Privacy Policy

This Privacy Policy ("Policy") describes how TwoBetter Tecnologia Ltda. ("TwoBetter", "we", "us", "Controller") collects, uses, shares, stores, and protects personal data of users of the TwoBetter Learning application ("App"). This Policy applies to residents of Brazil (LGPD — Law No. 13,709/2018), the European Economic Area, United Kingdom, and Switzerland (GDPR — Regulation (EU) 2016/679), and the United States (including, where applicable, California's CCPA/CPRA and equivalent state laws). Where the requirements of these laws diverge, we apply the standard most protective of the data subject in each jurisdiction of residence.

TwoBetter Learning shares account infrastructure (authentication via AWS Cognito) with the TwoBetter Dating application, operated by the same controller. Each app maintains its own processing purposes, privacy settings, and deletion flow, with one exception described in Section 5.1: your TwoBetter Learning progress level and badges are shown on your TwoBetter Dating profile if you use both apps with the same account.

2.1. Registration and account data

• Name; email address; authentication method (email and password, Google, or Apple);
• Authentication and session data managed through AWS Cognito;
• Profile avatar, gender, and age, voluntarily provided in Settings;
• Language and voice preference for content playback (accessibility/audio feature).

2.2. Onboarding and learning data

• Answers to the onboarding questionnaire about learning goals and relevant personal context, including multiple-choice questions about your current relationship status (for example, "Divorced or separated") and your emotional state regarding relationships (for example, "Afraid of getting hurt again");
• Progress through journeys and lessons, score, study streak, and ranking level;
• Free-text answers submitted in lessons' written-response steps;
• Posts, questions, answers, reports, and votes ("upvote"/"downvote") submitted to the community.

While relationship-status and emotional-state answers do not fall within the special categories of Article 5(II) of the LGPD or Article 9 of the GDPR, they concern personal and potentially sensitive aspects of your emotional life. We therefore apply to these answers the same safeguards described in Section 8 for sensitive textual content: use limited to pedagogical and journey-personalization purposes, no use for third-party advertising, and anonymization in aggregate use for product improvement.

We highlight that the free-text response steps and community posts are filled in by you and may, depending on what you choose to write, contain sensitive personal data about you or third parties (for example, a personal account that reveals sexual orientation, religion, emotional health, or relationship history). We recommend that you avoid including third parties' sensitive data without their consent. We treat this free-text content as potentially sensitive, subject to the additional safeguards described in Section 8.

2.3. Usage, device, and communication data

• Device identifiers, operating system, app version, IP address;
• Payment and subscription data, processed by third-party processors — we do not store full card numbers;
• Customer-support records and communications with us;
• External sharing interactions (when you choose to share progress on social media, only the shared content itself leaves the App, under the destination platform's control).

• Contract performance (LGPD Art. 7(V); GDPR Art. 6(1)(b)): creating and managing your account, delivering educational content, operating journeys, ranking and community, processing subscriptions;
• Consent (LGPD Art. 7(I); GDPR Art. 6(1)(a)): sending optional promotional communications; where applicable, processing sensitive data you voluntarily disclose in free text;
• Legitimate interest (LGPD Art. 7(IX); GDPR Art. 6(1)(f)): AI content moderation, fraud and abuse prevention, platform security, product and pedagogical-model improvement, aggregate and anonymized analytics;
• Compliance with a legal obligation (LGPD Art. 7(II); GDPR Art. 6(1)(c)): tax-data retention, responding to court orders, age verification.

Community posts go through an automated artificial-intelligence check before appearing in the feed, resulting in approval, referral for human review, or automatic rejection. This processing constitutes an automated decision that may produce effects on you (for example, content not being published). You have the right to request information about the general criteria used in this screening (LGPD Art. 20) and to request human review of a blocking or rejection decision that significantly affects you (LGPD Art. 20; GDPR Art. 22), by contacting our support channels.

We do not sell, rent, or trade your personal data. We share data, to the extent necessary, with:

• Companies within TwoBetter's corporate group, including outside Brazil, for technical operation and support;
• Other members: (i) information you choose to post to the community; (ii) on the progress ranking, your full name and profile photo, shown to all other members — there is currently no setting to restrict this display; and (iii) shares you initiate;
• Infrastructure service providers (cloud hosting, authentication, video hosting and streaming, email and notification delivery, payment processing, automated content moderation, data analytics), under confidentiality and data-processing agreements;
• Public authorities, when required by law, court order, or to protect rights, safety, or to investigate fraud and crime.

5.1. What we share with TwoBetter Dating

If you use TwoBetter Learning and TwoBetter Dating with the same account, your TwoBetter Learning progress level and badges are shown as an informational block on your TwoBetter Dating profile, visible to other Dating users. No other TwoBetter Learning data — lesson answers, community posts, ranking — is shared with TwoBetter Dating. Deleting your TwoBetter Learning account does not, by itself, delete your account or data on TwoBetter Dating, and vice versa, except where expressly stated on the applicable deletion screen at the time of the request.

