Privacy Policy

1. Who handles your data

The company that decides how your personal data is handled, and is answerable for it, is Skill Builders World USA — the controller, in the language of Brazilian law (LGPD, art. 5, VI; art. 9, III).

Brazilian law reaches this company even though it is based in the United States, because it offers a product to people located in Brazil, in Portuguese. The statute says so explicitly: it applies regardless of the country of the company's headquarters and regardless of where the data sits (LGPD, art. 3, II and § 1). We do not treat that as a technicality: this Policy was written to meet Brazilian law in full.

1.1 Data protection officer

[CONFIRMAR COM JURÍDICO] whether the company must appoint a data protection officer with a public identity, or whether it is exempt.

Brazilian law requires the controller to appoint an officer and to publish that person's identity and contact, preferably on the website (LGPD, art. 41, caput and § 1). The Brazilian authority created an exemption for small-scale processing agents, who in exchange must provide a communication channel for data subjects (Resolution CD/ANPD No. 2 of January 27, 2022, and LGPD, art. 41, § 2, I). The research found no position from the authority on how a foreign company without a Brazilian tax registration fits the size criterion, and that is the first open question for counsel.

Project decision, September 25, 2026: unless counsel rules the exemption out, this Policy names no individual. The privacy channel is the email address above, free and staffed — and that is what satisfies art. 41, § 2, I. If counsel concludes the exemption does not apply, the officer's name and title go in this section and in the contact block.

2. What data we collect

We collect exactly four pieces of information, and all of them come from a single form: the waitlist sign-up. There is no other collection point on the website (LGPD, art. 9, I).

Along with the submission, the system records the technical data that proves your consent: date and time, IP address, page language, and the exact text of each consent field as it appeared on screen at the moment you checked it. That record exists because the law places on the controller the burden of proving that consent was obtained in compliance (LGPD, art. 8, § 2).

2.1 What we do not collect, and we want it in writing

• We do not collect any child's data. No field asks for a child's name, age, date of birth, photo, voice recording, diagnosis, report, or any other information about the child. The form speaks to the adult, and only about the adult.
• We do not collect sensitive personal data. No health data, no diagnosis, no racial or ethnic origin, no religious belief, no political opinion, no union membership, no genetic or biometric data, no data about sex life (LGPD, art. 11).
• We do not collect anyone's age or date of birth. That is deliberate and it has a technical reason: in the United States, the specific duty regarding children's data arises when a website asks for and receives information that allows age to be determined. A website that does not ask does not acquire that knowledge through the route the regulator describes, and the absence of the field is the protection (COPPA, 16 CFR Part 312; FTC, Complying with COPPA FAQ).
• We do not collect payment data. There is no sale on this website today, no cart, and no card field.
• We do not buy lists, we do not rent databases, and we do not enrich your record with data from third parties.

3. What we use each piece of data for, and on what legal basis

The law requires a specific purpose and prohibits blanket authorization: consent "to receive communications", without saying which ones, is void (LGPD, art. 8, § 4). So every piece of data has a named purpose and a stated legal basis.

3.1 Why the two consents are separate

Because they are two different things, and the law does not accept one riding on the other.

Someone joining the list is asking for one specific notice: the November 19, 2026 sales opening and the language choice. Ongoing marketing is a different purpose, and using a list sign-up to fire generic campaigns would be a change of purpose without authorization (LGPD, art. 8, § 4, and art. 9, § 2).

So the form has two consent fields, both start unchecked, and the second one is genuinely optional: the form submits without it. If you check only the first, the only email you get from us is the launch notice. The literal text of both fields is in the annex ANEXO-Campos-de-Consentimento-PT-EN-v1.md.

3.2 What we do not use your data for

• Automated decisions affecting you, profiling, or behavioral scoring.
• Selling, renting, assigning, or trading your data, under any circumstances and at any price.
• Training automated systems.

What was on this list in version 1 and left it: behavioral advertising. The website now carries a Meta pixel and a Google pixel, and the next section says exactly what that means, instead of denying something that already exists.

3.3 Advertising: what we do with the Meta and Google pixels

We promote the launch with paid advertising on Facebook, Instagram, and Google, and the website loads the pixel of both platforms. That is processing for advertising purposes, and it depends on your acceptance of the marketing category in the cookie notice (LGPD, art. 7, I). Without that acceptance, neither pixel fires.

Two things happen when you accept:

• Campaign measurement. The platform tells us how many people joined the list after clicking one of our ads. What we receive is aggregate numbers — how many visits, how many entries, what each one cost — not a list of names.
• Custom audiences, what the industry calls remarketing. Meta and Google may recognize your browser as one that has visited this website, and show you Skill Builders ads again on Facebook, Instagram, Google Search, or YouTube. That is behavioral advertising: the ad reaches you because you visited, not because someone picked your name.

What is not part of this, and it is the most important distinction in this section. The name, email, phone, and the "I am" category you type into the form are not sent to Meta or Google, do not build custom audiences, and are not used to target advertising. The email list and the pixel are two separate worlds, and they do not meet.

You can switch this off at any time, through two paths that work independently: change your choice in the website's cookie preferences panel, and turn off ad personalization in your Meta account and in your Google account. The details of each path are in the Cookie Policy, sections 4.2 and 5.2.

4. How long we keep it

[CONFIRMAR COM JURÍDICO] the periods in this table. A writer does not set retention periods: the answer depends on statutory record-keeping duties, the applicable limitation periods, and a business decision. The rule guiding the table is the statutory one: processing ends when the purpose is fulfilled or when the data subject revokes consent, and the data is then deleted, except where retention is authorized (LGPD, arts. 15 and 16).

When we delete, we also delete at the processors we shared with, and that applies above all to the email platform: an unsubscribe that lives only in an internal spreadsheet is not an unsubscribe (LGPD, art. 18, § 6).

5. Who we share with

This section has two halves, and the order between them is deliberate: first what we share, then what we do not. A document that opens with the denial is hiding the statement.

5.1 What we share, and with whom

There are two kinds of sharing here, and they follow different rules.

Operational sharing, with suppliers who handle data on our behalf and under our instruction — processors, in the language of the law (LGPD, art. 5, VII, and art. 9, V):

Sharing for advertising, which is new in version 2 and depends on your acceptance of the marketing category in the cookie notice (LGPD, art. 7, I):

[CONFIRMAR COM JORGE/INFRA] the named list of suppliers in the first table. This Policy has to name the categories, and naming the supplier behind each one is what lets you know who touches your data. Meta and Google are already named because the decision to use both platforms has been made.

We may also share data where there is an order from a competent authority or a legal obligation, and in that case we tell you, unless the order itself forbids it.

5.2 What we do not share

These four statements remain true with a pixel on the page, which is why they stayed:

• The email list is not sold, not rented, and not assigned. Under no circumstances and at no price.
• Name, email, phone, and the "I am" category are not sent to Meta or to Google. They do not build custom audiences, they are not used to target advertising, and they are not uploaded to any advertising platform.
• We do not receive from the platforms the names of people who saw our ads. What comes back from their side is aggregate numbers.
• We do not match advertising data against the list. Who is on the list and who visited the page are two records that never meet.

The difference between version 1 and version 2 of this Policy lives right here: version 1 said "we do not share for advertising" with no qualification, and with a pixel that became false. This Policy prefers the longer true sentence to the short unsustainable one — a false promise in a privacy policy is a deceptive practice before the American regulator (FTC Act, § 5, 15 U.S.C. 45).

6. Your data goes to the United States

This has to be stated plainly, because it is an international transfer: the company is American, the suppliers are American, and your data is stored and processed in the United States (LGPD, art. 33; art. 9, II).

If you are in Brazil, your data leaves the country through three routes, and each one has its reason:

The third route is what version 2 added, and it deserves the full sentence: when you accept the marketing category in the cookie notice, data about your browsing leaves Brazil and is processed by two American companies, Meta and Google, for advertising purposes (LGPD, art. 33). Refusing the marketing category blocks that route; the other two remain, because without them there is no website and no email.

What supports that transfer:

[CONFIRMAR COM JURÍDICO] which instrument the company adopts. The research recommends contractual safeguards with suppliers (LGPD, art. 33, II) over specific consent for the transfer (LGPD, art. 33, VIII), for a practical reason: consent is revocable at any time, and one revocation would knock out the basis for the whole transfer. The Brazilian authority published standard contractual clauses (Resolution CD/ANPD No. 19/2024) whose full text and adequacy deadline the research did not confirm. That is the second open question for counsel.

What the Brazilian authority has not done: recognize the United States as a country with an adequate level of protection. Until that decision exists, the adequate-country route (LGPD, art. 33, I) is unavailable and the transfer rests on contractual safeguards.

Provisional wording, to be confirmed: the transfer rests on contractual safeguards executed with each supplier that handles data on our behalf, under art. 33, II, of the LGPD.

[CONFIRMAR COM JURÍDICO] the pixel changes the analysis in this section, and it is the new question in version 2. Meta and Google are not ordinary processors: each imposes its own advertising data processing terms, and the transfer instrument, in that case, is whatever the platform offers in its advertising contract, not a contract Skill Builders drafts. Counsel has to say whether those terms satisfy art. 33, II, and, if they do not, which art. 33 route supports sharing the browsing data of a Brazilian visitor with the two platforms.

7. Cookies

Our use of cookies is described in the Cookie Policy, which forms part of this Policy by reference. In short: the website uses cookies necessary for it to work, Google Analytics cookies for analytics, and marketing cookies from the Meta pixel and the Google Ads tag. The analytics and marketing ones depend on your acceptance in the cookie notice and do not fire before it (ANPD Guidance, Cookies and Personal Data Protection, October 18, 2022).

The Cookie Policy owns this subject: it lists the three categories, names the tools, describes the cookie notice with the seven items the website implements, and explains remarketing in plain language.

If a pixel from another advertising network goes in, the Cookie Policy and this Policy are revised together, in the same act, before the pixel goes live.

8. Your rights

Brazilian law gives you nine rights, and it names them one by one. We reproduce all nine with their names and with what each one means in practice, because the law requires explicit mention of them rather than a cross-reference to an article number (LGPD, art. 9, VII, and art. 18).

(LGPD, art. 18, items I through IX)

8.1 How to exercise them, and how fast we answer

Write to [email protected] and tell us what you want. We do not require a special form, we do not require a reason, and we do not ask for documents beyond what is needed to confirm the request is yours.

• It is free. We do not charge for any of the nine rights (LGPD, art. 18, § 5).
• Confirmation and access in simplified format: immediately. A clear and complete statement, with the origin, criteria, and purpose of the processing: within 15 days of your request (LGPD, art. 19, I and II, and § 1).
• If we cannot comply right away, we reply within the same period with the reason: either that we are not the processing agent for that data, naming who is, or the factual or legal grounds preventing compliance (LGPD, art. 18, § 4).
• When we correct or delete, we immediately notify the processors we had shared with, so the correction or the removal happens there too (LGPD, art. 18, § 6).

8.2 How to leave the email list

You can leave at any time, two ways:

1. The unsubscribe link in every email we send. One click, no login, no form, no reason asked.
2. An email to [email protected] asking to be removed.

Withdrawing consent is free and straightforward, and it is that way because the law requires it (LGPD, art. 8, § 5). We process removals within 10 business days, which is the maximum period under the federal commercial email statute, and in practice we aim for the same day (CAN-SPAM, 15 U.S.C. 7704(a)(4); FTC, CAN-SPAM Compliance Guide).

Leaving the marketing list does not automatically erase your record. If you want the data deleted, ask for deletion: that is right 6 in the table above.

8.3 If you disagree with our answer

You may complain to the Brazilian National Data Protection Authority (LGPD, art. 18, § 1). We would rather sort it out with you first, and the privacy channel exists for that.

9. Security

We use technical and administrative measures to protect your data from unauthorized access, loss, alteration, and improper disclosure (LGPD, art. 46).

[CONFIRMAR COM JORGE/INFRA] the concrete list of measures. This section has to describe what actually exists rather than a generic list of good intentions: encrypted connection on the website and in the form, access to the sign-up database restricted to those who need it, passwords and second-factor authentication on supplier accounts, and a log of who accessed what. Declaring a measure that does not exist is worse than declaring nothing.

No system is impenetrable. If a security incident occurs with relevant risk or harm to you, we notify you and the Brazilian authority within a reasonable period, with what is known, what was affected, and what we are doing (LGPD, art. 48).

10. Children

This website is directed to adults. Signing up requires being 18 or older.

We do not request and do not collect information from children under 13, and no field in the form asks for a child's data (COPPA, 16 CFR Part 312).

We use no age field, no date-of-birth field, and no age verification mechanism, and that is a conscious decision. In the United States, the specific duty regarding children's data activates when a website asks for and receives information that allows the age of the person filling it in to be determined; a website that does not ask does not acquire that knowledge through that route (FTC, Complying with COPPA FAQ).

If you are a parent or guardian and you believe a child in your care submitted data through our form, write to [email protected]. We delete the data and confirm the deletion in writing (COPPA, 16 CFR 312.6).

11. Where this Policy does not go, and why

Written on purpose, so that an absence is not read as an oversight.

There is no Florida Digital Bill of Rights section. The Florida statute reaches companies with global gross revenue above US$ 1 billion that also operate one of three specific lines of business: half of revenue from online advertising, a smart speaker with a voice assistant, or an app store with at least 250,000 distinct apps. Skill Builders World USA does not clear the first threshold and operates none of the three (research, B.1, with the threshold confirmed across three independent sources).

There is no California section and no "Do Not Sell" button. The California statute reaches those meeting one of three thresholds: annual gross revenue above US$ 26,625,000, handling the data of 100,000 or more California consumers or households per year, or half of revenue from selling data. None is met today, and the first production is a limited lot (research, B.2).

The reason for leaving both out is the same, and it is not brevity: promising to comply with a law that does not reach the company creates a contractual obligation where the law created none, and leaves the company owing a response deadline it never staffed. See section 13, which is the door those sections come through when the time arrives.

There is no European regulation section. The trigger for the European regulation is not the European visitor: it is a clear intention to do business with customers in the European Union, and the mere accessibility of a website in Europe is not enough (EDPB, Guidelines 3/2018 on territorial scope). The website is Portuguese and English, with no euro pricing, no shipping to Europe, and no additional European language.

What changes that, worth recording as a trigger: shipping to the European Union, euro pricing, an additional European language, or paid advertising targeted to a European country. Any one of those activates the regulation and requires this Policy to be revised before the campaign runs.

That last trigger stopped being hypothetical in version 2. The company will run advertising on Meta and Google, and targeting a European country is a checkbox in the campaign manager, not a project. Whoever builds campaigns needs to know this: including an EU country in the targeting is a decision that goes through counsel before it goes live, the same way installing a new pixel does (EDPB, Guidelines 3/2018 on territorial scope).

12. If Brazilian and American law ask for different things

They do, and on one specific point they start from opposite premises: for commercial email, the American rule works by exit — you may send, and the recipient leaves whenever they want — while Brazilian law requires prior, specific, and prominent consent.

We apply the stricter rule to everyone, without splitting by language or by country. Everyone joins by an affirmative check, nobody gets a pre-checked box, and marketing authorization is always a separate, optional field. A different regime per language would be indefensible, because the page's language does not say where the person is: someone in Brazil can fill in the English version (LGPD, art. 5, XII, and art. 8, §§ 1, 2, and 4; CAN-SPAM, 15 U.S.C. 7704; Brazilian Consumer Protection Code, art. 39, III).

13. Changes to this Policy

This Policy has an effective date and a last-revised date, both at the top. When we change it, we publish the new version on this page and update both dates.

When a change materially affects what you authorized — a new purpose, new sharing, a new data category — we notify you by email before the change takes effect, and where the new purpose requires it, we ask for fresh consent rather than assume the old one (LGPD, art. 9, § 2).

We keep previous versions with their effective dates.

This clause is also the door for the sections that do not exist today. If the company crosses California's 100,000-consumer threshold, if it starts selling into the European Union, or if any other American state law comes to reach it, the corresponding section enters here through a dated revision, without rewriting the document. The California threshold crossed first is the volume one, not the revenue one, and it counts consumers whose data is handled rather than only consumers who buy — worth reassessing after the first year of sales (research, B.2).

Scheduled review: April 2, 2027 (semiannual review), with threshold reassessment on November 19, 2027.

14. Contact