Last updated: August 2026
1. Data Controller
YuSay (yusay.io) is the controller of personal data collected on this platform, under the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018). Questions may be sent to privacy@yusay.io.
2. Data Collected
We collect: name, email, and password (hashed) at registration; phrases entered for translation; flashcard review history; payment information processed by Stripe (we do not store card data); IP address and access logs; and linked bot channel identifiers (WhatsApp, Telegram).
3. Purposes of Processing
Your data is used exclusively to: provide the Mandarin learning service; process payments and manage subscriptions; send transactional communications (confirmations, password resets); improve service quality through aggregated and anonymized analytics; and comply with legal obligations.
4. Data Sharing
We do not sell your data. We share information only with essential service providers: OpenAI (AI translation processing), Stripe (payments), Resend (transactional emails), and Supabase/PostgreSQL (hosted database). All are contractually required to protect your data.
5. Data Retention
Your data is retained while your account is active. You may request complete deletion of your account and all associated data at any time via app Settings or by emailing privacy@yusay.io. Deletion is processed within 30 days.
6. Your Rights (LGPD)
You have the right to: confirmation and access to your data; correction of incomplete or inaccurate data; anonymization, blocking, or deletion of unnecessary data; data portability; withdrawal of consent at any time; and objection to processing. To exercise these rights, contact privacy@yusay.io.
7. Cookies and Tracking
We use strictly necessary cookies for authentication (NextAuth session) and preference cookies (language, theme). We do not use third-party advertising tracking cookies. Teacher referral cookies are temporary (1 hour) and expire automatically.
8. Security
We implement technical and organizational measures to protect your data, including: HTTPS/TLS transmission; bcrypt-hashed passwords; database access restricted via environment variables and network policies; and periodic security reviews.