HomeSimulAI Academy - Data Protection
SimulAI Academy - Data Protection

Privacy Policy

Last updated: October 16, 2026

1. Who we are

This Privacy Policy describes how SAB-IA TECNOLOGIA E EDUCAÇÃO LTDA, registered in Brazil under CNPJ No. 69.300.953/0001-71 and operating under the trade name SIMULAI ACADEMY ("SimulAI Academy," "we," "us," or "our"), processes personal data on the website and platform. Our contact email for privacy matters is contact@simulaiacademy.com.

2. What data we collect

We collect only the data strictly necessary to deliver the service:

  • Account data: name and email provided at sign-up.
  • Usage data: tests, mind maps, presentations, attempts, and arenas generated from your access.
  • Uploaded files: PDFs, DOCX, and images you use to generate content - stored encrypted.
  • Authentication & audit data: IP address, browser, active sessions, and approximate login location, as detailed in the Terms.
  • Communication data: content of messages sent through support channels.
  • Voice, when you use dictation: the recording of the spoken passage, sent for transcription and deleted right afterwards - never stored. Details in section 15.

3. How we use your data

We process the collected data for the following purposes:

  • Operate and improve the platform (tests, maps, arena, and VideoLab);
  • Generate educational content on demand, with the help of AI providers;
  • Secure your account and detect suspicious access;
  • Reply to support requests and service-related communications;
  • Comply with legal and regulatory obligations (LGPD/GDPR).

4. Legal basis (LGPD / GDPR-aligned)

Your data is processed based on the following grounds set out in the Brazilian LGPD (Law No. 13,709/2018):

  • Performance of a contract: delivering the test generation service and other modules;
  • Consent: processing precise location data and sending optional communications;
  • Legitimate interest: improving the service, preventing fraud, and security;
  • Compliance with legal obligations: when required by law or a competent authority.
  • Specific consent for sensitive data: the voice recording from dictation, which may qualify as biometric data (art. 11, I) - using the feature is optional;

5. Data sharing

SimulAI Academy does not sell or rent your personal data. We may share strictly necessary data with:

  • AI providers - OpenAI, Groq (dictation audio transcription), Mistral (document reading) and Gamma (presentations) - only the content required to generate the requested artifact, under policies that prohibit use for model training;
  • Infrastructure providers (hosting, database, email) under confidentiality agreements;
  • Competent authorities, when required by law.

6. Where data is stored

Structural data (account, tests, maps, history) is stored in a MongoDB database hosted on a corporate cloud provider, with encryption in transit and at rest. The exact instance location may vary by operating environment and can be detailed by contract for institutional clients.

Uploaded files are stored in encrypted storage isolated per account.

7. Data retention

We retain your data while your account is active or for the period required to fulfill the purposes described in this policy and applicable law. Deletion requests are handled per section 8.

8. Your rights

Under the LGPD, you have the following rights over your personal data:

  • Confirmation that processing exists;
  • Access to data;
  • Correction of incomplete, inaccurate, or outdated data;
  • Anonymization, blocking, or deletion;
  • Data portability (export);
  • Withdrawal of consent;
  • Objection to processing.

To exercise your rights, send a request to contact@simulaiacademy.com from your registered email. We reply within 15 days.

9. Cookies and similar technologies

On the public website (simulaiacademy.com), we use cookies, localStorage and similar identifiers for the purposes below.

  • Preferences and metrics: we store your language preference and cookie choice. Metrics through Vercel Analytics and Speed Insights require your permission.
  • Advertising: when enabled, a Google AdSense block may appear only at the end of blog articles. Its script loads after your permission through the banner; Google may use cookies and identifiers to serve and measure ads.

Use Manage cookies in the footer to revisit your choice. To manage Google ad personalization, visit adssettings.google.com. See also how Google uses data from partner sites.

10. Data security

We adopt appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction: encryption in transit (TLS) and at rest, need-to-know access controls, audit logs, and secure development practices.

11. Changes to this policy

This Policy may be updated periodically. We recommend reviewing it. The date of the last update is shown at the top of this document.

12. Contact

For questions about this Policy or the processing of your personal data:

13. Advertising on the blog

The public website uses Google AdSense in a single block at the end of blog articles. It is independent of your plan or login and requires your permission through the cookie banner.

  • Provider: Google AdSense supplies the ads displayed on the blog.
  • Data: when you allow advertising, Google may receive your IP address, cookie or device identifiers, browser agent, visited page, language and ad interactions for ad serving and measurement.
  • No study data: we do not send quiz content, mind maps, transcripts, answer keys, student photos or other user materials to ad networks.
  • Profile: we do not send account details or select ads by school, class or student performance.
  • Your choice: refusing or withdrawing permission prevents new ad blocks from loading. Articles remain available.

You can revisit your choice using Manage cookies in the footer. For details about Google data processing, see Google Privacy Policy.

