Carregando...
Cookie Policy
How ProEvolua uses cookies, local storage, and similar technologies
This is a courtesy English translation. The Portuguese version is authoritative for legal interpretation under Brazilian law.
1. About this policy
This Cookie Policy describes how ProEvolua("ProEvolua", "we") uses cookies, local storage, and similar technologies ("cookies" hereafter) on the site and platform programe.proevolua.com.br.
This policy is part of our Privacy Policy and Terms of Use. By using the platform you agree to the use described here, subject to the management options in Section 8.
2. What cookies are
Cookies are small text files that your browser stores when you visit a site, allowing the site to recognize you across visits, keep your session active, and remember preferences.
Alongside traditional cookies we also use browser localStorage and sessionStorage — technically not HTTP cookies, but serving similar purposes and covered by this policy.
3. Legal basis (LGPD Art. 7)
We process personal data via cookies under the following bases of the Brazilian General Data Protection Law (Lei 13.709/2018):
- Contract performance (Art. 7, V): strictly necessary cookies to deliver the service you contracted (login, session, security).
- Legitimate interest (Art. 7, IX): functional and aggregated analytics cookies to understand usage and improve the product, always respecting your expectations and rights.
- Legal obligation (Art. 7, II): technical logs required by Brazilian Civil Internet Framework (Lei 12.965/2014).
4. Cookies we use
Strictly necessary
Without these, the platform doesn't work. Do not require consent (LGPD Art. 7, V).
access_token / refreshToken
Where:localStoragePurpose:Keep the user authenticated across pages and renew the session.Retention:refresh: 30 days · access: ~1h
csrf_token
Where:HTTP-only cookiePurpose:CSRF protection on authenticated requests.Retention:Session
user (snapshot)
Where:localStoragePurpose:Local cache of profile data to avoid refetching on every navigation.Retention:Until logout or session expiration
Functional
Store preferences and states that improve experience. Basis: legitimate interest.
email-verify-banner-dismissed-until
Where:localStoragePurpose:Remember when the user dismissed the verify-email banner.Retention:24 hours
ui-preferences
Where:localStoragePurpose:Focus mode, sidebar state (open/closed), selected theme.Retention:Persistent until manually cleared
Payment (Stripe)
Set by Stripe during checkout. ProEvolua does not control these cookies — they are managed under Stripe's privacy policy.
__stripe_mid, __stripe_sid
Where:stripe.com cookiePurpose:Checkout fraud prevention. Set only during the payment session.Retention:__stripe_mid: 1 year · __stripe_sid: 30 minutes
Analytics (Google Analytics 4)
Analytics cookies only with your consent. If you decline, we still count the visit anonymously — no cookie and no identifier that could recognize you later (Google Consent Mode v2).
_ga, _ga_<property-id>
Where:first-party cookiePurpose:Distinguish visitors and sessions, measure navigation and funnel steps (sign-up, Imersão start, subscription).Retention:2 years (Google Analytics 4 default) — created ONLY if you accept analytics
cookieless measurement (consent declined)
Where:none — nothing is stored on your devicePurpose:Aggregated page and action counts, with no cookie, no persisted client ID and no profiling. It only tells us how many people used each step; it cannot recognize you on a future visit.Retention:Not applicable (nothing stored in the browser)
server-side events
Where:sent from our backend to GA4Purpose:Facts the browser cannot see: subscription renewal and cancellation, payment failure, module completion. Tied to your user_id, no financial data.Retention:14 months (retention configured on the property)
Marketing
Only with your consent, and off by default. If you decline, nothing in this category is loaded.
Google ad signals
Where:third-party cookie (google.com)Purpose:Measure ad results and build remarketing audiences. Controlled by Consent Mode: denied until you accept.Retention:Per Google policy
LinkedIn Insight Tag
Where:third-party cookie (linkedin.com)Purpose:Measure LinkedIn ad results and build remarketing audiences. Loads only after marketing consent.Retention:Per LinkedIn policy
5. Sharing with third parties
We work with the following data processors (LGPD Art. 5, VIII):
- Stripe (Stripe, Inc. — United States): payment processing. Data shared: name, email, payment method. Stripe Privacy Policy.
- Google Analytics 4 (Google LLC — United States): product analytics and campaign measurement. Data shared: user_id, aggregated usage events and traffic source, no financial or personal information beyond the id. Google Privacy Policy.
- LinkedIn (LinkedIn Ireland Unlimited Company): ad measurement and remarketing audiences, only if you accept marketing cookies. Data shared: page visit and ad click identifier. LinkedIn Privacy Policy.
- Bunny.net (BunnyWay d.o.o. — Slovenia): video delivery for classes. Data shared: IP address at playback time, technical browser data. Bunny.net Privacy Policy.
- Google Cloud Platform (Google LLC — United States): hosting infrastructure (Cloud Run, Cloud SQL). Data stored in
southamerica-east1region (São Paulo, Brazil). GCP Data Processing Terms.
International transfers occur under adequate guarantees per LGPD Art. 33, mainly standard contractual clauses and adequacy via certifications such as SOC 2.
6. Your rights as a data subject (LGPD Art. 18)
You have the right, at any time, to request:
- Confirmation that your data is being processed;
- Access to the data being processed;
- Correction of incomplete, inaccurate, or outdated data;
- Anonymization, blocking, or deletion of unnecessary data or data processed against LGPD;
- Portability of data to another provider;
- Deletion of data processed based on your consent;
- Information about who we share your data with;
- Consent withdrawal, under Art. 8, § 5;
- Objection to processing based on exemption-from-consent hypotheses.
7. How to exercise your rights
You can exercise the rights in Section 6 in two ways:
- Via the platform: in My Data you can export (portability) or request immediate account deletion, without human intervention.
- Via DPO: for any other request, email dpo@proevolua.com.br or use the DPO contact form. We respond within 15 business days (LGPD Art. 19, § 1).
8. How to manage cookies
In your browser: every modern browser lets you block or clear cookies via Settings → Privacy. Blocking strictly necessary cookies prevents login and breaks the platform.
On ProEvolua: when you log out, we remove authentication tokens from localStorage. To clear all data tied to your account, use My Data.
Third-party cookies: each processor (Stripe, Google, LinkedIn, Bunny.net) has its own opt-out controls, described in their respective policies linked in Section 5.
9. Data retention via cookies
Strictly necessary cookies are deleted at the end of the session or when the token expires (max 30 days for refresh tokens).
Aggregated analytics events are retained for 14 months on Google Analytics 4, tied to your user_id. The _ga cookies last up to 2 years in your browser and you may delete them at any time. You may request anonymization of these events via the DPO.
Payment data is retained by Stripe per Brazilian tax requirements (up to 5 years after the last transaction).
10. Updates to this policy
This policy may be updated periodically. Material changes — for example, a new data processor, a new cookie category, or a base legal change — will be communicated on the dashboard and by email to active users at least 7 days before the effective date.
Version history is documented in Section 11. The version in force is always the one shown at the top of this page.
11. Revision history
- v1.0 (June 26, 2026): initial publication.
Data Protection Officer (DPO)
dpo@proevolua.com.br · Form at /privacy/dpo