Legal
Privacy Policy
This Privacy Policy describes how Lexuri (“we”, “us”, or “our”), operated by Natan Oliveira, collects, uses, shares, and protects your personal data when you use the Lexuri platform (“Service”). This policy is written in compliance with the Brazilian General Data Protection Law (LGPD — Lei 13.709/2018).
Contact / DPO: natanoliveiraad855@gmail.com
1. What Data We Collect
1.1 Account Data
When you create an account, we collect:
- Full name
- Email address
- Password (stored as a bcrypt hash — we never see your plain-text password)
- OAuth provider ID (if you sign up via Google or GitHub)
1.2 Profile and Learning Data
- Native language and English proficiency level (CEFR)
- Learning objectives you set during onboarding
- Flashcards you create (word, definition, source URL)
- Review history and SM-2 algorithm parameters
- Points, streak, and badge history
1.3 Content You Submit
- YouTube URLs you paste into the Service
- Song titles you search via the Music Lab
- Text excerpts (chunks) you select from transcripts or lyrics
This content is sent to our AI provider (OpenAI) to generate flashcard definitions and language explanations. See Section 4 for details.
1.4 Usage and Technical Data
- Pages visited and features used (analytics events)
- Device type, browser, and operating system
- IP address (retained in server logs for up to 30 days)
- Session tokens (stored in secure HTTP-only cookies)
1.5 Payment Data
If you subscribe to Lexuri Pro, your payment details (card number, billing address) are collected and stored directly by Stripe. We only receive a subscription status and a customer ID — we never see or store your full card number.
2. Legal Basis for Processing (LGPD Art. 7)
| Processing Activity | Legal Basis |
|---|---|
| Account creation and authentication | Contract execution (Art. 7, V) |
| AI-generated flashcards and chunk analysis | Contract execution (Art. 7, V) |
| Payment processing | Contract execution (Art. 7, V) |
| Transactional emails (verification, password reset) | Contract execution (Art. 7, V) |
| Marketing emails (product updates, tips) | Consent (Art. 7, I) — opt-in at registration |
| Analytics and product improvement | Legitimate interest (Art. 7, IX) |
3. How We Use Your Data
- Provide, operate, and improve the Service
- Generate AI-powered flashcards and language explanations
- Calculate spaced repetition schedules and gamification scores
- Send transactional emails (account verification, password reset, daily reminders)
- Send product updates and tips (only if you opted in)
- Analyze usage patterns to improve the Service
- Prevent fraud and abuse
4. Third-Party Services That Receive Your Data
We use the following third-party services. Each is bound by a Data Processing Agreement (DPA) with us and by its own privacy policy.
| Service | Purpose | Country | Data Shared |
|---|---|---|---|
| Supabase | Database, authentication, real-time | USA | All account and learning data |
| OpenAI | AI flashcard generation, chunk analysis | USA | Text/audio you submit for processing |
| Stripe | Payment processing | USA | Email, payment data (managed by Stripe) |
| Resend | Transactional email delivery | USA | Email address, email content |
| Vercel | Hosting and content delivery | USA | IP address, request logs |
| Genius API | Song lyrics search | USA | Search queries only (no account data) |
International data transfers to the USA are made under Standard Contractual Clauses (SCCs) as adopted by the European Commission and recognized under Brazilian LGPD international transfer provisions.
5. Data Retention
- Active accounts: Data is retained for the lifetime of your account.
- Deleted accounts: All personal data is deleted within 30 days of account deletion, except where we are required to retain it by law (e.g., payment records for tax purposes — retained for 5 years).
- Server logs (IP): Retained for 30 days.
- Analytics events: Retained in anonymized form after 12 months.
6. Cookies and Local Storage
We use the following storage mechanisms:
- Session cookies: Secure, HTTP-only cookies set by Supabase Auth to maintain your login session. Required for the Service to function.
- Local Storage / IndexedDB: Used for offline flashcard queue and app preferences. Stored only on your device.
We do not use advertising or tracking cookies from third-party ad networks.
7. Your Rights Under LGPD (Art. 18)
As a data subject under Brazilian law, you have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Update incorrect or incomplete data via Settings → Profile.
- Deletion: Delete your account and all associated data via Settings → Delete Account.
- Portability: Request your data in a structured, machine-readable format (email us).
- Revocation of consent: Withdraw marketing consent at any time in Settings → Profile.
- Information: Request information about which third parties we share your data with (this policy provides that information).
To exercise any of these rights, contact us at natanoliveiraad855@gmail.com. We will respond within 15 business days.
You also have the right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- All data in transit is encrypted via TLS/HTTPS
- Database access is restricted by Row-Level Security (RLS) policies
- Passwords are stored as bcrypt hashes
- API keys and secrets are never exposed client-side
- Supabase service role key is used only server-side for administrative operations
No system is perfectly secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ANPD within the timeframes required by LGPD.
9. Children’s Privacy
The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data without parental consent, contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a prominent notice in the Service at least 15 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
11. Contact and DPO
For any questions, data requests, or complaints regarding this Privacy Policy or our data practices, contact the Data Protection Officer (Encarregado de Dados):