14. SimulAI VideoLab browser extension

We offer a Google Chrome extension that turns YouTube video lessons and PDF documents open in your browser into study material in your account. It works exclusively on your command: nothing is read or sent unless you click the extension. When you use it, we process the following data:

  • Video content: when you trigger generation on a YouTube page, the extension reads the open video’s captions (closed captions) and metadata (title, channel and duration) and sends them to our API, solely to generate the material you requested (practice test, study plan, mind map and/or chat).
  • Document content: when you trigger generation on a PDF page, the extension reads the open file (up to 25 MB) and sends it to our API, solely to generate the material you requested (practice test and/or mind map). The file is stored encrypted in your account, like any document uploaded through the platform. On PDF pages the extension only displays a button: not a single byte of the file is read without your click.
  • Pairing token: to identify your account, the extension stores a dedicated token (prefix slx_) in your browser’s local storage, issued when you connect it to your account. It is sent only to our API and can be revoked at any time: the "Disconnect account" button deletes the token from the browser, and you can also revoke it on the platform.
  • What the extension does not do: it does not collect browsing history, does not monitor other tabs or sites, does not run in the background, does not inject ads, and does not share or sell data to third parties.

The transcript and document we receive follow the same rules as this policy: they are used only for the purpose you requested, under the legal bases in section 4 and the retention periods in section 7.

15. Voice dictation

Voice dictation lets you speak instead of typing in the topic and content fields of practice exams, presentations, mind maps and essays. The feature is optional: typing remains available in all of those fields, and nothing is captured unless you activate the microphone.

  • How it works: when you tap "Dictate", the browser asks for your permission and records only the spoken passage, up to the time limit shown on screen. When you stop, the audio is sent to our API, converted and transcribed. The text appears in the field as editable content — you review it before generating anything.
  • The audio is not stored: the recording exists only in memory and in a temporary file while it is being processed, and is deleted when the request ends, including on error. We do not keep the audio in a database, backup or file storage, and it is not used to train models.
  • Third-party transcription: to turn speech into text, the audio may be sent to a transcription provider — currently Groq, Inc. (Whisper model) and, alternatively, OpenAI — under policies that prohibit using the content to train models. We send only the audio of the dictated passage: no account data accompanies it.
  • Sensitive personal data: a voice recording may qualify as biometric data under the LGPD (art. 5, II). This processing therefore relies on your specific, highlighted consent (art. 11, I), given when you activate the microphone and revocable at any moment. We do not create a biometric identifier from your voice, do not compare it with other recordings, and do not use it to identify you.
  • Minors: if you are under 18, using dictation requires the consent of at least one parent or legal guardian (LGPD, art. 14). Without that consent, please type instead.
  • Accuracy: automatic transcription makes mistakes, especially with acronyms, technical terms, background noise and accents. That is why the text always lands in an editable field and is never used to generate content without your review.

To opt out, simply do not activate the microphone. Nothing else on the platform is limited by that choice.

16. Google data (Classroom and Calendar)

Connecting is optional and requires your authorization through Google when the integration is available for your account. Signing in with Google does not automatically connect Classroom or Calendar. We request permissions for the integration you choose and do not receive your Google password.

For Google Classroom, we access the courses where you teach, available student names, identifiers and email addresses, and the assignments, materials, submissions and grades needed for the integration. We use this data to import selected courses, link students to SimulAI accounts and synchronize assignments and grades. Students without a verified account may remain pending. In linked courses, we send titles, instructions, deadlines and links to materials published by the teacher; SimulAI assignment grades may be returned to Google on a scale of 0 to 100. Links require authorized class access, and attachments remain in SimulAI.

For Google Calendar, we create a separate SimulAI calendar and manage the study blocks you schedule there, including event titles, descriptions, dates, times and identifiers. We can create, update and remove these events. We do not read events from your personal calendar.

This data is used only for these features, is not sold, is not used for advertising and is not shared with third parties except as needed to operate authorized features or comply with legal obligations. We do not use data from these integrations to train AI models. We store course and event links and the authorization needed for synchronization; stored access tokens are protected by encryption.

You can disconnect each integration within SimulAI or revoke access at myaccount.google.com/permissions. Disconnecting stops synchronization but does not automatically erase previously imported classes, materials or records. When you disconnect Calendar through SimulAI, the app-created calendar is removed when Google access allows the operation to complete; your other calendars are not changed. Unlinking a class does not delete the course in Google. Revoking access in your Google account may stop both integrations.

Imported data can be deleted upon request by email to adm@simulaiacademy.com, subject to legally permitted retention. Do not send passwords or access codes with your request. Disconnecting does not erase copies that remain under the control of Google or your institution.

SimulAI's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

17. Classes, students and data access

When connecting an institutional account and importing a class, teachers must be authorized to manage this data and follow institutional rules. Inform students and, where applicable, their guardians about the use of the platform. Avoid including unnecessary personal data in titles, descriptions, files or assignments.

Class features and material links follow membership and access permissions within the platform. A teacher authorizing an account integration does not authorize every other use of student data. For questions about school data and records held by the institution, also contact that institution.

18. Retention, deletion and privacy requests

You can request information about processing, access, correction and deletion of your data by emailing adm@simulaiacademy.com. We may ask for proportionate information to verify your identity or authority and prevent someone else from accessing or deleting your data. Requests are assessed under applicable law, including its conditions and exceptions.

We retain data needed to provide the service and school records while they serve their purpose. Disconnecting an integration is different from deleting imported data. Where retention is required or permitted by law, it is limited to the purpose that justifies it; you can ask which records are retained and why.

If you believe your request has not been adequately addressed, you can contact ANPD. Changes to the purposes for which Google data is used will be communicated before they take effect, with renewed authorization when required.