Fluize · HomePortuguês

Fluize Privacy Policy

Version 2.1 · effective from 2026-10-25

1. Who we are and who is accountable for your data

Fluize is the language course from LearningFromAI, a YourFirstAI solution.

• Organization responsible for your data (controller): YourFirstAI Inc., a federal Canadian corporation (CBCA, No. 1793388-6), 151 Charles St. W., Suite 100, Kitchener, ON N2G 1H6, Canada.
• Privacy Officer (Canada), also our Data Protection Officer (encarregado, Brazil's LGPD) and person in charge of the protection of personal information (Quebec's Law 25): the director of YourFirstAI Inc., Alexandre Rosas Brandao, at [email protected].

This policy follows the 10 fair information principles of Canada's privacy law (PIPEDA, Schedule 1). Here is where you'll find each one:

2. What we collect and why

Purchases, the subscription and the points program only work when they are switched on in Fluize; while they are off, there are no purchases, no charges and no points earned or redeemed. The help panel also only appears when it is switched on. While it is off, nothing you write or do in the app goes to HelpDeskPro: only, when the account is deleted, its identifier (section 8.1), and, where the panel exists, the request for its code when pages load (section 6.1).

The legal bases as named in Brazil's LGPD and the EU's GDPR are in sections 15 and 16.

3. Your consent

• What the service needs (account, progress, purchase, security) comes with signing up: without it, the course can't work. The sign-up screen links to this policy.
• Anything optional asks for a separate yes: the newsletter (an unticked box at sign-up, adults only), votes, the waiting list, recording audio in a help request, and signing in with Google or LinkedIn.
• Points program. Every account gets a personal invite code, created automatically. If you created your account through an invite link, the referral is recorded at sign-up. Points only come into play if you use your code or report problems. If you don't want to take part, don't share your code; and if you don't want your sign-up to count as someone's referral, write to [email protected] and our team will undo it.
• You can withdraw optional consent at any time, through the link in any newsletter or at [email protected]. Withdrawing doesn't undo what was done before, and the course stays the same.

We follow the Office of the Privacy Commissioner of Canada's guidelines for meaningful consent: the essentials first, in layers, and a clear line between what's required and what's your choice.

4. What we don't collect and what we don't do

• We don't collect your card number (Stripe keeps it), your contacts, your precise location or your voice, except an audio recording you choose to make in a help request, which is turned into text and not kept by us (section 6.1).
• Your Speaking-mode recording stays on your device while the screen is open. It is never sent.
• The placement test runs on your device and the result isn't saved.
• We don't sell or rent personal information. We don't use your data for advertising, ad profiles or cross-site tracking.
• We don't use your data to train AI models, ours or anyone else's. The AI that creates and checks the course's voices and images receives only course text and course audio (section 13).
• We use what you write to [email protected] only to reply to you and to handle your rights. Your message goes through Cloudflare's email forwarding and lands in the team's Google Workspace inbox (section 6.1). Under an internal rule, the AI tools the team uses don't read these messages.

5. Signing in with Google or LinkedIn

If you choose to sign in with Google or LinkedIn, we ask only for the basics: your name, your email and, if available, your picture (the openid, email and profile scopes). We use them only to create your account and sign you in. We never ask for your contacts, never read your messages and never post anything on your behalf.

Signing in with LinkedIn isn't available yet; once it is, what this section says applies to it.

On the sign-in screen, the Google button comes from Google itself: when that screen opens, Google receives technical data from your browser (such as your IP address) and may use its own cookies, under its own policy, even if you don't sign in with it.

Limited Use (Google). Fluize's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice: we use this data only to sign you in to Fluize; we don't sell it; we don't use it for advertising or to train AI models; and no one on our team reads it, except at your request, for security, or when the law requires it.

6. Who receives your data

6.1 Service providers: they work for us

These companies handle data on our behalf, only to provide their service to us, and are bound by contract to protect it. We remain accountable for what they do with it.