Our servers and service providers may be located outside Brazil. Where data is transferred internationally, we ensure compliance with LGPD (Art. 33) and, where applicable, GDPR Chapter V, including standard contractual clauses or equivalent adequacy mechanisms, and security measures equivalent to those required in Brazil, under ANPD Resolution CD/ANPD No. 19/2024.

We retain your data for as long as necessary for the purposes described in this Policy, subject to the following reference periods, without prejudice to a different period required by a specific legal obligation:

• Registration and progress data: up to 5 (five) years after account closure, for defense in judicial, administrative, or arbitration proceedings, and legal compliance;
• Lesson answers and community posts linked to your identity: up to 6 (six) months after permanent account deletion;
• Access and security logs: up to 6 (six) months, under Article 15 of Brazil's Marco Civil da Internet (Law No. 12,965/2014), where applicable;
• Inactive accounts: data of accounts with no login for more than 1 (one) year may be anonymized or deleted, following prior notice sent to the registered email before deletion.

You may delete your account at any time in Settings, using the "Delete account" option, with no need to select a reason beforehand. The App's screen states that data is "permanently removed"; that statement refers to data tied to your user experience (progress, answers, posts linked to your identity), which becomes inaccessible to you and other members immediately upon confirmation. We may still retain, for the minimal residual periods indicated in this Section and within the limits of the law, records necessary to comply with a legal obligation (for example, payment tax records) or for defense in legal proceedings, and may keep aggregate, anonymized data for statistical purposes. Deleting your TwoBetter Learning account does not, by itself, delete an active TwoBetter Dating account, except where expressly stated on the applicable deletion screen at the time of the request.

We recognize that lesson answers, onboarding answers about relationships and emotional state, and community posts may, at the user's own initiative, contain sensitive or personally delicate data. We apply the following safeguards: (i) community posts pass through automated screening before public display, which reduces, though does not eliminate, the risk of sensitive-data exposure to other members; (ii) you may edit or delete your own posts at any time; (iii) this content is not used for third-party targeted advertising; and (iv) aggregate use of this content to improve moderation and pedagogical models is anonymized whenever technically feasible.

We implement technical and organizational data-protection measures, including encryption of data in transit and at rest, role-based access controls, continuous threat monitoring, staff training, and regular security assessments. No system is one hundred percent secure; in the event of an incident with relevant risk to data subjects, we will notify the competent authorities and affected data subjects, in accordance with applicable law.

We use cookies, device identifiers, and similar technologies for authentication, remembering preferences, measuring performance, and, where consent is required, for analytics purposes. You can manage these preferences in your device or App settings.

11.1. Users in Brazil (LGPD)

Under Article 18 of the LGPD, you have the right to: confirmation of the existence of processing; access; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data; portability; deletion of data processed with consent; information about sharing; information about the possibility of not giving consent; withdrawal of consent; and review of automated decisions.

11.2. Users in the European Economic Area, United Kingdom, and Switzerland (GDPR)

You have the right to access, rectification, erasure, restriction of processing, portability, objection to processing (including for direct marketing), and the right not to be subject solely to automated decisions with legal or significant effect, plus the right to lodge a complaint with the data protection authority in your jurisdiction.

11.3. Users in the United States

Residents of California and other states with equivalent legislation have the right to know what data we collect, to access, correct, or delete it, to opt out of the sale or sharing of data for cross-context behavioral advertising, and not to be discriminated against for exercising these rights. TwoBetter does not sell personal data.

11.4. How to exercise your rights

Requests can be made in the App's Settings, under "Privacy and Communications", or through the contact channels listed in Section 13. We will respond within the deadlines required by the law applicable to each request, and may request identity verification before processing it.

The App is intended for individuals 18 years of age or older. The sign-up screen and the "Edit age" screen offer "18 or younger" as an option; selecting it constitutes an indication of access by a minor for the purposes of this Policy and Section 2 of the Terms of Use, and should trigger immediate interruption of the flow, without collecting the following answers. We do not knowingly collect data from minors. If we become aware of data collection from a minor, we will block the account and permanently delete the personal data collected.

Controller: TwoBetter Tecnologia Ltda., taxpayer ID (CNPJ) [to be completed], registered at [full address to be completed]. Our Data Protection Officer ("DPO"), [name to be completed], can be reached at dpo@twobetter.com or through the App's support channels, for the exercise of rights, questions, complaints, or notification of incidents related to personal data.

This Policy may be updated periodically. Material changes will be communicated through a prominent notice in the App or by email, with reasonable advance notice. This version fully replaces any prior version.

This Policy will be interpreted under Brazilian law, without prejudice to the application of GDPR provisions and U.S. state laws to data subjects residing in those jurisdictions, as set out in this Policy.