Privacy Policy

Privacy Policy

VERSION: privacy-v1 EFFECTIVE DATE: August 14, 2026

This Privacy Policy explains how Schole Startup Studio, which operates DOCOD, processes personal data in connection with the service, including the website, accounts, Daily Challenges, Premium subscriptions, book purchases and delivery, payments, communications, and other features provided through the platform.

It also explains why this data is processed, who it may be shared with, how long it may be retained, and how you can exercise your rights.

The Portuguese version of this Policy is the version of record.

1. Who is responsible for your data

SCHOLE STARTUP STUDIO, registered under Brazilian company number (CNPJ) 31.393.117/0001-06 and publicly identified as Codenroll Technologies, is the controller of the personal data processed for the purposes described in this Policy.

This means it makes the primary decisions about why and how this data is processed.

The company operates from São Paulo, Brazil, and publishes hello@codenroll.tech as an official contact channel.

For purposes of this Policy, "DOCOD," "we," "us," and "our" refer to the service it operates.

2. What this Policy covers

This Policy applies to personal data processed when you:

• visit the DOCOD website;
• create or use an account;
• subscribe to the Daily Challenge;
• receive free challenges by email;
• use Premium features;
• submit challenge answers or solutions;
• track your progress;
• purchase the book or other digital products;
• access your library or downloads;
• purchase or manage a subscription;
• make a payment;
• receive transactional communications;
• choose to receive newsletters, materials, or other communications;
• contact us;
• use other features directly provided by DOCOD.

Third-party websites and services linked from DOCOD, such as external repositories, social platforms, or independently operated services, may be governed by their own privacy policies.

3. What data we may process

The personal data we process depends on how you use DOCOD.

3.1 Account data

Where an account is required, we may process your name or display name; email address; language and locale; internal account identifiers; preferences; authentication and session data; and dates related to account creation, access, and updates.

Where passwords are used, they are not stored in plain text.

3.2 Subscriptions and communications

When you subscribe to a challenge, newsletter, free chapter, or other content, we may process your email address; the subscription purpose; the subscription source; language or locale; subscription timestamp; confirmation timestamp; the version of the privacy notice presented; subscription status; unsubscribe or consent-withdrawal records; and technical identifiers needed to securely confirm or cancel the subscription.

Each purpose is handled separately. Subscribing to the Daily Challenge, for example, does not automatically mean that you consent to a separate newsletter.

3.3 Daily Challenges

When you use the challenges, we may process the challenges accessed; submitted answers and solutions; submitted code, where applicable; programming language used; execution or test results; completion status; progress; attempts; timestamps associated with your activity; and the Free or Premium features available to your account.

Please avoid including unnecessary personal information in code, answers, or other content submitted as part of a challenge.

3.4 Book and digital products

When you purchase or receive a digital product, we may process the product purchased; language and edition; format provided; purchase date; amount and currency; order status; transaction identifier; product entitlement; information needed to make the product available in your account or library; and technical records related to delivery or downloads where necessary for operation and security.

Buying a book does not constitute consent to receive marketing communications.

Messages required to confirm, deliver, or administer your purchase are transactional communications and may be sent regardless of whether you subscribe to marketing.

3.5 Premium and subscriptions

When you purchase a recurring or Premium product, we may process the selected plan; start date; billing period; amount and currency; subscription status; renewal and cancellation information; entitlement to Premium features; and payment and subscription identifiers.

This information is used to administer the service you purchased and manage access to the relevant features.

3.6 Payments

Payments may be processed by a specialized payment provider.

Depending on the payment method, we may receive a transaction identifier; amount; currency; payment status; date; the related product or subscription; a customer identifier assigned by the payment provider; limited payment-method information; and billing or tax information where required.

Full payment card information, such as the complete card number and security code, is processed directly by the payment provider where the checkout architecture uses that model.

The payment provider may also process personal data under its own legal obligations and privacy policy.

3.7 Support and direct communications

When you contact us, we may process your email address and identity; the contents of your message; files or information you voluntarily provide; and the history necessary to respond to and manage the request.