Support (HelpDeskPro). HelpDeskPro isn't another company: it is the customer support system of YourFirstAI Inc. itself, the same company responsible for Fluize, and it follows this policy. It uses providers that work for us like the ones in this table: Supabase, Inc., where requests are kept, in a database separate from Fluize's that is currently in the United States; Cloudflare, Inc., which delivers the panel; Google (Gemini API), to turn audio into text; and Amazon Web Services (Amazon SES), once the email notice is switched on. Where the panel exists, the app's pages load its code from HelpDeskPro, and that request goes through Cloudflare with your IP address and browser, like any page. The Write to the team panel is HelpDeskPro. When you open it, Fluize sends HelpDeskPro a digitally signed message that says who you are: your account identifier, your email (always an email you have already confirmed), whether the account belongs to someone under 18 (based on the age range you declared; with no age range, the account counts as a minor's) and the interface language. Fluize doesn't send your password, your session, your name, your exact age range, your progress, your purchases or your points. What you write in the panel goes straight to HelpDeskPro, together with:

• a screenshot, only if you tap to attach one: it shows whatever is on the screen, such as your name or your progress; password, card and email fields are covered, and you see a preview and can cover more before sending;
• an audio recording, only if you record one and say yes, and only for people 18 and over: HelpDeskPro sends the recording to Google (Gemini API) only to turn it into text, and doesn't keep the recording;
• the screen's technical context: the page address, the screen size, the browser, the language, and the page's recent errors and failed connections. Everything after ? and # is removed from the address, and in the address and the errors, emails, long codes and long numbers are replaced with markers such as [email].

To tell you where your request stands, HelpDeskPro sends Fluize signed notices (request created, answered, resolved, accepted). From each notice we keep only its type, the request's category, whether it could earn points and the notice's own code, not linked to you.

6.2 Independent third parties: they decide about their own data

When you choose to use these services, they receive data about you and handle it under their own policies, as independent organizations. We don't control what they do with it.

6.3 The Fluize team

Very few people have admin access. They see what's needed for support and fraud prevention: email, name, unlocked levels, points, purchases, time per unit and mode, referrals, reports and help requests. These are logged: courtesy grants, revocations, point reversals and adjustments, and also opening a person's profile and exporting the list of people. An exported list stays only on the team's computer and is deleted within 30 days.

6.4 When the law requires it, and change of ownership

We may disclose data to authorities when a valid law compels us to, and only what is required. In a sale or merger of the company, data may pass to the new owner, who must honour this policy; we'll tell you first.

7. Where your data is stored and cross-border transfers

Fluize's database and service emails are in Canada. The providers in section 6 and HelpDeskPro may process data in other countries, mainly the United States. There, local authorities may be able to access data under that country's laws.

Under Canadian law, we remain accountable for data a service provider handles for us in any country. That's why we only use providers bound by contract to protect the data at a level comparable to ours. HelpDeskPro is ours, follows this policy and uses the providers in section 6.1. Section 15 (Brazil), 16 (European Union) and 17 (Quebec) cover what else applies if you are there.

8. How long we keep data

8.1 Asking to delete your account

In Account, tap Ask to delete my account, or email [email protected] from your account's address. Within 30 days:

• if your subscription is still charging: the Delete my account button only deletes after you cancel it in My account; if you ask by email or with the Ask to delete my account button, we cancel the subscription when we receive the request; if any charge goes through after it, we refund it;
• we delete your email, sign-in, profile, progress, preferences, unlocked levels, votes and notes;
• the points ledger, referrals and purchase and subscription records are kept for the periods above, but no longer linked to you: the identifier left behind doesn't point to anyone in Fluize. This keeps the audit trail and meets tax law. Stripe's own payment record keeps the data Stripe requires;
• your unlocked levels and points are lost with the account.

In HelpDeskPro. When Fluize has the help panel, deleting your account also reaches HelpDeskPro, whichever way you ask: with the Delete my account button, we notify HelpDeskPro right away; when you ask by email or with the Ask to delete my account button, the team sends the same notice when it deletes the account. HelpDeskPro deletes your screenshots and blanks the text of everything in your requests: what you wrote, the text of your audio recordings, the team's replies and internal notes, and system messages; it also deletes the technical context, the summary made at triage, your email and your name. Anything that arrives after the notice is stored without text, and screenshots are discarded. At the same time, your account's code is replaced with a randomly drawn pseudonym that isn't derived from it and can't be computed from it. What remains there, without text and only under that pseudonym: the record of each request and each message (its type, suggested priority, dates, status and counts); the record of each screenshot, with only a code (hash) of the deleted file; your Yes/No answer about the fix and the language the notice was sent in; and a flag that the account belonged to a minor, if it did. Also kept: security hashes (the hash of the deletion request and anti-abuse markers, for about 2 days) and the audit log; what the team wrote in records about general problems with the app, which aren't your request; and backups, until they roll out of their cycle. Apart from backups, until they roll out of their cycle, your account's old code remains there in only two cases: in a “request accepted” notice still queued for Fluize, until delivery ends (about 1 day at most); and, if your account was linked to a HelpDeskPro team sign-in, as a fingerprint (hash), for about 90 days, used only to stop that team member from handling their own requests. If the notice doesn't get through, we keep only the deleted account's identifier, with no email or name, and send it again until HelpDeskPro confirms, within the same 30 days.

