HomeSimulAI Academy - Data Protection
SimulAI Academy - Data Protection

Privacy Policy

Last updated: September 2026

1. Who we are

SimulAI Academy is a Brazilian generative-study platform, maintained by DataLock. Our contact email for privacy matters is contact@simulaiacademy.com.

2. What data we collect

We collect only the data strictly necessary to deliver the service:

  • Account data: name and email provided at sign-up.
  • Usage data: tests, mind maps, presentations, attempts, and arenas generated from your access.
  • Uploaded files: PDFs, DOCX, and images you use to generate content - stored encrypted.
  • Authentication & audit data: IP address, browser, active sessions, and approximate login location, as detailed in the Terms.
  • Communication data: content of messages sent through support channels.
  • Voice, when you use dictation: the recording of the spoken passage, sent for transcription and deleted right afterwards - never stored. Details in section 15.

3. How we use your data

We process the collected data for the following purposes:

  • Operate and improve the platform (tests, maps, arena, and VideoLab);
  • Generate educational content on demand, with the help of AI providers;
  • Secure your account and detect suspicious access;
  • Reply to support requests and service-related communications;
  • Comply with legal and regulatory obligations (LGPD/GDPR).

4. Legal basis (LGPD / GDPR-aligned)

Your data is processed based on the following grounds set out in the Brazilian LGPD (Law No. 13,709/2018):

  • Performance of a contract: delivering the test generation service and other modules;
  • Consent: processing precise location data and sending optional communications;
  • Legitimate interest: improving the service, preventing fraud, and security;
  • Compliance with legal obligations: when required by law or a competent authority.
  • Specific consent for sensitive data: the voice recording from dictation, which may qualify as biometric data (art. 11, I) - using the feature is optional;

5. Data sharing

SimulAI Academy does not sell or rent your personal data. We may share strictly necessary data with:

  • AI providers - OpenAI, Groq (dictation audio transcription), Mistral (document reading) and Gamma (presentations) - only the content required to generate the requested artifact, under policies that prohibit use for model training;
  • Infrastructure providers (hosting, database, email) under confidentiality agreements;
  • Competent authorities, when required by law.

6. Where data is stored

Structural data (account, tests, maps, history) is stored in a MongoDB database hosted on a corporate cloud provider, with encryption in transit and at rest. The exact instance location may vary by operating environment and can be detailed by contract for institutional clients.

Uploaded files are stored in encrypted storage isolated per account.

7. Data retention

We retain your data while your account is active or for the period required to fulfill the purposes described in this policy and applicable law. Deletion requests are handled per section 8.

8. Your rights

Under the LGPD, you have the following rights over your personal data:

  • Confirmation that processing exists;
  • Access to data;
  • Correction of incomplete, inaccurate, or outdated data;
  • Anonymization, blocking, or deletion;
  • Data portability (export);
  • Withdrawal of consent;
  • Objection to processing.

To exercise your rights, send a request to contact@simulaiacademy.com from your registered email. We reply within 15 days.

9. Cookies and similar technologies

We use cookies, localStorage and similar identifiers across both service surfaces, the public website (simulaiacademy.com) and the application (app.simulaiacademy.com), with different purposes.

  • On the public website (this page): essential cookies (language preference) and anonymous traffic metrics via Vercel Analytics and Speed Insights. On blog article pages, and only there, a Google AdSense block loads and Google sets its own cookies. If you decline in the banner, the script stops being downloaded on those pages. You can revisit the choice any time from the \"Manage cookies\" link in the footer.
  • In the application (app.simulaiacademy.com): essential cookies (login session, language, CSRF protection), optional analytics cookies (aggregated metrics) and Google Ad Manager advertising cookies for Free plan users. Advertising cookies are only set after explicit consent in the banner shown on the first authenticated session.
  • Advertising in the app: when a Free user consents, Google and bidding partners may set their own cookies (NID, IDE, DSID, among others) to serve ads, measure performance, and prevent fraud. PRO subscribers never receive advertising cookies.

On the public website, use the \"Manage cookies\" link in the footer to revisit your choice — the banner comes back immediately. Inside the app, the banner reappears when you clear the browser cookies. To manage Google's personalized advertising specifically, visit adssettings.google.com. How Google uses partner data: policies.google.com/technologies/partner-sites.

10. Data security

We adopt appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction: encryption in transit (TLS) and at rest, need-to-know access controls, audit logs, and secure development practices.

11. Changes to this policy

This Policy may be updated periodically. We recommend reviewing it. The date of the last update is shown at the top of this document.

