← back

Privacy Policy

Last updated: August 7, 2026 · Under Brazilian Law 13.709/2018 (LGPD)

This Privacy Policy describes how Areia Score (areiascore.com) collects, uses, shares and protects its users' personal data. It follows the Brazilian General Data Protection Law (Law 13.709/2018) and other applicable rules.

1. Data controller

The controller of the personal data processed in the Service is Impulse (legal name: IMPULSE LTDA), registered under CNPJ 35.787.876/0001-04, reachable exclusively at viniciusimpulse@gmail.com for every data protection matter.

2. Data we collect

We collect the following categories of data:

  • Account data: name (optional), email address and password (stored as a bcrypt hash, never in plain text). For accounts created with Google we receive name, email and profile picture from the provider, and no password is created.
  • Subscription data: Stripe customer and subscription identifiers, subscription status, start, renewal and cancellation dates. We do not store card number, expiry date or CVV, which stay exclusively with Stripe.
  • Usage data: pages visited, matches and players opened, device, browser, operating system and approximate country of origin. Collected only when you accept analytics cookies in the banner shown on your first visit.
  • Technical logs: IP address, timestamps and request paths, needed to run the service (fraud detection, abuse prevention, error diagnosis). Kept for up to 90 days.
  • User-generated content: scout reviews, comments or other data you actively create on the platform.

3. Purpose and legal basis

Data is processed for the following purposes, with the matching LGPD legal basis:

  • Account operation and authentication: performance of a contract (Art. 7, V).
  • Premium subscription processing: performance of a contract (Art. 7, V).
  • Transactional communications (receipts, plan changes, billing notices): performance of a contract (Art. 7, V).
  • Analytics, ad measurement and product optimisation (Google Analytics, Microsoft Clarity, PostHog, Meta): consent (Art. 7, I), collected in the cookie banner.
  • Security and fraud prevention: legitimate interest (Art. 7, IX).
  • Compliance with legal obligations (tax, regulatory): Art. 7, II.

4. Sharing with third parties

We share personal data only with processors strictly necessary to run the Service:

We never sell your personal data. Disclosures required by a competent authority (judicial or administrative) are met within the strict limits of the order received.

5. International transfers

Some of our processors (Stripe, Vercel, Neon, Google, Microsoft, Meta, PostHog, Resend) process data outside Brazil. Transfers rely on the contractual safeguards and mechanisms of Art. 33 of the LGPD, including standard clauses and adequacy of the receiving country.

6. Cookies

We use strictly necessary cookies (session, theme and the record of your consent) and optional analytics and ad-measurement cookies, installed only after you accept them in the banner. The per-cookie detail is in the Cookie Policy.

7. Retention

We keep your data while your account is active. After deletion (at your request or if the Service shuts down), personal data is removed within 30 days, keeping only what is strictly necessary to meet legal obligations (tax records, fraud prevention, defence in proceedings).

Aggregated, anonymised statistics (with no possibility of re-identification) may be kept indefinitely for research and product improvement.

8. Your rights as a data subject (LGPD, Art. 18)

At any time, free of charge, you may:

  • Confirm that processing exists;
  • Access your data;
  • Correct incomplete, inaccurate or outdated data;
  • Request anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
  • Request data portability in a structured, interoperable format (JSON/CSV);
  • Request deletion of personal data processed on the basis of your consent;
  • Withdraw consent given for specific purposes (analytics, for example);
  • Learn who we share your data with;
  • File a complaint with the ANPD (Brazilian Data Protection Authority): gov.br/anpd.

To exercise any of these rights, write to viniciusimpulse@gmail.com. We answer within 15 business days.

9. Security

We apply reasonable technical and administrative measures to protect your data, among them:

  • Passwords stored as bcrypt hashes (cost 10);
  • HTTPS connections with up-to-date certificates;
  • Managed database (Neon) with encryption at rest and in transit;
  • Role-based access control (RBAC);
  • Audit logs for critical administrative operations (scout reviews, tournament changes).

In case of a security incident that may cause relevant risk or harm to data subjects, we notify those affected and the ANPD within the legal deadline, under Art. 48 of the LGPD.

10. Children and teenagers

The Service is not aimed at people under 18 without the supervision of a legal guardian. We do not knowingly collect children's data. If we identify improper processing, we delete the data immediately.

11. Changes to this Policy

Material changes are announced by email to registered users at least 7 days in advance. The date of the last update appears at the top of this page.

12. Contact

For any question, request or exercise of rights: viniciusimpulse@gmail.com.