Privacy Policy
Last updated: July 6, 2026
Effective date: July 6, 2026
1. Introduction
Welcome to Lingoproof (“we”, “our”, or “us”). We are committed to protecting your personal data and respecting your privacy.
This Privacy Policy explains how Lingoproof collects, uses, stores, and shares your personal data when you use our website at lingoproof.com (the “Service”). It also explains your rights as a data subject under applicable laws, including Brazil’s Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018), the European General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).
By using our Service, you acknowledge that you have read and understood this Privacy Policy.
2. Who We Are
Business name: Lingoproof
Operator / Legal entity: Natalia Apolinario Ferreira Terra — CPF 098.697.666-09
Address: Juiz de Fora, Minas Gerais, Brazil
Data Protection contact (DPO): support@lingoproof.com
3. What Personal Data We Collect
We collect only the data strictly necessary to provide our Service (principle of data minimisation).
3.1 Data you provide directly
| Data | When collected | Purpose |
|---|---|---|
| Full name | When requesting your certificate | To personalise and issue your certificate |
| Email address | After completing the test | To send your results and certificate |
| Payment information | During checkout | To process your payment (handled by our payment processing partners) |
3.2 Data collected automatically
| Data | How collected | Purpose |
|---|---|---|
| IP address (anonymised) | Automatically on site visit | Security, analytics (anonymised) |
| Browser type and device | Automatically on site visit | Technical improvement |
| Pages visited and time spent | Via Google Analytics (with consent) | Understanding user behaviour |
| Test results | When you complete the test | To calculate and display your CEFR level |
| Cookie preferences | Via consent banner | To record your consent choices |
Note: We anonymise IP addresses before processing. We do not store full IP addresses.
4. Legal Basis for Processing (LGPD / GDPR)
We process your personal data on the following legal bases:
| Processing activity | Legal basis |
|---|---|
| Sending test results by email | Consent (Art. 7, I — LGPD) |
| Issuing and delivering your certificate | Performance of contract (Art. 7, V — LGPD) |
| Processing payment | Performance of contract |
| Analytics (Google Analytics) | Consent (Art. 7, I — LGPD) |
| Security and fraud prevention | Legitimate interest (Art. 7, IX — LGPD) |
| Legal compliance | Legal obligation (Art. 7, II — LGPD) |
5. How We Use Your Data
We use your personal data exclusively for the following purposes:
- To send you your language test results by email
- To generate and deliver your official Lingoproof certificate
- To process your payment for the certificate
- To send follow-up emails about your certificate (you may unsubscribe at any time)
- To improve our Service through anonymised analytics
- To ensure the security and integrity of our platform
- To comply with legal obligations
We do not use your data for:
- Selling to third parties
- Targeted advertising
- Automated decision-making that produces legal effects
6. Third Parties Who Receive Your Data
To provide our Service, we share data with the following trusted third-party providers. Each has been selected for their commitment to data protection.
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Payment Partners (e.g., PayPal, dLocal Go) | Payment processing | Name, email, payment data | Available during checkout |
| Brevo (Sendinblue) | Email delivery | Name, email address | brevo.com/legal/privacypolicy |
| Google Analytics | Website analytics | Anonymised usage data | policies.google.com/privacy |
| Hostinger | Web hosting | Server logs (IP anonymised) | hostinger.com/privacy-policy |
We do not sell your personal data to any third party.
All third-party providers are required to process your data in accordance with applicable data protection laws and our instructions.
7. International Data Transfers
Some of our third-party providers are based outside Brazil and the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Data Processing Agreements (DPAs) with all providers
Specifically:
- Payment Partners — Global (covered by SCCs and local regulations)
- Brevo — EU/France (adequate protection under GDPR)
- Google Analytics — USA (covered by SCCs + anonymisation)
8. How Long We Keep Your Data
We retain your personal data only for as long as necessary:
| Data | Retention period |
|---|---|
| Email address (test results) | 12 months from last interaction |
| Certificate data (name, level, date) | 5 years (for certificate verification purposes) |
| Payment records | 5 years (legal/tax obligation) |
| Analytics data | 14 months (Google Analytics default) |
| Cookie consent records | 12 months |
After the retention period, your data is securely deleted or anonymised.
9. Your Rights as a Data Subject
Under the LGPD and GDPR, you have the following rights regarding your personal data:
- Right of access: You may request a copy of the personal data we hold about you.
- Right of correction: You may request that we correct any inaccurate or incomplete data.
- Right of deletion: You may request that we delete your personal data, subject to legal retention obligations.
- Right of portability: You may request your data in a structured, machine-readable format.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Right to object: You may object to processing based on legitimate interest.
- Right not to be subject to automated decisions: We do not make automated decisions that produce legal effects on you.
- Right to lodge a complaint: You may lodge a complaint with Brazil’s Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd, or with your local data protection authority.
To exercise any of these rights, contact us at: support@lingoproof.com
We will respond within 15 business days.
10. Cookies
We use cookies and similar technologies to operate our website and improve your experience.
Types of cookies we use:
| Type | Purpose | Can be disabled? |
|---|---|---|
| Strictly necessary | Site functionality, security |  No |
| Analytics (Google Analytics) | Understanding usage patterns |  Yes — via consent banner |
| Marketing | We do not use marketing cookies | N/A |
You can manage your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of our website.
11. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:
- SSL/TLS encryption (HTTPS) for all data transmission
- Secure password storage (hashed and salted)
- Access controls limiting who can access personal data
- Regular security monitoring and updates
- Automatic backups
However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but commit to notifying you and the relevant authorities in the event of a data breach, as required by law.
12. Children’s Privacy
Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us at support@lingoproof.com and we will delete it promptly.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and notify registered users by email where required by law.
We encourage you to review this Privacy Policy periodically.
14. Contact Us
For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact our Data Protection Officer (DPO):
Email: support@lingoproof.com
Response time: Within 15 business days
For complaints that are not resolved to your satisfaction, you may contact Brazil’s data protection authority:
ANPD: gov.br/anpd