12. Contact

For questions about this Policy or the processing of your personal data:

13. Advertising in the application

To keep the Free plan accessible, we display ads inside the application (app.simulaiacademy.com) for Free plan users. The public website carries a single block, at the end of blog articles, served by Google AdSense and independent of plan or login. PRO subscribers see no ads in the application. About how this works in the app:

  • How the ad shows up on the Free plan: the Free service is sustained by advertising. Each generation (quiz, presentation, mind map, correction, video lesson) is unlocked by a short video that you choose to watch - nothing starts playing without your confirmation, and you can cancel before the video begins. To generate with no ads inside the application, subscribe to PRO. The block at the end of blog articles belongs to the public website and does not depend on your plan.
  • Ad provider: we use Google Ad Manager (Google Ireland Limited / Google LLC) as the serving platform, in the rewarded video format. Google is the data controller for the information collected through ads; we act only as the publisher providing the ad space.
  • Personalization (user choice): in the cookie banner shown on the first authenticated session of the app, you choose between personalized ads (Google uses browsing data to select more relevant creatives) or generic / non-personalized ads (NPA). In both cases, the video remains the way to unlock a generation - the choice only affects creative relevance.
  • What we store: to prevent fraud on the video credit, we record the IP address and browser agent of every ad request. Those records are deleted after 30 days.
  • What data is shared: when you consent to personalized ads, Google may access: IP address, cookie/device identifiers, browser agent, visited page, language, ad interactions, and aggregated interest data. In non-personalized mode (NPA), sharing is restricted to the minimum required to serve and measure the ad.
  • Children and minors: the platform is not directed at children and we do not target ads by age, school, class, or student performance. No profile data from your account is sent in the ad request to Google Ad Manager.
  • No sensitive data: we never share quiz content, mind maps, transcripts, answer keys, student photos or any user-generated artifact with ad networks.
  • European Economic Area and United Kingdom: the in-app banner satisfies Brazil's LGPD and is not an IAB TCF certified CMP. Where the GDPR applies, advertising consent is collected by Google's own messaging platform, shown by Google before the first ad; until it is live, Google itself restricts what it delivers in those regions — that is not a control on our side.

You can revoke personalization at any time at adssettings.google.com (you'll still see ads, just non-personalized), or make the app 100% ad-free by subscribing to PRO. For questions about Google's data processing, see Google's Privacy Policy.

14. SimulAI VideoLab browser extension

We offer a Google Chrome extension that turns YouTube video lessons and PDF documents open in your browser into study material in your account. It works exclusively on your command: nothing is read or sent unless you click the extension. When you use it, we process the following data:

  • Video content: when you trigger generation on a YouTube page, the extension reads the open video’s captions (closed captions) and metadata (title, channel and duration) and sends them to our API, solely to generate the material you requested (practice test, study plan, mind map and/or chat).
  • Document content: when you trigger generation on a PDF page, the extension reads the open file (up to 25 MB) and sends it to our API, solely to generate the material you requested (practice test and/or mind map). The file is stored encrypted in your account, like any document uploaded through the platform. On PDF pages the extension only displays a button: not a single byte of the file is read without your click.
  • Pairing token: to identify your account, the extension stores a dedicated token (prefix slx_) in your browser’s local storage, issued when you connect it to your account. It is sent only to our API and can be revoked at any time: the "Disconnect account" button deletes the token from the browser, and you can also revoke it on the platform.
  • What the extension does not do: it does not collect browsing history, does not monitor other tabs or sites, does not run in the background, does not inject ads, and does not share or sell data to third parties.

The transcript and document we receive follow the same rules as this policy: they are used only for the purpose you requested, under the legal bases in section 4 and the retention periods in section 7.

15. Voice dictation

Voice dictation lets you speak instead of typing in the topic and content fields of practice exams, presentations, mind maps and essays. The feature is optional: typing remains available in all of those fields, and nothing is captured unless you activate the microphone.

  • How it works: when you tap "Dictate", the browser asks for your permission and records only the spoken passage, up to the time limit shown on screen. When you stop, the audio is sent to our API, converted and transcribed. The text appears in the field as editable content — you review it before generating anything.
  • The audio is not stored: the recording exists only in memory and in a temporary file while it is being processed, and is deleted when the request ends, including on error. We do not keep the audio in a database, backup or file storage, and it is not used to train models.
  • Third-party transcription: to turn speech into text, the audio may be sent to a transcription provider — currently Groq, Inc. (Whisper model) and, alternatively, OpenAI — under policies that prohibit using the content to train models. We send only the audio of the dictated passage: no account data accompanies it.
  • Sensitive personal data: a voice recording may qualify as biometric data under the LGPD (art. 5, II). This processing therefore relies on your specific, highlighted consent (art. 11, I), given when you activate the microphone and revocable at any moment. We do not create a biometric identifier from your voice, do not compare it with other recordings, and do not use it to identify you.
  • Minors: if you are under 18, using dictation requires the consent of at least one parent or legal guardian (LGPD, art. 14). Without that consent, please type instead.
  • Accuracy: automatic transcription makes mistakes, especially with acronyms, technical terms, background noise and accents. That is why the text always lands in an editable field and is never used to generate content without your review.

To opt out, simply do not activate the microphone. Nothing else on the platform is limited by that choice.