Privacy Policy

Last updated: September 17, 2026

ITCS Webplace Ltda., registered in Brazil under CNPJ no. 65.998.990/0001-44 (“Webplace”, “we”, “us”, or the “Controller”), operates learnchinese.today (the “Site”), an educational platform for learning Chinese.

This Privacy Policy explains what personal data may be processed through the Site, why it is processed, how it may be shared, how long it may be retained, and how users may exercise their rights.

1. Data controller

Controller: ITCS Webplace Ltda.
CNPJ: 65.998.990/0001-44
Website: https://learnchinese.today
Privacy and data rights contact: [email protected]

2. Data we process

The data processed depends on how the user interacts with the Site.

2.1. Use without signing in

Parts of the Site may be used without creating an account or signing in.

In that case, we may process information related to use of the Site, including:

• interface language;
• level or learning stage;
• phrases or activities displayed;
• answers and correct/incorrect results;
• game round or session identifier;
• date and time of events;
• basic technical information such as browser, device, IP address, and user-agent when recorded by infrastructure systems;
• a pseudonymous or anonymous identifier stored locally in the browser to associate game events on the same device;
• theme preference and other local preferences.

We do not intentionally associate this information with the name or email address of a user who has not signed in.

2.2. Google Sign-In

Google Sign-In is optional and is used solely for authentication and account identification within the Site.

When a user signs in with Google, Google's authentication service may provide the Site, according to Google's operation and the permissions presented to the user, with:

• name;
• email address;
• profile image or profile image URL, where available;
• a technical identifier needed to recognize or link the authenticated account.

learnchinese.today does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or the content of other Google Account services for the sign-in described in this Policy.

Data received through Google is used only to authenticate the user, maintain the account and session, identify the user within Site features, and, where applicable, associate preferences or learning progress with the account.

2.3. Authentication session

When the user signs in, the Site uses an authentication mechanism based on Auth.js and a session cookie.

The authentication cookie is configured to keep the session active for approximately 30 days, although it may expire earlier, be renewed depending on use, or be invalidated when the user signs out or when required for security.

Where technically applicable, authentication cookies are configured with appropriate safeguards such as HttpOnly, Secure, and suitable SameSite attributes.

2.4. Nickname and progress

The Site may allow users to set a nickname and may store learning progress, preferences, or performance information.

When linked to an authenticated account, such information may constitute personal data.

2.5. AI tutor

The Site offers or may offer educational AI tutor features.

When a user sends a message to the tutor:

• the text needed to generate a response is sent by the learnchinese.today backend to AI infrastructure operated by Webplace;
• the current implementation uses a proprietary Ollama-based API operated within Webplace's infrastructure;
• the user's name, email address, and other direct identifiers are not intentionally included in the payload sent to the language model;
• users should not voluntarily submit sensitive personal data, confidential information, or third-party personal data in tutor messages.

Conversations may be processed for the time required to generate responses, maintain security, diagnose technical issues, and operate the feature, according to the service architecture.

2.6. Google Analytics

The Site uses Google Analytics 4 (GA4) to understand statistically how the Site is used.

The current measurement ID is:

G-2YMPSSQJND

Google Analytics may process information such as:

• pages visited;
• browsing events;
• session characteristics and duration;
• approximate location information;
• browser and device information;
• identifiers stored in cookies or equivalent technologies.

Google Analytics cookies and analytical technologies should only be activated after the corresponding cookie choice is made by the user, unless a future technical configuration permits analytics processing without analytics storage subject to consent and there is an appropriate legal basis.

3. Cookies, localStorage, and similar technologies

The Site uses cookies, localStorage, and similar technologies for different purposes.

3.1. Strictly necessary technologies

These are used for functions that are essential or expressly requested by the user, such as:

• authentication;
• security;
• maintaining a session;
• basic technical operation of the Site.

These technologies may be used independently of analytical cookie preferences when required to provide the service requested by the user.

3.2. Preferences and local storage

The Site may locally store in the browser:

• theme preference;
• language or interface preferences;
• a pseudonymous or anonymous game identifier.

Users may delete this data through their browser settings.

3.3. Analytics cookies

Analytics cookies, including those related to Google Analytics, are used to measure audience, understand usage patterns, and improve the Site.

Where processing depends on consent, users may:

• accept analytics cookies;
• reject them;
• later change their choice through the cookie preference mechanism made available on the Site.

Rejecting analytics cookies should not prevent access to essential Site features.

3.4. Google Analytics cookies

Google Analytics may use cookies such as _ga and cookies associated with the Analytics property to distinguish users and sessions.

Cookie duration and retention periods may vary according to the Analytics property settings, browser limitations, and Google's own policies.

