MnezoMnemonic Zone

Privacy Policy

Effective date: October 19, 2026

1. Who we are

Mnezo (mnezo.com) is an online platform for learning Brazilian Portuguese, operated by GhTeam, a company registered in Brazil (full legal details below). For the purposes of the Brazilian General Data Protection Law (LGPD, Lei nº 13.709/2018) and, where applicable, the EU General Data Protection Regulation (GDPR), GhTeam is the data controller of your personal data.

Contact for any privacy matter: support@mnezo.com.

2. Data we collect

  • Account data. When you sign up with email, Google, Apple or Telegram we receive your email address (or, for Telegram, a service-generated identifier), and optionally your name and avatar as provided by the sign-in provider.
  • Learning data. Your study progress: vocabulary repetition history and ratings, exercise and exam attempts, listening and reading progress, study-time statistics, learning goals and settings, and the texts you write in the writing and exam sections.
  • Payment data. Payments are processed by Stripe. We never receive or store your full card number; we receive your subscription status and billing history metadata. Subscriptions bought in the Android app are processed by Google Play; we receive the subscription status and period from Google Play through RevenueCat, never your card details.
  • Technical data. IP address, browser and device information, cookies and similar identifiers, pages visited and usage events (via Google Analytics 4), error and performance diagnostics (via Sentry).
  • Mobile app. If you use the Mnezo Android app, we also receive: a push notification token (only if you allow notifications), the app version and platform, a random installation identifier used to deliver app updates (Expo), and, if you subscribe in the app, the Google Play purchase details needed to confirm your subscription (via RevenueCat). The app contains no advertising or analytics trackers and does not use your advertising ID or location. Links to mnezo.com/app/… (for example, password-reset emails) open the Mnezo app when it is installed; this uses a public verification file on our site and collects no extra data.
  • Communications. Messages you send to our support email.

3. Why we process it (purposes and legal bases)

  • Providing the service — creating your account, storing your progress, personalising your study plan, grading your submissions. Legal basis: performance of a contract (LGPD art. 7 V; GDPR art. 6(1)(b)).
  • Payments and accounting — processing subscriptions and complying with tax law. Legal basis: contract and legal obligation (LGPD art. 7 II, V; GDPR art. 6(1)(b), (c)).
  • Analytics and product improvement — understanding how the service is used so we can improve it (Google Analytics 4). Legal basis: for visitors in the EEA and UK, your consent (GDPR art. 6(1)(a); ePrivacy Directive) — analytics cookies load only after you accept them in our cookie banner, and you can withdraw consent at any time; elsewhere, legitimate interest (LGPD art. 7 IX; GDPR art. 6(1)(f)).
  • Security and error diagnostics — protecting accounts and diagnosing crashes (Sentry). When an error occurs we send an error report: what failed in the code, the browser and device, the page address and the technical steps before it (page changes, which button was pressed, network requests). We do not record your session, what is on your screen or what you type. Legal basis: legitimate interest.
  • Service communications — transactional emails and, if you opt in, push notifications with study reminders. You can disable push notifications at any time in your profile. In the Android app, reminders are sent at most once a day when words are due for review, and only after you allow notifications. You can turn them off at any time in the app's profile (Reminders) or in Android settings (Apps → Mnezo → Notifications); switching reminders off, signing out of the app or deleting your account deletes the notification token from our servers.
  • Service messages — after you sign up we may send you a small number of service messages about your free trial and subscription — for example, the day before your trial ends — by email or, if you signed in with Telegram, through the Mnezo bot. Every message contains a link that unsubscribes you immediately; you can also write to [email protected]. We do not send these messages to paying subscribers or to anyone who has unsubscribed. Legal basis: legitimate interest (LGPD art. 7 IX; GDPR art. 6(1)(f)).
  • Learning reminders — if you signed in with Telegram, the Mnezo bot may also send you a short reminder when words are due for review or after a few days without practice — at most one a day and two per break. Every reminder has a link that unsubscribes you immediately. Legal basis: legitimate interest (LGPD art. 7 IX; GDPR art. 6(1)(f)).

4. AI processing of your texts

Texts you submit for review in the writing and exam sections are processed by an AI model (provided by Anthropic, or OpenAI if the primary provider is unavailable) solely to generate feedback and an estimated score for you. Automated feedback is an educational aid, not an official examination result. We do not use your texts to train AI models.