We confirm by email once deletion is done.

9. On your device: local storage and cookies

Fluize sets no cookies of its own and uses no advertising cookies or trackers. We also don't run any visitor counter in your browser.

The app keeps on your device what it needs to work, including offline:

When you sign out, paid content and your session are deleted. Progress and preferences stay on the device; on a shared device, you can remove them by clearing the site's data in your browser.

Third parties: Cloudflare may set a technical security cookie to tell people from bots; Google sets its own cookies when the "Sign in with Google" button appears. We don't use either for advertising.

10. Emails

• Service emails (confirmation, password reset, access, changes to these documents) come from [email protected]. They are part of the service and don't require consent.
• Newsletters go only to people who ticked the box at sign-up, at most once a month, always with our name, our address and a one-click unsubscribe link, as Canada's Anti-Spam Legislation (CASL) requires.
• Points program invitations are never sent by us: the person who invites sends them (see the Points Program Rules).

11. Safeguards and breaches

We use encrypted connections, a database with row-level access rules (each person sees only their own data), server keys kept out of the code, bot checks, rate limits and the smallest possible number of people with admin access.

If a breach happens:

• we record every breach of security safeguards involving personal information in an internal register and keep it for at least 5 years (Canadian law requires 24 months; Brazil's ANPD, 5 years);
• if there is a real risk of significant harm to you, we notify you and the Office of the Privacy Commissioner of Canada as soon as feasible;
• if you are in Brazil and the incident may cause relevant risk or harm, we notify the ANPD and you within 3 business days;
• in Quebec, we notify the Commission d'accès à l'information and you when there is a risk of serious injury;
• in the European Union, if the GDPR applies, the competent authority within 72 hours.

No system is 100% secure. If you notice anything odd in your account, write to [email protected].

12. Children and teens

• Children under 14 can't have an account. Email sign-up refuses. Anyone who signs in with Google or LinkedIn answers the age question right after: if they declare they are under 14, the session ends, the account doesn't open, and we delete the data received within 30 days. A child may study through an adult's account (parent, guardian or teacher), who holds the account and supervises its use.
• Ages 14 to 17 may have an account when a parent or guardian knows and agrees: choosing that age range at sign-up confirms this, and the parent or guardian supervises its use. The app asks for an age range, not an ID.
• For anyone under 18, the app works this way out of the box: no referral points, no invitations and no newsletter, no advertising and no commercial profiling. In the help panel, an account belonging to someone under 18, or with no declared age range, can't record audio.
• We handle minors' data in their best interests: only what's needed to study.
• A parent or guardian can ask for access to, correction of or deletion of a minor's data at [email protected].
• If we learn that a child created an account alone, we close it and delete the child's data.

13. Automated decisions and artificial intelligence

• Placement test: it only suggests where to start, on your device. You choose the level.
• Automatic points rules: caps, waiting periods and the age rule are applied by the system.
• Fraud detection: the system flags signals (many referrals within 24 hours, several referred accounts from the same network or device, referred people who don't study within 7 days, repeated rejected reports). These signals only alert the team: no account is blocked and no point is reversed until a person reviews it and records the reason. A school sharing one network is normal.
• You can ask for a human review of any decision about your points or your account at [email protected].
• What AI creates: the audio voices are synthetic and the scene images are also AI-generated. The characters are fictional. To create and check these materials, we send Google (Gemini API) only course text and course audio. None of your data, including your reports, goes into this process.
• Audio in a help request: if you record one, HelpDeskPro sends it to Google (Gemini API) only to turn it into text; the recording isn't kept by us (section 6.1).

14. Your rights and how to use them

You can ask for:

• access to your data and to how it is used and shared;
• correction of anything wrong or incomplete (we keep data as accurate as its purpose needs);
• deletion of your account and data (section 8.1);
• a copy of your data in a commonly used format (portability);
• withdrawal of consent for anything optional;
• a human review of an automated decision;
• to challenge how we handle your data.

How to ask: in Account (deletion request) or at [email protected]. To protect you, we reply to the account's email address or ask you to confirm your identity before showing or deleting data. A minor's parent or guardian can also ask.

Timing: we reply within 15 days. If a request is complex, we'll tell you before the deadline and explain why. Requests are free.

If you're not satisfied, you can complain to an authority:

15. If you are in Brazil

• Brazil's LGPD applies to you, because Fluize is offered to people in Brazil.
• Controller: YourFirstAI Inc. (section 1). Data Protection Officer (encarregado): the director of YourFirstAI Inc., Alexandre Rosas Brandao, [email protected].
• Legal bases (art. 7): performance of contract (V) for your account, progress, levels, purchases, subscription, reports, help requests and the points-program rules; legal obligation (II) for tax records; legitimate interest (IX) for security, fraud prevention, study sessions and totals; consent (I) for the newsletter, votes, the waiting list and audio recordings in help requests. We don't process sensitive data (art. 11).
• Your rights (art. 18): confirmation and access, correction, anonymization, blocking or deletion of unnecessary data, portability, deletion of data processed with consent, information about who we share with, information about the option not to consent, withdrawal of consent, objection to processing based on legitimate interest, and review of automated decisions (art. 20).
• International transfer (art. 33): your data goes to Canada and to the providers in section 6 (help requests go straight to HelpDeskPro's database, currently in the United States), because this is needed to perform the contract you enter into with us when you create an account (art. 33, IX, with art. 7, V).
• Incidents: we notify the ANPD and you within 3 business days when there is relevant risk or harm.
• Minors and the ECA Digital (Law 15.211/2025): the measures the app applies are in section 12: minimum age of 14, no advertising or commercial profiling, and no referral points, invitations or newsletters for anyone under 18, with parent or guardian requests by email.

16. If you are in the European Union

• Fluize isn't directed at the European Union: prices and charges are only in Canadian dollars (CAD), the company's own currency, never in euros, the Portuguese we use, in the interface and in the course, is Brazilian Portuguese, and we don't market there. For now, we don't sell levels or the subscription to people in the European Union.
• Even so, if you study from there, you get every right in this policy, which covers those in the GDPR (arts. 15 to 22). We have no representative in the European Union; if we start offering courses to people living there, such as Italian, we'll appoint one, as GDPR art. 27 requires.
• If the GDPR applies, the legal bases are: contract (art. 6(1)(b)) for your account, progress, purchases, subscription and help requests; legal obligation (art. 6(1)(c)) for tax records; legitimate interests (art. 6(1)(f)) for security, fraud prevention and totals; consent (art. 6(1)(a)) for the newsletter, votes, the waiting list and audio recordings in help requests.
• Transfers: Canada has a European Commission adequacy decision for organizations subject to PIPEDA, like YourFirstAI. Service providers in the United States process data under their data protection agreements.
• Complaints: your country's data protection authority.

17. If you are in Quebec

• The person in charge of the protection of personal information is the director of YourFirstAI Inc., Alexandre Rosas Brandao, at [email protected].
• Until these documents are available in French, Fluize isn't offered in Quebec: visitors from Quebec see a notice.
• Before communicating personal information outside Quebec, we assess the privacy-related factors, as section 17 of the Act requires. Fluize's database is in Montreal; our team, some providers and HelpDeskPro's database are outside Quebec (section 6).
• Our governance rules for personal information are published on this page, in section 17.1.
• As everywhere, children under 14 can't have an account (section 12).
• You have the right to access, correct and withdraw consent, to ask us to stop disseminating information about you or to de-index it where the law allows, and to receive the information you gave us in a structured, commonly used technological format.
• We don't use location technology to follow you. Fraud prevention groups referrals by network and device only so our team can check them (section 13); it isn't used for anything else.
• Incidents with a risk of serious injury are reported to the CAI and to you, and all incidents are recorded in our internal register.

17.1 Governance rules for personal information

• Who is accountable: the person in charge of the protection of personal information (section 1) approves these rules and this policy, and every change to them.
• Who has access: only the few people on our team with admin access, and only to what they need for support and fraud prevention; opening a person's profile and exporting the list are logged (section 6.3).
• From start to finish: we collect only what section 2 lists, for its purposes; we keep it for the periods in section 8; when a period ends, we delete it or unlink it from you. Every manual clean-up is noted in an internal register.
• Before communicating information outside Quebec and before any new system that handles personal information, we assess the privacy-related factors.
• Providers: only service providers bound by contract to protect the data (section 6.1).
• Incidents: all are recorded in our internal register for at least 5 years (section 11).
• Complaints: write to [email protected]; the person in charge replies within 15 days (section 14). If you're not satisfied, you can complain to the CAI.
• Changes to these rules follow section 18.

18. Changes to this policy

We give at least 30 days' notice by email and in the app before a significant change, such as a new use of your data or a new kind of provider. If a change needs your consent, we'll ask again. The date at the top shows the version in effect.

Version history

19. Contact

[email protected] · YourFirstAI Inc. · 151 Charles St. W., Suite 100, Kitchener, ON N2G 1H6, Canada