Privacy Policy

The controller of your data is SHORT STACK DESENVOLVIMENTO DE SOFTWARES LTDA, registered under CNPJ 66.334.896/0001-53, with its registered office at Visconde do Rio Branco, 1488, conj. 909 – Centro, Curitiba/PR – CEP 80420-210, which operates Short Stack Arena.

As a small-scale processing agent, the company is exempt from appointing a data protection officer (art. 11 of ANPD Resolution CD/ANPD No. 2/2022) and keeps a communication channel for data subjects, as LGPD art. 41, § 2, I requires: the email support@shortstackarena.com. For general matters, use support@shortstackarena.com or the Support page.

• Account: name, email and profile picture provided by Google or Apple when you sign in; the nickname, avatar and language you choose.
• Service usage: training results (your decisions and how each was graded), rating (Elo) and tier, tournament history, daily streaks, the solutions you open and your use of the tools.
• Payments: processed by partner payment companies (card, Pix — with name and CPF/CNPJ — and cryptocurrency). We receive the subscription status, amounts, dates and transaction identifiers. The site never receives or stores card numbers.
• Affiliate program: if you take part, the payout details you provide (Pix key, crypto wallet or Luxon Pay account) and your referral and commission history.
• Support: name, email and the content of messages sent through the support form; replies are sent by email.
• Discord: if you link your account, your Discord identifier and username; spots you request through the bot, with the screenshot you sent.
• Sign-up origin: the utm_* parameters of the campaign link you first arrived through, the landing page, the referring site and the date of that visit, linked to your account to measure which promotions bring sign-ups and subscriptions (see the Cookie Policy).
• Technical data: IP address, date and time of access, country estimated from the IP, browser type and session logs, used for security and to comply with art. 15 of the Marco Civil da Internet.
• AI assistant: the questions you send to the "Ask AI" feature and the generated answers.
• Images and voice: payout screenshots you upload in the tools and voice requests made in the admin tools are sent to an artificial intelligence provider to be read. Audio is not stored after it is processed.
• Ad measurement (only with your consent): if you accept advertising cookies, the Meta Pixel records the pages you visit on the site, account creation, the start of a payment and the subscription (plan, amount and currency), together with the _fbp cookie identifier and the technical data the pixel itself collects (IP address and browser). We do not send Meta your name, email, phone number or CPF.

We do not collect sensitive personal data (LGPD art. 5, II) and we do not ask for identity documents.

Each use rests on a legal basis in LGPD art. 7:

• Creating and keeping your account and providing the service (solutions, training, ranking, tournaments, tools): performance of a contract (art. 7, V).
• Charging subscriptions, processing refunds and paying affiliate commissions: performance of a contract (art. 7, V) and compliance with a legal or regulatory obligation, such as keeping tax records (art. 7, II).
• Keeping application access logs for the legal period: compliance with a legal obligation (art. 7, II; art. 15 of the Marco Civil da Internet).
• Security, fraud and abuse prevention, usage limits: legitimate interest (art. 7, IX).
• Answering support and data subject requests: performance of a contract (art. 7, V) and legal obligation (art. 7, II).
• Answering the AI assistant and reading images or voice you send: performance of a contract (art. 7, V), since it is the feature you asked for.
• Improving the product with aggregated usage statistics: legitimate interest (art. 7, IX).
• Defending rights in judicial, administrative or arbitration proceedings: regular exercise of rights (art. 7, VI).
• Measuring and optimizing our ads on Instagram and Facebook (Meta Pixel), including showing Short Stack Arena ads to people who have visited the site: consent (art. 7, I), which you can withdraw at any time under Cookie preferences.

We do not sell personal data and do not build profiles for third parties. The only advertising-related use is the ad measurement described above, which depends on your consent; refusing it does not limit any feature of the site. The grading of your plays and your rating are automatic training calculations and have no legal effect on you.

• Account and usage data: while the account exists. Erased when you delete the account, except what must be kept under the items below.
• Access logs (IP, date and time): at least 6 months, as art. 15 of the Marco Civil da Internet requires; then erased automatically (about 7 months after being recorded).
• Questions to the AI assistant: 12 months.
• Financial and tax records (payments, invoices, refunds, commissions): 5 years, the period set by tax law.
• Support messages: as long as needed to handle the request and to defend rights.
• Voice request audio: not stored.
• Meta Pixel data: the _fbp cookie stays in your browser for up to 90 days and is deleted from this site when you withdraw consent; what Meta has already received is kept under Meta’s privacy policy.

When the period ends, the data is erased or anonymized.

We share data only with processors that help us provide the service, each limited to its role and bound to protect the data:

• Infrastructure: hosting, database, authentication, file storage, content delivery and bot protection.
• Payments: card, Pix and cryptocurrency processors, and the subscription management portal.
• Artificial intelligence: providers of the models that answer the assistant and read images and voice.
• Communication: sending support emails.
• Sign-in and community: Google and Apple, when you sign in with them, and Discord, if you link your account.
• Advertising (only with your consent): Meta Platforms, which receives the Meta Pixel data to measure and optimize our ads and also processes it under its own privacy policy.

We do not sell personal data. The only sharing for advertising is the Meta Pixel, and it happens only if you accept advertising cookies. You can ask for the list of companies that process your data through our privacy channel (LGPD art. 18, VII). We may also provide data to authorities when the law or a court order requires it.

Some of these processors handle data outside Brazil, mainly in the United States and the European Union. These transfers rely on LGPD art. 33: on the contractual data protection safeguards those providers offer (art. 33, II) and, when the transfer is needed to perform the contract with you, on art. 33, IX. Meta Pixel data is processed by Meta also outside Brazil, based on your specific and highlighted consent, given in the cookie notice, which states that international nature (art. 33, VIII).

Under LGPD art. 18 you may request at any time:

• confirmation that we process your data;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or erasure of unnecessary or excessive data, or data processed in breach of the law;
• portability of the data to another provider;
• erasure of data processed on the basis of your consent;
• information about who we share your data with;
• information about the possibility of not consenting and its consequences;
• withdrawal of consent;
• objection to processing based on another legal ground, where the law is not being complied with;
• review of decisions taken solely on the basis of automated processing (art. 20).

To get a copy of your data or exercise any other right, write to our privacy channel at support@shortstackarena.com. We reply within 15 days.

To erase your account, request it by email at support@shortstackarena.com; the deletion is done within 15 days. If you have an active subscription, cancel it before requesting the deletion. We may ask you to confirm the request comes from the account holder, to protect your data.

Short Stack Arena is intended only for people aged 18 or over. We do not knowingly collect data from children or adolescents. If we learn that an account belongs to a minor, it will be closed and its data erased.

We use encrypted connections (HTTPS), per-user access control in the database, service keys kept only on the server and restricted administrative access. No system is entirely immune to failure; if a security incident may cause you relevant risk or harm, we will notify you and the ANPD, as LGPD art. 48 requires.

We use strictly necessary and preference storage and, only if you accept, the Meta Pixel advertising cookies. Nothing from Meta loads before you choose, and you can change your choice at any time under Cookie preferences in the site footer. Details are in the Cookie Policy.

We may update this Policy. The date of the last update appears at the top of the page. Relevant changes will be announced on the site or by email before they take effect.

If you believe your rights were not respected, you may file a complaint with Brazil’s National Data Protection Authority (ANPD) at www.gov.br/anpd. We recommend contacting the data protection officer first, which is usually faster.