3.8 Technical and security data

When you access the service, our application and infrastructure providers may process request date and time; the route or resource accessed; browser and protocol information; IP address; error logs; data used for abuse prevention; authentication and security events; and rate-limiting information.

This information is not used as proof of consent for marketing communications.

3.9 Analytics

We may use aggregated metrics or analytics tools to understand how the website and products are used and to identify experience, performance, or content problems.

Where non-essential technologies require consent under applicable law, they will only be activated in accordance with those requirements.

4. Why we process your data

We process personal data only for defined purposes and where an applicable legal basis exists.

To provide the requested service. We use data to create and maintain accounts; authenticate users; provide challenges; record progress; provide Premium features; deliver purchased books and digital products; maintain libraries and entitlements; manage subscriptions; process orders; and send communications required to provide the service.

Where processing is necessary to provide a product or service under a contract, or to take steps requested before entering into a contract, processing relies on the contractual legal basis expressly available under the LGPD.

To process payments and comply with obligations. Certain transaction, payment, accounting, and tax information may be processed or retained to complete purchases and comply with applicable legal and regulatory obligations.

To send communications you requested. Newsletters, free Daily Challenges, free materials, and other optional communications are sent according to the purpose you selected. Where consent is the legal basis, you may withdraw it through the mechanisms provided; the LGPD expressly provides for withdrawal.

To protect the service. We may process technical data to detect abuse; enforce rate limits; prevent unauthorized access; investigate failures; protect accounts; and preserve the integrity of the platform.

To improve DOCOD. Usage information and aggregated data may be used to understand service performance, correct problems, and improve content, performance, and user experience.

5. Marketing, transactional messages, and consent

DOCOD distinguishes communications required to operate the service from optional communications.

Transactional communications may include account confirmation; purchase confirmation; receipts; product delivery; subscription information; material changes to a purchased service; account security; and requests initiated by you. These messages do not depend on a newsletter subscription.

Optional communications may include the free Daily Challenge; newsletters; new articles; free materials; and updates or other communications you chose to receive.

Consent is recorded separately for each purpose.

Buying the book, purchasing Premium, or creating an account does not automatically subscribe you to marketing.

6. Double opt-in and unsubscribing

Where email confirmation is used, your subscription is confirmed only after you take the action indicated in the email you receive.

Every optional communication provides an unsubscribe mechanism, and no login is required to unsubscribe.

Simply opening an unsubscribe URL does not itself cancel a subscription: a change is made only after an explicit confirmation action. This reduces accidental unsubscribes caused by link scanners, security systems, or automatic page prefetching.

You may unsubscribe from a specific purpose or, where available, from all optional communications.

7. Sharing with service providers

We do not sell your personal data, and we do not provide it to third parties for their own marketing purposes.

We may share necessary information with providers that help us operate DOCOD, including providers of hosting and infrastructure; storage; databases; authentication; payment processing; email delivery; monitoring and security; analytics; and technical support.

These providers receive only the information necessary to perform their respective services, subject to applicable agreements, responsibilities, and obligations.

We may also disclose information where necessary to comply with a legal obligation, a valid request from a competent authority, or to establish, exercise, or defend legal rights.

8. International data transfers

Some service providers may operate infrastructure or process data in other countries.

Where an international transfer is subject to the LGPD, we use the applicable mechanisms provided by law and ANPD regulations. Resolution CD/ANPD No. 19/2024 regulates international data transfers and provides mechanisms including adequacy decisions, standard contractual clauses, specific contractual clauses, and binding corporate rules.

Where the GDPR applies to a particular processing activity, we also apply the requirements relevant to that processing and related international transfers.

9. Data retention

We do not retain all information for the same period. Retention depends on the purpose and nature of the data.

Optional subscriptions. Retained while the subscription is active and for as long as necessary to maintain legitimate records relating to consent and the fulfillment of privacy requests.