More information about Google's privacy practices is available at:

https://policies.google.com/privacy

4. Purposes and legal bases

Depending on the context, we may rely on the following legal bases under Brazil's General Data Protection Law — Law No. 13,709/2018 (“LGPD”):

Where processing is based on consent, consent may be withdrawn without affecting the lawfulness of processing performed before withdrawal.

5. Data sharing

Personal data may be processed by or shared, where necessary, with:

Google

Used for:

• Google Sign-In;
• Google Analytics, when authorized.

The user's relationship with Google services is also governed by Google's own policies.

Hosting and infrastructure

Webplace uses its own or contracted infrastructure for hosting, databases, security, logs, Site delivery, and other technical purposes.

The Site's main operational data is currently hosted on infrastructure located in Brazil, including the State of São Paulo, according to the current service configuration.

Webplace AI infrastructure

Tutor messages may be sent to a proprietary Ollama-based API operated by Webplace only to the extent necessary to generate the requested response.

We do not intentionally send the user's name or email address in the payload provided to the language model.

Authorities and legal obligations

Data may be disclosed where necessary to comply with applicable law, court orders, or valid requests from competent authorities.

No sale of personal data

Webplace does not sell personal data of learnchinese.today users.

6. International processing

Although the Site's primary infrastructure is reported as being located in Brazil, certain providers — particularly Google — may process or store data in other countries according to their own infrastructure.

Where international transfers of personal data occur, applicable LGPD requirements and reasonable safeguards will be observed.

7. Data retention

Personal data is retained only for as long as necessary for the purposes described in this Policy, subject to legal obligations, security, fraud prevention, exercise of rights, and reasonable technical limitations.

As a general rule:

• account data: while the account or relationship with the Site remains active or until a valid deletion request, subject to lawful retention exceptions;
• session: for the validity period of the session, generally around 30 days, unless renewed, ended, or invalidated;
• game events and internal metrics: for as long as reasonably needed to analyze and improve the service, preferably aggregated or anonymized when individual-level data is no longer necessary;
• Google Analytics data: according to the Analytics property configuration and Google's retention policies;
• technical and security logs: for a period reasonably necessary for security, diagnosis, and abuse prevention;
• data required by law or for legal claims: for the period required or permitted by applicable law.

8. User rights

Under the LGPD, where applicable, users may request:

• confirmation that personal data is being processed;
• access to personal data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• portability where applicable and regulated;
• information regarding data sharing;
• withdrawal of consent where consent is the applicable legal basis;
• deletion of data processed based on consent, subject to lawful retention exceptions;
• objection to certain processing performed without consent where LGPD requirements are not met;
• other rights provided by applicable law.

9. Account and data deletion requests

At this time, requests related to accounts and personal data, including account deletion requests, must be sent to:

[email protected]

To protect users, we may request information reasonably necessary to verify the identity and legitimacy of the requester before deleting or disclosing data.

Deleting an account does not necessarily require immediate deletion of every record where retention is required or permitted by law, security needs, fraud prevention, legal obligations, or the establishment or exercise of legal rights.

10. Children and teenagers

learnchinese.today is an educational project, but it is not specifically directed at children and does not generally require users to state their age before accessing the Site.

We do not knowingly seek to collect children's personal data beyond what is necessary for the functions they use.

Where processing involves personal data of children or teenagers, Webplace will observe their best interests, Article 14 of the LGPD, and other applicable legal requirements.

Parents or legal guardians who become aware that a child under their responsibility is using the Site and wish to request information, correction, or deletion may contact:

[email protected]

11. Security

We adopt reasonable technical and administrative safeguards proportionate to the size and nature of the Site, including where applicable:

• HTTPS;
• infrastructure access controls;
• protected authentication cookies;
• separation between account authentication data and content sent to the AI tutor;
• data minimization in AI requests;
• logging, monitoring, and security mechanisms.

No internet-connected service can be guaranteed to be completely secure. If a relevant personal data incident occurs, we will take the measures required under the LGPD and applicable ANPD regulations.

12. Automated outputs

The AI tutor produces automated responses for educational purposes.

Under the operation currently described, the Site does not use the AI tutor to make decisions that produce legal, financial, credit, employment, or similarly significant effects on users.

13. Information submitted by users

Users should avoid entering into the tutor or other free-text fields:

• sensitive personal data;
• passwords;
• identity documents;
• financial information;
• trade secrets;
• confidential information;
• third-party personal data without authorization.

14. Changes to this Policy

We may update this Policy to reflect changes in the Site, applicable law, or our data practices.

The date of the latest update will appear at the top of this document.

Where a material change requires new notice, consent, or another action by the user, we will take the appropriate steps.

15. Contact and the Brazilian DPA

Privacy questions and requests may be sent to:

ITCS Webplace Ltda.
CNPJ 65.998.990/0001-44
https://learnchinese.today
[email protected]

Where applicable, users may also petition Brazil's Autoridade Nacional de Proteção de Dados — ANPD in accordance with applicable law.