Privacy Policy

When you register, we process your username, email address, password stored as a hash, optional brand name, creation date, and verification status. We also process session data, user agent, and sign-in history to protect access.

In your profile, you may provide a bio, avatar, social links and, when enabled, optional public-profile data such as location, pronouns, date of birth, language, skills, certifications, and links. Information marked public may be displayed to profile visitors.

For Google, the requested scopes are openid, email and profile; we receive the account identifier, email, name and profile picture to create or link your account.

For Discord, the requested scopes are identify and email; we receive an identifier, username, email and avatar. If you link Discord and are eligible, the identifier may also be used to grant a Premium role or send a configured server message.

For digital-product purchases, we process your name, email, product, amount, order status, transaction IDs, PIX QR Code, and delivery token. The system is not designed to store a full card number; the transaction is processed by payment providers.

In the advertiser portal, we process account data, brand, campaign, destination URL, creatives, logo, brief, price, status, credits, and operational billing data. This is needed to contract, review, and deliver the campaign.

To record downloads and post views, the system processes pseudonymized network identifiers, user agent, accessed item, and date/time. This enables counting, abuse prevention, and download history for authenticated accounts.

For public profiles, the system may record one unique visit per day. For security and auditing, some records may include IP address, user agent, requested URL, approximate country, and limited details of an action or suspicious event.

For first-party ads, we record an IP hash, approximate country, referrer, ad, event type, and date/time. The purpose is delivery measurement, fraud detection, and aggregate advertiser reporting — we do not provide direct visitor identification to advertisers.

The site contains code that can load Google AdSense, PropellerAds, Monetag, and Admandala based on the active page configuration. These vendors may process identifiers and browsing data under their own policies.

To provide APT, we process the application username, password hash, hardware identifiers (HWID, when used), last sign-in date, and execution tokens. This data is used to validate license, security, and access to the purchased product.

The execution link is individual, expires after 15 minutes, and is invalidated after one use. Execution updates the account-use record. The application does not collect, access, or transfer personal files or computer content.

We use a session refresh cookie and temporary OAuth state cookies for authentication and request-forgery protection. The browser may also store an access token, local session marker, post-login return, temporary checkout state, and local preferences.

If you allow notifications, we process the push subscription, its public keys, and user agent to send alerts. You may revoke permission in browser settings and unsubscribe.

We process personal data only when there is a legitimate purpose and an applicable legal basis. The table below is a reference matrix for activities found in the audit.

We share only the minimum necessary for the disclosed purpose. We do not sell personal data and do not authorize advertisers to directly identify visitors through campaign metrics.

Some partners may process data outside Brazil according to their infrastructure, including Stripe, Google, Discord, Resend, Cloudflare, and advertising networks. The specific location may vary by service and configuration.

When an international transfer occurs, aMathyzin will seek to adopt the applicable legal mechanism under LGPD Article 33, with compatible security, transparency, and documentation measures.

We keep data only as long as needed for the purposes in this Policy, legal or regulatory obligations, fraud prevention, and the establishment or exercise of rights. Deleting an account does not erase data that must be retained for those reasons.

APT tokens expire after 15 minutes and are single-use; OAuth state cookies expire after 10 minutes; OTP codes expire after 1 hour; and sign-in history is limited to the latest 20 records. Transaction and connection records are retained according to statutory retention periods.

The platform uses HTTPS, password hashes, expiring tokens, Secure/HttpOnly/SameSite refresh cookies, CAPTCHA, request rate limiting, additional administrative authentication, access control, and security logging.

No system is completely invulnerable. If a security incident presents relevant risk or harm, aMathyzin will assess the event and take applicable communications and measures, including to the ANPD and data subjects where required by law.

You may request confirmation of processing, access, correction, anonymization, blocking or deletion where applicable, portability, information about sharing, withdrawal of consent, and review of automated decisions, where they exist.

To exercise your rights, email contato@amathyzin.com.br with the subject “Privacy — [request type]”, preferably from the account email address. We may request proportionate information to verify your identity and protect your account.

Within the product, you may also edit profile data, change your password, unlink Discord, end sessions, and revoke browser notifications. If the response is not satisfactory, you may complain to the ANPD, without prejudice to other legal remedies.

The platform is intended for users aged 13 and older and is not directed at children. If you are a parent or legal guardian and identify improper processing of a minor’s data, please contact us through our privacy channel.

We may update this Policy to reflect changes in the product, partners, or law. Material changes will be published with a new date and version; when needed, we will also use available communication channels.