Privacy Policy

1. What We Collect

• Account data: name, email address, and password (securely hashed with bcrypt).
• Profile data: bio, avatar photo, teaching specialties, and availability.
• Lesson data: booking history, lesson notes, and activity results.
• Messages: chat messages sent between students and teachers on the platform.
• Usage data: standard server logs (IP address, browser type, pages visited).

2. How We Use Your Data

We use your data to:

• Provide and improve the ilevar service.
• Connect students to teachers and facilitate bookings.
• Send transactional emails (booking confirmations, password resets).
• Comply with legal obligations.

We do not sell your personal data to third parties.

3. Data Sharing

We share data exclusively with sub-processors necessary to operate the platform (Stripe for payment processing, OpenAI/OpenRouter for AI pedagogical content generation, Cloudflare for WebRTC audio/video transmission, Resend for transactional emails, Microsoft Clarity for usability analytics only after consent, and Vercel/Supabase for hosting and database). The application uses NextAuth for authentication and Supabase for database, storage, and Realtime. All providers must be bound by data privacy agreements.

4. International Data Transfers

As part of operating the service, some of the sub-processors listed above store or process personal data outside Brazil. These international transfers are carried out under Article 33, II, of the LGPD, through Standard Contractual Clauses or an equivalent mechanism set out in the data processing agreements (DPAs) signed with each provider:

• Supabase (database, storage, and Realtime) — United States.
• Vercel (hosting and infrastructure) — United States.
• Stripe / Stripe Connect (payment processing) — United States.
• Cloudflare (WebRTC audio/video transmission — Calls/Realtime/TURN) — global data center network.
• Resend (transactional email delivery) — United States.
• OpenAI / OpenRouter (AI-generated pedagogical content and text-to-speech) — United States.
• Microsoft / Microsoft Clarity (anonymized usability analytics and heatmaps) — United States.

We adopt the contractual safeguards required by the LGPD to ensure these providers maintain an adequate level of protection for the personal data transferred. You may request more information about these safeguards by contacting us at contact@ilevar.com.

5. Children's Privacy

ilevar may be used by students under 18 in the context of a responsible school or teacher. When registering a minor, the organization must confirm that parental consent was obtained, provide the guardian's email, and keep that record; student access remains blocked until confirmation. The platform does not independently verify the guardian's identity or collect date of birth. We collect only the minimum data necessary and do not use children's data for advertising. Parents may request deletion by contacting us.

6. Your Rights (GDPR / LGPD)

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain processing.

To exercise these rights, use the account deletion feature in settings or contact us at contact@ilevar.com.

7. Data Retention

We retain necessary data while your account is active. When you delete your account, credentials, contact data, memberships, notifications, push subscriptions, and avatar assets are removed; remaining profile data is anonymized immediately. Ephemeral authentication, rate-limit, and voice-cache data is removed periodically by the retention job. Shared lesson and message history may remain anonymized when necessary for educational continuity and the other party's rights, as explained below.

Chat messages and lesson notes (vocabulary, corrections, and notes shared between student and teacher) are handled differently, since they also belong to the other party in the conversation/lesson: during the student-teacher relationship, the legal basis is performance of the educational contract (art. 7, V of the LGPD). After the relationship ends or one party deletes their account, we keep this content on the basis of legitimate interest — pedagogical continuity and dispute resolution — restricted to the controller's own use (art. 10 together with art. 16, IV). When an account is deleted, we anonymize the identity of who wrote it (shown as "Account deleted"), but the content itself remains visible to the other party; we do not offer full deletion of this shared history, since that would affect the other party's own right to the same content. A teacher's private notes (never shared with the student) are handled separately: the teacher can delete them individually at any time, and they are removed when the teacher's account is deleted.

8. Cookies

We use strictly necessary session cookies for authentication and navigation. Microsoft Clarity loads only after you choose 'Accept all' in the cookie notice; choosing 'Essential only' prevents it from loading. Microsoft Clarity automatically masks data, but this does not replace the obligation not to enter unnecessary personal data into free-text fields.

9. Changes to This Policy

We will notify users of material changes by email or in-app notice before changes take effect.

10. Contact

Privacy questions: contact@ilevar.com