Data We Collect
We collect the following types of data:
- Account data: name, email, password (hash), phone.
- School data: name, address, GPS coordinates.
- Student data: name, email, date of birth, profile photo.
- Usage data: access logs, check-ins, belt progression history.
How We Use the Data
We use the data to:
- Provide and improve MyBelt services.
- Process payments and manage subscriptions.
- Send operational notifications (confirmations, reminders).
- Comply with legal and regulatory obligations.
Data Sharing
We do not sell your data. We only share with service providers required to operate the platform (Stripe for payments, DigitalOcean for hosting).
Security
We use TLS encryption in transit and AES-256 at rest. Daily backups are performed. Access is recorded in an audit log.
Facial Recognition
Biometric data (face encodings) is processed locally and stored only in Redis memory, never in a persistent database. It is automatically deleted when the student's photo is removed.
Your Rights (LGPD/GDPR)
You have the right to:
- Access your personal data.
- Correct inaccurate data.
- Request deletion of your data.
- Data portability.
- Withdraw consent.
Data Retention
Data retention depends on your school's status on the platform:
While your school is active and in use, we keep all data necessary to operate the service.
Schools suspended due to inactivity or overdue payment retain their data for 60 days to allow full recovery.
After 60 days of suspension, or 30 days after voluntary cancellation, all data is permanently deleted — including backups.
DPO Contact
To exercise your rights or for privacy questions: privacy@mybelt.app