Privacy Policy

Account data. When you sign in via Google, we receive your name, email address, and profile photo from Google. We store this information in our database for as long as your account is active.

Activity data. When you use the client portal or admin tools, we store your project comments, approvals, library uploads, license records, and timestamps of actions you take.

Applicant data. If you submit a job application via the Careers section, we collect: your name, email, country, primary discipline, years of experience, links you choose to share (LinkedIn, portfolio, demoreel, social networks), CNPJ status and number (if Brazilian and you provide it), and any cover-letter text you submit. Submission requires explicit consent under LGPD Art. 7(I).

Academy lead data. If you sign up via the Academy welcome form, we collect: your name, email, age, the program you're interested in, and your LGPD consent stamp. Adult-only: Academy is 18+; we record your 18-or-older self-certification alongside your age. Academy playback data (when a video is played, by whom, for forensic attribution of any leaked material) is collected only after you sign in and a program access grant has been issued.

Atlas wait-list data. If you sign up via the wait-list form on atlas.uppercut.studio, we collect: your name, email, the profile category you selected (animator, studio owner, student, etc.), the optional free-text describing what you'd use Atlas for, your LGPD consent stamp, and basic technical metadata (IP address and user agent) for abuse forensics. We use this only to evaluate and invite you to Uppercut Atlas. Same retention rules as Academy lead data, below.

Contact-form data. If you message us via the contact form, we collect your name, email, optional company, the message content, and your consent stamp, plus the submitting IP for abuse forensics — used solely to respond to your inquiry.

Versus data. Uppercut Versus (the invite-only writing tool at versus.uppercut.studio) stores the work you create — songs and screenplays, their line versions ("takes"), the subtext notes behind them, and your theme and font preferences — in your account so it's there when you return. When you use the on-demand word tools (definitions, rhymes, synonyms, slang, phrase refinement), only the word or line you act on plus a short excerpt of your subtext is sent to Google Cloud Vertex AI to generate a suggestion; your inputs are not used to train Google's models. Versus wait-list submissions (name, email, and anything you write in the form) feed our invite queue. You can export any work to a portable .versus file at any time.

Technical data. We use a single session cookie (__session) to keep you signed in. We do not use marketing trackers, analytics cookies, or third-party advertising.

• Execution of a contract (Art. 7, V) — to provide the Service you signed up for.
• Legitimate interest (Art. 7, IX) — to operate, secure, and improve the Service.
• Legal obligation (Art. 7, II) — for financial records required by Brazilian tax law (Receita Federal).
• Consent (Art. 7, I) — for any optional features clearly identified as such.

We share data only with the following service providers, who process data on our behalf under contract:

• Google LLC / Firebase — hosting, authentication, database, file storage. Servers may be located outside Brazil.
• Google Cloud Vertex AI — generative word and phrase suggestions in Versus. Receives only the word or line you act on plus a short subtext excerpt; inputs are not used to train Google's models. Servers may be located outside Brazil.
• GitHub, Inc. — source-code hosting; does not receive client data.
• (future) Stripe — payment processing, when and if you purchase paid tools.

All transfers outside Brazil comply with LGPD Art. 33 (international data transfer).

• Account data: kept for as long as your account is active, plus 30 days after deletion to handle support requests.
• Project / activity data: kept until you or the project owner deletes it.
• Applicant data: kept for two (2) years from the date of submission, then automatically deleted unless you have been hired, have opted into a longer retention, or applicable law requires otherwise. You may request earlier deletion at any time by emailing careers@uppercut.studio; we comply within 15 days per LGPD Art. 19.
• Academy lead data: kept for two (2) years from your last activity (submission, sign-in linked to the lead, or program participation), then deleted. Earlier deletion by request via academy@uppercut.studio.
• Atlas wait-list data: kept for two (2) years from submission, then deleted. Earlier deletion by request via atlas@uppercut.studio.
• Contact-form data: kept for two (2) years from your message, then deleted. Earlier deletion by request via contact@uppercut.studio.
• Academy playback data (audit log of which user played which lesson, when, and the forensic watermark imprinted on that play): kept for two (2) years from the play event. Used solely to attribute any leaked copy of exclusive material to the originating user.
• Versus content (your songs, screenplays, line versions and subtexts): kept until you delete it or close your account. Versus wait-list data: kept for two (2) years from submission, then deleted — earlier deletion by request via contact@uppercut.studio.
• Financial records (invoices, payment receipts): kept for 5 years per Brazilian tax law.
• Backup snapshots: kept for 90 days for disaster recovery, then irrecoverable. Additionally, a 7-day point-in-time recovery (PITR) window protects against accidental writes and corruption.

You have the right to:

• Access your data
• Correct incomplete or outdated data
• Delete your data (subject to retention periods above)
• Port your data to another service in a structured, commonly-used format
• Withdraw consent at any time
• Object to processing based on legitimate interest
• Be informed of subprocessors

To exercise any of these rights, email rodrigo@uppercut.studio (or careers@uppercut.studio for applicant-data requests). We respond within 15 days per LGPD Art. 19.

We use a single essential session cookie (__session) to keep you signed in. It is not used for tracking. You can clear it at any time via your browser settings; doing so will sign you out.

The Service is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

We rely on Firebase's encryption-at-rest and encryption-in-transit. Access to our backend systems is gated by Google authentication and role-based permissions. Backups are encrypted before leaving production systems.

We follow industry-standard practices but cannot guarantee absolute security. If a personal data breach occurs that meets LGPD's reporting threshold (Art. 48), we will notify affected users and the Autoridade Nacional de Proteção de Dados (ANPD) within a reasonable time.

We may update this Policy from time to time. Material changes will be notified via email to active users at least 30 days before they take effect. The current version's effective date is at the top of this page.

Data Protection Officer / Encarregado: Rodrigo da Costa
Email: rodrigo@uppercut.studio

For LGPD-specific complaints, you may also contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.