This Privacy Policy describes how Metaverso Educacional ("we", "our" or "Platform") collects, uses, stores and protects the personal data of Dashboard and Teaching Platform users. We are committed to protecting the personal data of all users, with special attention to children and adolescents, in compliance with the General Data Protection Law (LGPD — Law No. 13,709/2018) and the Child and Adolescent Statute (ECA — Law No. 8,069/1990).
| Profile | Data collected |
|---|---|
| Student | Name, date of birth, e-mail (or guardian's, if minor), linked school/institution |
| Teacher | Name, e-mail, CPF, linked institution, professional data |
| Institution | Company name, CNPJ, address, legal representative data, institutional e-mail |
| Parent/Guardian | Name, e-mail, CPF, relationship with student |
We use personal data for the following purposes:
| Purpose | Legal basis (LGPD) |
|---|---|
| Account creation and management | Contract execution (Art. 7, V) |
| Virtual lab operation | Contract execution (Art. 7, V) |
| Educational progress tracking | Contract execution (Art. 7, V) |
| Performance reports generation | Contract execution (Art. 7, V) |
| Parental control | Guardian consent (Art. 14, §1) |
| Chat monitoring | Minor protection (Art. 14) and legitimate interest (Art. 7, IX) |
| Platform security | Legitimate interest (Art. 7, IX) |
| Platform communications | Contract execution (Art. 7, V) |
| Technical support | Contract execution (Art. 7, V) |
| Service improvement | Legitimate interest (Art. 7, IX) |
Processing of children's personal data (up to 12 years) will be carried out exclusively with the specific and prominent consent of at least one parent or legal guardian, pursuant to Art. 14 of the LGPD.
For adolescents (12 to 17 years), processing will be carried out with guardian consent or in their best interest.
We collect only data strictly necessary for providing the educational service.
Minor data will never be:
The parent or guardian may at any time:
What is monitored: all messages exchanged between teachers and students are automatically analyzed. The parent or guardian, through the Parental account, can review the full content of the linked student's conversations at any time.
Purpose of monitoring:
Retention: chat messages are stored for the period necessary to fulfill the described purposes and legal obligations. After that period, they are anonymized or deleted.
Transparency: users are informed about monitoring before using the chat for the first time.
| From | To | Shared data |
|---|---|---|
| Student | Teacher | Progress, performance, activities |
| Student | Institution | Progress, performance, reports |
| Student | Parent/Guardian | Progress, performance (parental control) |
| Teacher | Institution | Generated reports, management data |
We may share data with:
We do not sell, rent or commercialize our users' personal data.
Data is stored on secure servers with: encryption in transit (TLS/SSL) and at rest, role-based access control, regular backups, and continuous security monitoring.
Internal data access is restricted to authorized employees under confidentiality.
In case of a security incident that may cause risk or damage to data subjects, the National Data Protection Authority (ANPD) and affected users will be notified as required by law.
| Data type | Retention period |
|---|---|
| Account data | While account is active + 6 months after closure |
| Progress and reports | While account is active + 1 year after closure |
| Chat messages | 1 year after sending, then anonymized or deleted |
| Access logs | 6 months (per Internet Civil Framework) |
| Minor data | Deleted upon guardian request or account closure |
Under the LGPD, you have the right to:
To exercise your rights, contact us at the email indicated in Section 14.
| Type | Purpose | Required? |
|---|---|---|
| Essential | Login, session, security | Yes |
| Functional | User preferences, language | No |
| Analytics | Usage metrics, Platform improvement | No |
Non-essential cookies are only activated with user consent.
Users can manage cookies in browser settings or through the Platform's preference panel.
We offer sign-in to the admin dashboard and to the Unity application (Educational Metaverse) through Google (Google Sign-In) and Apple (Sign In with Apple) accounts.
When you choose this method, we receive from the provider only the data strictly required to identify your account:
This data is stored in the same database as your account and used only to validate subsequent sign-ins. No provider password is received or stored by us.
You can unlink at any time in Settings > Linked accounts. Revoking on the Google or Apple side also ends access starting from your next sign-in.
We use the Sentry service (sentry.io, Functional Software Inc., USA) to detect and diagnose errors automatically — both in the dashboard and in the Unity application.
When an error occurs, Sentry automatically collects:
The data is used exclusively to investigate failures and improve product stability. It is not shared with third parties, does not feed marketing profiles, and is automatically deleted after 30 days.
We apply masking rules (PII scrubbing) so sensitive fields like passwords, tokens, and payment data are removed before being sent to Sentry.
The 3D application (Unity), installed on computers or tablets, collects additional data required to operate the virtual lab:
The Unity application does NOT record keyboard, mouse, microphone, camera, desktop, or other applications on the device.
If data is stored or processed on servers outside Brazil, we ensure that: the destination country has an adequate level of protection, or appropriate safeguards are adopted (standard contractual clauses, certifications).
Users will be informed about international transfers when applicable.
Metaverso Educacional has designated a Data Protection Officer responsible for: receiving and responding to data subject requests, interacting with the ANPD, and guiding the organization on data protection practices. DPO contact: operacional@bebyte.net
This Policy may be updated periodically.
Significant changes will be communicated with a minimum of 30 days' notice through the Platform.
For minor data, changes that expand processing will require new guardian consent.
For questions, requests or exercise of rights, contact us at: operacional@bebyte.net
If you do not receive a satisfactory response, you may contact the National Data Protection Authority (ANPD).