Privacy Policy

For your Mentorflix account data — registration, subscription, payments, and site usage — Mentorflix acts as the data controller: we decide how and why that data is processed.

Inside each community, the creator who runs it sets the rules: for community members’ data, the creator acts as the controller and Mentorflix as the processor, handling data according to the creator’s instructions and the terms of this policy. Member requests about a specific community’s data may be forwarded directly to the creator responsible.

We collect data you provide directly and data generated by your use of the platform:

• Registration data: name, email, phone number, and password (stored only in encrypted, hashed form).
• Profile data: photo, bio, language, and preferences you configure.
• Payment data: securely processed by our payment provider (Stripe). We receive only transaction identifiers, card brand, and last digits — we never store the full card number.
• Technical and usage data: IP address, device and browser type, operating system, pages visited, traffic source (for example, campaign parameters), and activity logs.
• Generated content: posts, comments, messages, courses, videos, live streams, and files uploaded by you or your members.
• Support data: messages, tickets, and attachments sent when you contact our team.
• Cookies and similar technologies, detailed in the dedicated section of this policy.

All data processing at Mentorflix relies on one of the legal bases provided by the LGPD:

• Contract performance: to create your account, run the platform, process payments, and provide support.
• Legitimate interest: to keep the platform secure, prevent fraud and abuse, and continuously improve the product — always respecting your reasonable privacy expectations.
• Consent: for marketing communications and advertising cookies. You can decline without losing access to the service.
• Legal obligation: to keep records required by law, such as tax and accounting documents.

Whenever processing relies on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

We use the data we collect to:

• Provide, operate, and maintain the platform and its features.
• Authenticate your access and protect your account.
• Process subscriptions, charges, and refunds.
• Handle support requests and communicate account matters (billing notices, service changes, security).
• Send marketing communications — only with your consent, and always with an unsubscribe option in every message.
• Keep the platform secure and detect and prevent fraud, abuse, and violations of our terms.
• Analyze usage in aggregate to understand what works and improve the product.

We use cookies and similar technologies in four categories:

• Essential: keep your session active, enable login, and protect against fraud. The platform does not work without them.
• Preferences: remember choices such as language and display settings.
• Analytics and performance: help us understand, in aggregate, how pages are used.
• Advertising: we use the Meta Pixel and the Meta Conversions API to measure the effectiveness of our campaigns. These tools may receive browsing and conversion events associated with identifiers such as cookies and hashed email addresses.

You can manage or block cookies in your browser settings — essential ones, however, are required for the service to work. For Meta advertising, you can also adjust your ad preferences directly in your Meta account.

We do not sell your personal data — ever. We share data only with providers essential to the operation, in the following categories:

• Payment processing (Stripe): data needed for charges, payouts, and fraud prevention.
• Cloud infrastructure and hosting: the servers and databases that run the platform.
• Video streaming and delivery (CDN): storage and distribution of community videos and files.
• Transactional email delivery: platform notifications, invitations, and notices.
• Advertising measurement (Meta): conversion events from our campaigns, as described in the cookies section.

Every provider is bound by confidentiality and data protection obligations and receives only the minimum needed for its role. We may also share data when required by law, court order, or a competent authority — and, in that case, only what is strictly required.

Some of our infrastructure, payment, and email providers operate servers outside Brazil. This means your data may be transferred to and stored in other countries.

When that happens, we apply the safeguards provided by Article 33 of the LGPD: we transfer data only to countries with an adequate level of protection or under contractual clauses ensuring the same level of protection required by Brazilian law.

We keep your data only for as long as needed for the purposes of this policy:

• Active account: we keep data for the duration of the contractual relationship, to provide the service.
• After account deletion: data enters a deletion queue with a short grace period — allowing accidental deletions to be reversed — and is then permanently removed or anonymized.
• Backups: backup copies expire and are overwritten in regular cycles after the source data is deleted.
• Mandatory retention: tax, accounting, and transaction records are kept for the periods required by law, even after the account is closed.

Article 18 of the LGPD grants you, as a data subject, the rights to:

• Confirm that your data is being processed.
• Access the data we hold about you.
• Correct incomplete, inaccurate, or outdated data.
• Request anonymization, blocking, or deletion of unnecessary or excessive data.
• Request data portability to another provider, in a structured format.
• Delete data processed based on your consent.
• Obtain information about who we share your data with.
• Withdraw consent at any time.
• Request review of decisions made solely by automated means that affect your interests.

To exercise any of these rights, write to contato@mentorflix.io. We will respond as quickly as possible, within legal deadlines. If you believe your rights were not honored, you may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

We protect your data with technical and organizational measures aligned with industry best practices:

• Encryption in transit (TLS) on every connection to the platform.
• Encryption at rest for sensitive data, including hashed passwords.
• Internal access control under the principle of least privilege: only those who need data can access it, and only when needed.
• Automated, tested backups to ensure service continuity.
• Continuous monitoring and an incident response process.

No system is 100% infallible. If a security incident creates a relevant risk to your data, we will notify you and the ANPD as required by the LGPD.

Mentorflix is not intended for people under 18, except with the supervision and consent of their legal guardians. Creators are responsible for defining and enforcing age requirements in their own communities. If we identify children’s data collected without proper consent, it will be deleted.

We may update this policy to reflect changes in the service or the law. Relevant changes will be clearly communicated — by email or a notice on the platform — before they take effect. The date of the last update always appears at the top of this page.

To exercise your rights, ask questions about this policy, or reach our data protection officer (DPO), write to contato@mentorflix.io.

You may also contact the Brazilian National Data Protection Authority (ANPD), the body responsible for overseeing personal data protection in Brazil.