Privacy Policy

1. Data controller

The data controller is [RAZÃO SOCIAL A DEFINIR], Brazilian company registration (CNPJ) [CNPJ A DEFINIR]. For any privacy matter, including contacting our data protection officer (DPO), email contato@tenisestrategico.com.br.

2. Data we collect

• Account: email, display name and password (stored only as a hash by our authentication provider). If you sign in with Google, we receive the name and email of your Google account.
• Profile and preferences: language, dominant hand and self-reported level.
• Service usage: your answer to each situation, matches, points, daily streak and achievements.
• Payment (Premium plan): payments are processed by Stripe. We never receive or store your card number; we only keep the customer ID, plan, status and renewal date.
• Technical data: essential cookies, IP address and access logs kept by our hosting providers for security.
• Advertising (Free plan): if you consent, Google AdSense uses cookies and identifiers to show and measure ads.
• Usage statistics: if you consent, Google Analytics records pages visited, actions on the site (such as situations answered and matches completed), device type and approximate location. We never send your name, email or account identifiers to Google Analytics.

We do not collect your date of birth, identity documents or precise location.

3. Purposes and legal bases

• Creating and maintaining your account, saving your progress and providing the service, including the Premium plan — performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Security, fraud prevention and preventing abuse of the free plan limits — legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Aggregated, anonymous statistics such as "X% of players chose this option" and the ranking — legitimate interests.
• Advertising cookies, personalized ads and Google Analytics statistics — consent (LGPD art. 7, I; GDPR art. 6(1)(a)), which you can withdraw at any time.
• Keeping payment records — legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)).

4. Public ranking

Your display name and points appear in the weekly and all-time rankings, visible to other users. Your email is never shown. You can change your display name in Settings.

5. Who we share data with

We do not sell your data. We only share it with processors that help us provide the service, under contract:

• Supabase — database and authentication.
• Our website hosting provider (e.g. Vercel or Cloudflare).
• Stripe — payment processing.
• Google — Sign in with Google (if you choose it), Google AdSense and Google Analytics (the last two only with your consent).

Some of these providers store data outside Brazil and the EU. These international transfers rely on standard contractual clauses and appropriate safeguards (LGPD art. 33; GDPR chapter V).

6. Cookies

• Essential (always on): login session, chosen language, your cookie choice and the sample-situation counter for visitors.
• Measurement (optional): Google Analytics cookies (such as _ga), loaded only after your consent.
• Advertising (optional): Google AdSense cookies, loaded only for Free plan users and only after your consent. Premium subscribers never load AdSense.

You can change your choice at any time under "Cookie preferences", in the footer or in Settings.

7. How long we keep data

We keep your data while your account exists. When you delete your account, we erase your profile, answers, matches, achievements and subscription from our database. Payment records may be kept by Stripe for the period required by law. Backups are overwritten on a regular cycle.

8. Your rights

Under the LGPD (art. 18) and the GDPR you may:

• Confirm and access the data we hold about you.
• Correct incomplete or outdated data (name, language and preferences in Settings).
• Receive a copy of your data in an open format ("Export my data" button in Settings).
• Delete your account and data ("Delete account" button in Settings).
• Withdraw consent for advertising and measurement cookies.
• Know who we share your data with and object to processing based on legitimate interests.

For any other request, email contato@tenisestrategico.com.br; we reply within 15 days. You may also complain to Brazil's National Data Protection Authority (ANPD) or to the supervisory authority in your country.

9. Children and teenagers

The service is intended for people aged 13 or older. Users under 18 should use it with the consent and supervision of a parent or guardian. We do not collect users' age; if we learn that a user is a minor, we will not show them personalized ads. Parents or guardians can request deletion of an account by emailing contato@tenisestrategico.com.br.

10. Security

We use encrypted connections (HTTPS), passwords stored only as hashes, per-user access control in the database, and points and payments calculated only on the server. No system is completely immune; if a relevant incident occurs, we will notify affected users and the competent authorities.

11. Changes

We may update this policy. Relevant changes will be announced on the site or by email before they take effect.