Privacy Policy

For this instance, Start4Me is the organization identified to the user and may act as controller for data used to provide the service. Start4Me may also act as controller for its own operations or as processor when it handles data under a client institution's instructions.

If your access was provided by a school, clinic, company or other partner, that organization determines some processing purposes and must provide its own identity and contact details. If you are unsure, contact the organization that gave you access first.

The data varies with your role, the institution's configuration and the features you use:

• Account and profile: name, email, hashed password, Brazilian tax ID (CPF), phone number, address, country, language and time zone, when provided.
• Access and organization: permission role, linked institution, preferences, login sessions and records needed for security and auditing.
• Vocational journey and learning: assigned paths, progress, test responses and results, favorite professions, private ratings and viewed content.
• Guidance follow-ups: availability, appointments, meeting attendance, evaluations and information needed for support between students and professionals.
• Content you provide: private journal notes, interviews, form responses, uploaded files and other text or media you choose to save.
• Communications: chat messages, reactions, notifications, operational emails and delivery or audited administrative-access records.
• Technical and integration data: instance domain, dates and times, session identifiers and, when you connect a service, protected identifiers and tokens for Google Calendar or Meet.

We receive data directly from you, from the institution or professional responsible for your journey, from normal platform operation and, only when an integration is enabled, from the connected provider such as Google.

• Create and manage accounts, authenticate access and provide contracted features.
• Organize the vocational journey, display results and progress and support guidance by authorized professionals.
• Send essential communications, reminders and notifications and enable service-related conversations.
• Prevent abuse, enforce permissions, investigate incidents and maintain platform integrity.
• Meet legal or regulatory obligations and establish, exercise or defend legal rights.
• Diagnose faults and improve performance and usability with necessary data and, where possible, aggregated information.

Depending on the operation and the relationship with the user, processing may rely on performance of a contract or pre-contract steps, compliance with a legal obligation, exercise of rights, legitimate interests assessed with appropriate safeguards, and consent where required. Sensitive data receives enhanced protection and a specific legal basis.

The platform does not sell personal data and does not use test responses, private notes or vocational ratings for behavioral advertising.

Processing must always prioritize the best interests of children and teenagers, use age-appropriate information and involve guardians where the law requires. The institution providing access is responsible for obtaining the authorizations needed in its context.

Test results and indicators support reflection and guidance; they are not a diagnosis and are not used by the platform to make decisions with legal or similarly significant effects on a student without human involvement.

Access is limited to what each purpose and permission role requires. We may share data with:

• The institution providing the instance and its authorized professionals, according to each person's role and relationship with the student.
• Infrastructure, database, storage, email-delivery and technical-support providers bound by security and confidentiality duties.
• Google, only when you use Google sign-in or voluntarily connect Calendar or Meet, within the authorized scope.
• Services triggered by specific features, such as embedded Bunny videos, hosted fonts and Brazilian postcode lookups through ViaCEP.
• Public authorities, courts or third parties when needed to comply with law or a valid order, or to protect rights and safety.

Journal notes, vocational ratings and other private content are not public. Internal visibility follows authorized permissions and relationships in the platform.

We keep data while the account or relationship with the institution is active and for any additional period needed to fulfill the stated purpose, meet legal duties, provide security and auditing, and exercise legal rights. Data is then deleted or anonymized where applicable.

The specific period depends on the record type, the institution's contractual settings, legal time limits and any pending request or dispute. You may ask the responsible controller for the period that applies.

We use access controls by role and institution, protected sessions, encryption for integration tokens, input validation, isolation between instances, and monitoring, backup and recovery measures proportionate to risk.

No system is completely immune from incidents. If a relevant event occurs, we will take containment, investigation and notification steps for affected people and authorities where the law requires.

Under Brazil's LGPD and other applicable laws, you may request the following free of charge, as applicable:

• Confirmation of processing and access to your data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary, excessive or unlawful data, or data processed with consent, where applicable.
• Portability, subject to regulations and the protection of trade and industrial secrets.
• Information about entities with which data has been shared.
• Information about the consequences of refusing consent and withdrawal where consent is the legal basis.
• Review and explanation of solely automated decisions that affect your interests.
• Objection to unlawful processing and the right to petition the competent authority.

You can also read the official guidance from Brazil's National Data Protection Authority (ANPD).

Some technology providers, particularly Google services and contracted infrastructure, may process data outside Brazil. Where this happens, the controller must use a permitted transfer mechanism and contractual, technical and organizational safeguards consistent with the LGPD.

Contact the institution that provided your access through the channels it supplied, or use the support channel available in the platform. On an institutional instance, this is the appropriate route to identify the controller and data protection contact responsible for the request.

To protect your account, we may confirm your identity and request only the information needed to locate the records. Legal guardians may exercise rights for minors after appropriate verification.

We may update this policy to reflect legal, technical or service changes. Material changes will be communicated through an appropriate channel and the date at the top of this page will be revised.