Accounts and activity. Account and product-usage data may be retained while the account is active and for the period necessary to operate the service, respond to requests, resolve disputes, and comply with applicable obligations.

Purchases, subscriptions, and payments. Information needed to document transactions, comply with accounting, tax, regulatory, or legal obligations, or establish and exercise legal rights may be retained for the period required or permitted by law.

Privacy requests. We may retain a minimal technical record showing that a withdrawal, unsubscribe, or deletion request was processed, where necessary to demonstrate compliance or prevent a cancelled preference from being improperly reactivated. That record is not used for marketing.

The LGPD provides for certain situations in which data may lawfully be retained after a deletion request.

10. Your rights

Depending on applicable law, you may have the right to request confirmation of processing; access to personal data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion where legally available; portability where applicable; information about sharing; information about the consequences of withholding consent; deletion of data processed on the basis of consent, subject to lawful retention exceptions; withdrawal of consent; objection to processing where provided by law; and review of automated decisions where applicable.

Where the GDPR applies, additional rights available under that Regulation will also be respected.

Exercising applicable privacy rights is free of charge.

11. Account and data deletion

A deletion request does not necessarily mean that every record can be erased immediately.

We will delete or anonymize data where applicable, but certain information may be retained where necessary for compliance with legal or regulatory obligations; establishment or exercise of legal rights; fraud or abuse prevention and investigation; security; or other retention grounds permitted by applicable law.

Deleting an account does not cancel existing financial obligations or invalidate transaction records that must lawfully be preserved.

12. Cookies and local storage

Strictly necessary

DOCOD uses cookies and equivalent mechanisms that are strictly necessary for authentication; session management; security; essential preferences such as the light or dark theme; and checkout functionality or required integrations.

They are not used for tracking or advertising, and the site does not work without them. For that reason they do not require consent.

Measurement, and it depends on you

We use two measurement tools, and they differ in what they require.

Umami. This is our default measurement: self-hosted, with no cookies and no persistent device identifier. It counts visits and events in aggregate, does not build an individual profile, and cannot recognize you across visits. Because it stores nothing in your browser, it does not depend on consent.

Google Analytics. It stores cookies in your browser to help us understand how the site is used. It is only loaded if you accept. Until you accept, the script is not loaded, no Google cookie is stored, and no data is sent to it.

We ask for that choice on your first visit, with accept and decline presented with equal prominence. Declining does not limit any functionality of the site.

How to change your mind

Your choice is stored in your own browser, together with the version of this Policy shown when you decided. You can change it at any time, and clearing site data in your browser also removes that record.

When this Policy changes version we ask again: a choice made about one text does not automatically apply to another.

We do not use advertising or remarketing cookies.

13. Security

We use technical and organizational measures designed to reduce risks of unauthorized access; unauthorized modification; exposure; loss; destruction; and processing inconsistent with the stated purposes.

No internet-connected system can guarantee absolute security.

Where a personal data incident occurs, we will take the measures required under applicable law, including notifications where required.

14. Third-party services and links

DOCOD may provide links to websites, tools, repositories, or platforms operated independently by third parties. Data processing performed directly by those third parties is governed by their own privacy notices and terms.

This Policy covers processing by DOCOD and providers acting as part of our operation; it does not replace the privacy policies of independent services you choose to access.

15. Changes to this Policy

This Policy is versioned. Each new version receives its own identifier, an effective date, and its own content.

Where consent is used as the legal basis for a particular purpose, we maintain a record of the version of the notice associated with that consent. Publishing a new Policy does not retroactively alter the record of an earlier consent.

Where a change requires renewed consent, we will request it appropriately.

16. Contact

For questions about this Policy or to exercise rights relating to personal data, contact:

SCHOLE STARTUP STUDIO (Codenroll Technologies) CNPJ 31.393.117/0001-06 São Paulo, Brazil Email: hello@codenroll.tech

We may request only the information reasonably necessary to verify your identity or authority to make a particular request.

Current version: privacy-v1 Effective date: August 14, 2026