5. Service providers (sub-processors)

We share personal data only with the providers we rely on to run the service, and only to the extent needed:

  • Supabase — database, authentication and file storage.
  • DigitalOcean — application hosting (USA).
  • Cloudflare — CDN, DNS and security.
  • Stripe — payment processing.
  • Google — Google Play (app distribution and in-app subscription billing), Google sign-in, and Firebase Cloud Messaging (delivery of push notifications on Android).
  • RevenueCat — confirms Google Play purchases and tells us the subscription status; it receives your Mnezo account identifier and the purchase details.
  • Expo — delivers push notifications to the app and app updates.
  • Google Analytics 4 — usage analytics.
  • Sentry — error and performance monitoring.
  • Anthropic — AI review of texts you submit for grading (section 4).
  • OpenAI — backup AI review when the primary provider is unavailable (section 4).

Course audio is produced with ElevenLabs text-to-speech; this concerns our learning content only and involves no personal data of users. Speaking exercises use the speech recognition built into your browser (Google on Chrome/Edge, Apple on Safari). Audio from those exercises is processed by that vendor to turn it into text; we do not receive or store the recording. In the Android app, speaking exercises use the speech recognition service of your phone (usually Google's). The microphone is switched on only while you answer such an exercise, after you grant the permission; the audio goes to that service to be turned into text, and the app sends us only the recognised text, as with a typed answer. We never receive, store or share the recording. You can always answer in writing instead. We do not sell personal data and do not share it with advertisers.

6. International transfers

Our infrastructure providers store data primarily in the United States. Where personal data is transferred outside Brazil or the EEA, we rely on our providers' safeguards (such as standard contractual clauses) as permitted by LGPD chapter V and GDPR chapter V.

7. Cookies

We use:

  • Essential cookies — keeping you signed in (authentication session). The service cannot work without them.
  • Preferences — interface settings (theme, view modes) stored in your browser's local storage.
  • Analytics cookies — Google Analytics 4 identifiers used to measure aggregate usage. For visitors in the EEA and UK these are off by default and load only after you accept them in the cookie banner shown on your first visit; you can change or withdraw your choice at any time through the banner, and blocking them does not affect the service. Elsewhere they are enabled by default and you can opt out via browser settings or extensions. For signed-in users who accept analytics, we associate these analytics events with a pseudonymous account identifier so we can understand how the product is used across a user's sessions and devices. This identifier is not your email or name, and no on-screen content or answer text is sent to Google Analytics. We measure learning-material identifiers, exercise formats and results, active time, help requests and technical failure categories to understand where learning stops and what leads to a subscription. A hidden tab is recorded as a pause, not a reason for leaving.

We also use Sentry for error reports, which contain no on-screen content (see section 3). Analytics and diagnostics are grouped as Analytics and Usage & crash telemetry in our Cookie settings, reachable any time from the footer and your profile — every visitor (not only in the EEA/UK) can turn either off there. We do not use advertising or cross-site tracking cookies.

8. Retention

We keep your data while your account is active. You can delete your account yourself at any time: Profile → Account → Delete account, confirmed by typing a word. This takes effect immediately — we cancel any active subscription and erase your profile, learning progress, answers, written work, settings and your sign-in record. If you ask us instead (write to support@mnezo.com), we delete or anonymise your personal data within 30 days.

Step-by-step instructions, including for the Mnezo app: Deleting your Mnezo account.

What remains after deletion: payment records that Stripe keeps as tax and accounting law requires (invoices and the billing customer record — we never hold card numbers); residual copies in encrypted backups, which expire on their normal rotation schedule; and pseudonymous analytics and error-diagnostic events (linked to a random account id, never to your e-mail), which expire under those providers' retention periods. A cancelled subscription is not refunded automatically; see the refund terms in our Terms of Service.

Deleting your account does not cancel a subscription bought through Google Play — cancel it in Google Play (the app shows a link before deletion). Google Play keeps its records of that purchase under its own retention rules; we ask RevenueCat to delete its customer record for your account.

9. Your rights

Under LGPD (art. 18) you may request: confirmation that we process your data; access to it; correction; anonymisation, blocking or deletion; portability; information about sharing; and revocation of consent. You also have the right to lodge a complaint with the Brazilian data protection authority (ANPD).

If you are in the EEA or UK, you have the equivalent GDPR rights (access, rectification, erasure, restriction, portability, objection) and the right to complain to your local supervisory authority.

Access, portability and deletion are self-serve: Profile → Account → Download my data gives you a machine-readable JSON file with everything we store about your account (account details, settings, learning history, answers and written work), and account deletion is in the same place (section 8).

To exercise any other right, write to support@mnezo.com from the email associated with your account. We respond within the timeframes required by law.

10. Children

Mnezo is intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, contact us and we will delete it.

11. Security

We use industry-standard measures: encrypted connections (TLS), encrypted storage, access controls and the security programmes of the providers listed above. No online service can guarantee absolute security, but we work to protect your data proportionally to the risk.

12. Changes to this policy

We may update this policy as the service evolves. The current version is always at mnezo.com/privacy; material changes will be announced in the app or by email.