional Ltda. ("Learpy," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, store, and protect your personal data when you use our website at learpy.org, our mobile applications, and our AI-powered learning platform (collectively, the "Services").
We comply with applicable data protection laws including the General Data Protection Regulation (GDPR) of the European Union, the Lei Geral de Proteção de Dados (LGPD) of Brazil, and other applicable privacy regulations. Please read this policy carefully before using our Services. By accessing or using Learpy, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this policy.
Learpy Tecnologia Educacional Ltda. is a company incorporated under the laws of Brazil, with its principal place of business at Avenida Paulista, 1374, São Paulo, SP 01310-100, Brazil. For the purposes of GDPR, Learpy acts as a data controller in respect of the personal data of individuals using our Services in the European Economic Area. For the purposes of LGPD, Learpy acts as a controller (controlador) in respect of the personal data of Brazilian data subjects. If you have questions about this policy or our data practices, please contact our Data Protection Officer at privacy@learpy.org.
We collect several types of information from and about users of our Services:
Account Registration: When you create an account, we collect your name, email address, password (stored in encrypted form), and optionally your organization name and job title. For enterprise accounts, we also collect billing information including company name, tax identification numbers, and authorized purchaser information.
Profile Information: You may optionally provide additional profile information including your professional background, learning goals, industry, and geographic location. This information helps us personalize your learning experience but is not required to use the Services.
Payment Information: For paid plans, we collect billing information necessary to process your subscription. Payment card information is processed by our payment processor, Stripe Inc., and is not stored on our servers. We retain only a tokenized reference provided by Stripe.
Communications: When you contact us by email or through our contact forms, we collect the contents of your communications and any information you choose to provide, including your name, email address, and the subject matter of your inquiry.
Survey and Feedback Responses: If you participate in user research, surveys, or provide product feedback, we collect your responses and any additional information you provide.
The Learpy platform collects detailed data about your learning activity in order to personalize your learning experience and improve our platform. This includes:
This learning activity data is the foundation of the personalized experience Learpy provides. Without it, we cannot operate the adaptive learning engine. We treat this data with the highest level of care and use it only for the purposes described in this policy.
When you use our Services, we automatically collect certain technical information, including: your IP address (which may be used to infer your approximate geographic location), browser type and version, operating system and device type, referral URL, pages or features accessed, time spent on pages, and error logs. We use this data to operate, maintain, and improve our Services.
We use cookies and similar tracking technologies as described in our Cookie Policy at learpy.org/legal/cookies.html. We use strictly necessary cookies to operate our Services, functional cookies to remember your preferences, and analytics cookies (with your consent) to understand how our Services are used. We do not use advertising or behavioral tracking cookies.
We use the information we collect for the following purposes:
Your learning activity data is processed by our AI systems to construct and maintain your personalized learning path, calibrate content difficulty and pacing, schedule spaced repetition reviews, and generate competency assessments. This processing is fundamental to the service we provide. The legal basis for this processing is the performance of the contract between you and Learpy (fulfillment of your subscription).
We analyze aggregated and de-identified learning data to understand what instructional approaches, content formats, and platform features produce the best learning outcomes. This research improves our platform for all users. Individual users are never identifiable in this aggregate analysis. The legal basis for this processing is our legitimate interest in improving our Services.
We may send you service-related communications including welcome emails, course recommendations, progress reports, and notifications about changes to your account or our Services. These communications are a necessary part of providing the Services. We may also send you promotional communications about new features, content, or offers if you have consented to receive them. You may unsubscribe from promotional communications at any time using the unsubscribe link in each email.
We use your information to detect and prevent fraud, abuse, and violations of our Terms of Service. We may process your account activity to identify unusual patterns that suggest unauthorized access or other security threats.
For users in the European Economic Area and Brazil, we process your personal data on the following legal bases:
We do not sell your personal information to third parties. We do not share your individual learning data with advertisers or data brokers. We share your information only in the following limited circumstances:
We engage carefully selected third-party service providers to help us operate our Services. These providers are contractually bound to process your data only on our instructions and in accordance with this policy. Our key service providers include: Stripe Inc. (payment processing), Amazon Web Services (cloud infrastructure), Sendgrid (transactional email), Mixpanel (product analytics, processed on data processor agreement), and Intercom (customer support).
If you use Learpy through an Enterprise account provided by your employer, your employer's designated administrators have access to aggregate team analytics and your learning progress data as described in your employer's enterprise agreement. Your employer is a data controller with respect to this data. If you have questions about how your employer uses this data, please contact your employer.
We may disclose your information if required by applicable law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of Learpy, our users, or others.
We retain your personal data for as long as necessary to provide our Services and as required by applicable law. Specifically: Account data is retained for the duration of your subscription plus 3 years following termination. Learning activity data is retained for the duration of your subscription plus 2 years following termination to allow you to access your learning history if you resume a subscription. Payment records are retained for 7 years as required by Brazilian tax law. You may request deletion of your account and associated data at any time as described in Section 7 below.
You have the following rights with respect to your personal data, exercisable by contacting us at privacy@learpy.org:
We will respond to rights requests within 30 days. If we are unable to fulfill your request, we will explain why. You also have the right to lodge a complaint with a supervisory authority — in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD), and in the EU, the data protection authority in your member state.
We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures include: encryption of data at rest and in transit using AES-256 and TLS 1.3, access controls restricting employee access to personal data on a need-to-know basis, regular security assessments and penetration testing, and SOC 2 Type II certification of our infrastructure. While we take security seriously, no method of transmission over the internet or method of electronic storage is 100% secure. We encourage you to use strong, unique passwords and to notify us immediately if you suspect unauthorized access to your account.
Learpy operates primarily in Brazil and may transfer your data to servers located in the United States (our primary cloud infrastructure provider, AWS). For transfers of personal data from the European Economic Area to third countries, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. By using our Services, you consent to the transfer of your information to countries outside your country of residence, including Brazil and the United States, in accordance with this policy.
Learpy is designed for and directed to adults aged 18 and over. We do not knowingly collect personal information from children under the age of 16. If we learn that we have collected personal information from a child under 16, we will promptly delete it. If you believe we may have collected information from a child under 16, please contact us at privacy@learpy.org.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by email or by displaying a prominent notice on our platform at least 30 days before the change takes effect. Your continued use of the Services after the effective date of an updated policy constitutes your acceptance of the changes.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
We are committed to working with you to resolve any concerns about your privacy. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority.