Privacy Policy

Account data. When you sign in via Google, we receive your name, email address, and profile photo from Google. We store this information in our database for as long as your account is active.

Activity data. When you use the client portal or admin dashboard, we store your project comments, approvals, library uploads, and timestamps of actions you take.

Applicant data. If you submit a job application via the Careers section, we collect: your name, email, country, primary discipline, years of experience, links you choose to share (LinkedIn, portfolio, demoreel, social networks), CNPJ status and number (if Brazilian and you provide it), and any cover-letter text you submit. Submission requires explicit consent under LGPD Art. 7(I).

Academy lead data. If you sign up via the Academy welcome form, we collect: your name, email, age, the program you're interested in, and your LGPD consent stamp. Adult-only: Academy is 18+; we record your 18-or-older self-certification alongside your age. Academy playback data (when a video is played, by whom, for forensic attribution of any leaked material) is collected only after you sign in and a program access grant has been issued.

Contact-form data. If you message us via the contact form, we collect your name, email, optional company, the message content, and your consent stamp, plus the submitting IP for abuse forensics — used solely to respond to your inquiry.

Technical data. We use a single session cookie (__session) to keep you signed in. Optional analytics cookies are used only with your permission, as described below. We do not use third-party advertising trackers.

Optional measurement covers selected public pages of Uppercut Studio and participating products (Academy, TileSlicer/Atlas, Versus, FX, WinTinyBar and Flakback). Only after “Accept cookies”, Google Analytics receives public page views and predefined actions, using analytics cookies to distinguish browsers and sessions. Arbitrary query strings, form contents and account identifiers are excluded. Engagement time from the isolated collector is not presented as attention to the page.

When enabled for the product, Microsoft Clarity records eligible public navigation and clicks for session replay and heatmaps, with page text masked. Documents containing forms or input fields, private pages, admin, accounts, signed-in sessions, and URLs with query strings or fragments are excluded from replay. Recording is stopped before private navigation or input interactions. No private editor or user project is recorded.

Your choice is stored for up to six months per product. A product’s Uppercut subdomains can share its choice; custom domains require a separate choice. “Cookie preferences” lets you select “Necessary only” at any time. This stops collection, clears accessible measurement cookies and reloads the page when needed to remove the recorder. Withdrawal does not erase data already processed by Google or Microsoft; contact us for data-rights requests.

Separate first-party product counters record aggregate visits, download clicks and checkout intentions without persistent visitor identifiers. Existing authenticated credit records provide aggregate counts of completed operations inside the protected admin; they are not sent to Analytics or Clarity. Cookie preference storage and sign-in cookies remain separate from optional measurement.

Eonwisp e o jogo clássico Frase Oculta usam somente contadores próprios após consentimento: páginas abertas, cliques de contato e partidas iniciadas ou concluídas, conforme o produto. Armazenamos totais por dia e produto, separando testes. Não registramos identidade, palavras, respostas, movimentos ou gravações; não carregamos Analytics nem Clarity nesses jogos. A infraestrutura recebe informações técnicas necessárias para entregar requisições; endereços de rede são usados temporariamente em memória para limitar abuso, sem entrar nos contadores. “Só os necessários” interrompe novos eventos.

Eonwisp and the classic Frase Oculta game use only consented first-party counters: page views, contact clicks and game starts or completions where applicable. We store daily product totals, separating tests, without visitor identifiers, words, answers, movements or recordings. Neither Analytics nor Clarity loads in these games. Network addresses are temporarily used in server memory for abuse limits, never stored in counter records. Infrastructure may process technical request logs. Choosing “Necessary only” stops further events.

• Execution of a contract (Art. 7, V) — to provide the Service you signed up for.
• Legitimate interest (Art. 7, IX) — to operate, secure, and improve the Service.
• Legal obligation (Art. 7, II) — for financial records required by Brazilian tax law (Receita Federal).
• Consent (Art. 7, I) — for any optional features clearly identified as such.

We share data only with the following service providers, who process data on our behalf under contract:

• Google LLC / Firebase and Analytics — hosting, authentication, optional audience measurement, database, file storage. Servers may be located outside Brazil.
• Google Cloud Vertex AI — optional AI-assisted features (e.g. spam filtering on submitted messages). Receives only the specific content being processed; inputs are not used to train Google's models. Servers may be located outside Brazil.
• Microsoft / Clarity — optional public session replay and heatmaps after consent, when enabled. Processing may occur outside Brazil.
• GitHub, Inc. — source-code hosting; does not receive client data.
• (future) Stripe — payment processing, when and if paid features are introduced.

All transfers outside Brazil comply with LGPD Art. 33 (international data transfer).

• Account data: kept for as long as your account is active, plus 30 days after deletion to handle support requests.
• Project / activity data: kept until you or the project owner deletes it.
• Applicant data: kept for two (2) years from the date of submission, then automatically deleted unless you have been hired, have opted into a longer retention, or applicable law requires otherwise. You may request earlier deletion at any time by emailing careers@uppercut.studio; we comply within 15 days per LGPD Art. 19.
• Academy lead data: kept for two (2) years from your last activity (submission, sign-in linked to the lead, or program participation), then deleted. Earlier deletion by request via academy@uppercut.studio.
• Contact-form data: kept for two (2) years from your message, then deleted. Earlier deletion by request via contact@uppercut.studio.
• Academy playback data (audit log of which user played which lesson, when, and the forensic watermark imprinted on that play): kept for two (2) years from the play event. Used solely to attribute any leaked copy of exclusive material to the originating user.
• Financial records (invoices, payment receipts): kept for 5 years per Brazilian tax law.
• Backup snapshots: kept for 90 days for disaster recovery, then irrecoverable. Additionally, a 7-day point-in-time recovery (PITR) window protects against accidental writes and corruption.

You have the right to:

• Access your data
• Correct incomplete or outdated data
• Delete your data (subject to retention periods above)
• Port your data to another service in a structured, commonly-used format
• Withdraw consent at any time
• Object to processing based on legitimate interest
• Be informed of subprocessors

To exercise any of these rights, email rodrigo@uppercut.studio (or careers@uppercut.studio for applicant-data requests). We respond within 15 days per LGPD Art. 19.

We use a single essential session cookie (__session) to keep you signed in. It is not used for tracking. You can clear it at any time via your browser settings; doing so will sign you out.

The professional client portal and Academy are intended for adults. Eonwisp and the classic Frase Oculta game are available to all ages. Katapult's current alpha account requirements are described in its own terms. Site Kit does not record sessions in these games. Counters described above do not identify players or record their content. If a child has provided personal information, a parent or guardian can contact us to request its removal.

We rely on Firebase's encryption-at-rest and encryption-in-transit. Access to our backend systems is gated by Google authentication and role-based permissions. Backups are encrypted before leaving production systems.

We follow industry-standard practices but cannot guarantee absolute security. If a personal data breach occurs that meets LGPD's reporting threshold (Art. 48), we will notify affected users and the Autoridade Nacional de Proteção de Dados (ANPD) within a reasonable time.

We may update this Policy from time to time. Material changes will be notified via email to active users at least 30 days before they take effect. The current version's effective date is at the top of this page.

Data Protection Officer / Encarregado: Rodrigo da Costa
Email: rodrigo@uppercut.studio

For LGPD-specific complaints, you may also contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.