This policy explains how Math Mental processes personal data, in compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018, LGPD).
Initial version prepared by the team. The text must be reviewed by legal counsel before the public launch.
1. Who we are
Math Mental is the math study platform that acts as the controller of the data described here.
Data protection officer (DPO): name and contact e-mail to be defined before the launch. In the meantime, use the Account › Privacy section.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Account | login identifier, name, e-mail | authentication provider (Clerk) |
| Progress | completed lessons, XP, streak, answers | use of the platform |
| Preferences | daily goal, interface settings | provided by you |
| Support | feedback messages and privacy requests | provided by you |
| Technical | access and device logs | collected automatically |
We do not ask for sensitive data (art. 5, II) and we do not use your data for targeted advertising.
3. What we use it for and on which legal basis
- Providing the service (account, path, progress, leagues): performance of a contract (art. 7, V).
- Security, fraud prevention and access logs: compliance with a legal obligation (art. 7, II; Marco Civil da Internet, art. 15) and legitimate interest (art. 7, IX).
- Improving content and fixing errors with aggregated metrics: legitimate interest, with an impact assessment and the option to object.
- Optional communications: consent (art. 7, I), which can be withdrawn at any time.
4. Teenagers
Our audience includes high school students. We always process teenagers’ data in their best interest (art. 14 of the LGPD and CD/ANPD Statement No. 1/2023), collecting only what learning requires, without profiling for advertising and with more protective settings by default. Math Mental is not aimed at children under 12.
5. Sharing
We share data only with processors needed to run the service (authentication, hosting and infrastructure), under contract and with security instructions. Some of these providers may store data outside Brazil, with the safeguards of art. 33 of the LGPD. We do not sell personal data.
6. How long we keep it
- Account and progress data: while the account is active.
- After the account is deleted: erasure within 30 days, except what must be kept by legal obligation.
- Access logs: 6 months (Marco Civil da Internet).
- Acceptance records, data subject requests and incidents: 5 years, to demonstrate compliance with the LGPD.
7. Audience measurement
To learn which screens and lessons help people study, and where they give up, we use two external tools on the public site (math.jhonatasfender.com) and in the app (app.math.jhonatasfender.com): Google Analytics 4 and Microsoft Clarity. Both are loaded only after you accept in the footer bar. Until you accept, your browser requests nothing from Google or Microsoft.
- What Google Analytics receives: screens visited, date and time, language, device and browser type, country and region, where the visit came from, and events from your use of the app — lesson start and finish, right and wrong answers, use of the step-by-step solution, concept cards, quick practice, unit test, the out-of-hearts screen, paid refills and support. Each event carries only the question type, the unit, the lesson, the mode and the result. We never send your account identifier, name, nickname, e-mail, the answer you typed or any text you wrote. The IP address is anonymised (
anonymize_ip) and Google cross-device identification is turned off. - What Microsoft Clarity receives: an anonymous recording of your navigation (clicks, scrolling and the structure of the screens), without identifying you. We never use Clarity user identification. Answer fields, the math keyboard, the Account area, the feedback form and the team area are masked in the code: the recording shows blank blocks instead of the content.
- Why: to find where the app confuses or blocks people and to prioritise what to fix and improve. We do not use this data for advertising: Google advertising and ad personalisation signals are turned off, and we do no profiling or remarketing.
- Legal basis: your consent (LGPD, art. 7, I).
- International transfer: Google LLC and Microsoft Corporation process this data on servers outside Brazil, including in the United States, under each service’s contractual clauses (LGPD, art. 33).
- For how long: Clarity recordings are kept for 30 days and aggregate metrics for 13 months; Google Analytics data follows the retention configured on the property. Your choice is stored in your browser for 6 months, after which we ask again.
- How to withdraw: in the app, under Account › Settings › Cookie preferences; on the site, through the “Cookie preferences” link in the footer. Recording stops from then on and nothing more is sent. You can also delete the cookies in your browser.
- In Chinese: screens in Chinese never load either tool.
- Cookie-free measurement: whatever you choose, Cloudflare, which serves the pages, counts visits from the server requests themselves, in aggregate. No cookie or script runs in your browser in that case and the data identifies no one.
8. Your rights
At any time and free of charge (art. 18), you can: confirm that processing exists, access your data, correct it, ask for anonymization, blocking or erasure, request portability, learn with whom we share it, withdraw consent and object to processing.
Use the Account › Privacy section or write to the data protection officer. We reply within 15 days (art. 19, II). You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).
9. Security and incidents
We use encryption in transit, role-based access control and an audit trail. If an incident occurs that may cause relevant risk or harm, we will notify the ANPD and the affected data subjects within 3 business days (CD/ANPD Resolution No. 15/2024).
10. Changes
When this policy changes, we will publish a new version with a summary of the changes and ask you to read and accept it when you sign in to the platform.