1. Who this notice applies to

This notice supplements the Privacy Policy and covers only the Referral Program, which is governed by the Program Terms. It applies to three people: the person who invites ("participant"), the person who creates an account through an invitation ("invitee"), and anyone who merely opens an invitation link. Everything the Privacy Policy says that this notice does not change still applies.

Controller: Mister Education.
Data protection officer (encarregado): info@mistereducation.com.

2. Data about the person who invites

Your invitation code and the date it was created.
Your invitations, with the date each account was linked to your code.
Your referral credits: amount, the month they relate to, status (waiting, available, under review, paid or cancelled) and the dates they were produced, became available and were paid.
Review signals attached to your credits, such as the number of invitations that subscribed within a period.
Your withdrawals: amount, Pix key type, date, the Asaas transfer reference and the outcome. The Pix key itself is not kept: we keep an irreversible code of it, computed with a secret key. Of the key holder, as identified by the Pix key directory (DICT), we keep only an irreversible code of their CPF or CNPJ, used to make sure later withdrawals go to the same person. The holder's name, also returned by DICT, may be shown to our team for checking and is not stored.
Your acceptance of the Program Terms: the version accepted, and the date and time.
Technical security records of withdrawal requests, such as short-lived attempt counters tied to your account and your IP address.

3. Data about the invitee, and what the person who invited sees

If you created your account through an invitation, we process: the link between your account and the inviter's code, and its date; your plan and your subscription status; the paid charges that produced credits, with each charge's Asaas reference, for accounting; and whether any of them was reversed or refunded, because that cancels the corresponding credit.

The person who invited you sees, on their dashboard: the first letter and the domain of your email address (for example, m***@gmail.com); when your account was created and linked to the invitation; the plan name; whether the subscription is active and whether it counts for the Program; and, for each credit, its amount, status and dates. If you delete your account, they only see that the account was closed.

They never see: your name, your full email address, your identifier on the Platform, what you study or write, your payment method, the processor, whether a payment was late, or why a credit was cancelled.

The product currently does not tell an invitee that they arrived through an invitation. If you want to know whether your account is linked to an invitation, and whose, write to info@mistereducation.com. The data export in Account also includes that record.

4. Someone who only opens a link: the referral_ref cookie

When you open an invitation link on our site, your browser receives the referral_ref cookie, which holds only the invitation code, for up to 60 days. A link opened later replaces the earlier one. It serves to link any account you may create to the person who invited you, and nothing else: it is not used for advertising or to follow you on other sites.

It is set without asking for consent, on the basis of legitimate interest (LGPD art. 7, IX and art. 10, I), because it holds only a code and is the only way an invitation can work. You can delete it at any time by clearing the site's cookies. The full list is in the Cookie Policy.

5. Purposes and lawful bases

Recording invitations, calculating and releasing credits and paying withdrawals, basis: performance of a contract with the participant (LGPD art. 7, V).
Processing the invitee data needed to calculate credits, and showing the inviter the narrow view described in section 3, basis: legitimate interest, ours and the inviter's, in making the Program work (LGPD art. 7, IX and art. 10, I and II), limited to what is necessary.
Consulting DICT, recording the key holder and analysing fraud signals, basis: legitimate interest in fraud prevention and in participants' security (LGPD art. 7, IX).
Keeping access and payment records required by law, basis: compliance with a legal obligation (LGPD art. 7, II), including article 15 of the Marco Civil da Internet and tax law.
Defending rights in judicial, administrative or arbitral proceedings, basis: regular exercise of rights (LGPD art. 7, VI).
The referral_ref cookie, basis: legitimate interest (section 4).

Where processing is based on legitimate interest, you may object to it (LGPD art. 18, paragraph 2) by writing to info@mistereducation.com.

6. Pix, Asaas and DICT

Withdrawals are Pix transfers made from our account at Asaas, our payment processor, acting as a processor on our behalf. To identify the key holder, Asaas consults DICT, the Pix key directory maintained by the Central Bank of Brazil. Asaas and the institutions involved in the transfer keep their own records, for the periods Central Bank rules and Lei nº 9.613/1998 require of them. Those records are theirs and are not deleted when you delete your account here.

7. Automated decisions

Two things in the Program are automatic: the volume signal, which can hold credits for review, and the holder rule, which refuses a withdrawal to a key of a different holder. Neither cancels credits. A held credit is reviewed by a person, and a refused withdrawal can be reviewed at your request. You may ask for review of these decisions and for information about the criteria used (LGPD art. 20), subject to commercial and industrial secrecy (art. 20, paragraph 1).

8. Who we share data with

With the person who invited you, only what is in section 3.
With Asaas, to pay withdrawals and consult DICT.
With the other processors listed in section 4 of the Privacy Policy, such as hosting and database, only as far as necessary.
With public authorities, when the law or a court order requires it.

We do not sell personal data. Some of our processors are outside Brazil, and those transfers follow section 5 of the Privacy Policy (LGPD art. 33).

9. How long we keep data

Program data is kept for as long as the inviter's account exists. When that person deletes their account, their invitations, credits and withdrawal records in our database are deleted. Records of transfers already made remain at Asaas, and in the accounting documents the law requires us to keep, for the legal period.
When an invitee deletes their account, the link to that account is removed. The record of the invitation and its credits remains, without the deleted account's identifier, for as long as the inviter's account exists, because credits already released stay valid.
referral_ref cookie: up to 60 days.
Security event records: 90 days. Access records required by the Marco Civil da Internet: 6 months.

10. Your rights

Participants, invitees and anyone who opened a link have, free of charge and at any time, the rights in LGPD article 18: confirmation and access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent, objection to processing based on legitimate interest, and review of automated decisions.

The export at Account → Export your data includes Program data. For anything else, write to info@mistereducation.com. We reply within 15 days. You may also complain to the Brazilian National Data Protection Authority (ANPD, gov.br/anpd).

11. Security

Pix key and holder document kept only as irreversible codes computed with a secret key; withdrawal tables reachable only by the server; row level security, so each person sees only their own invitations; attempt limits on withdrawal requests; a per-transfer ceiling; and approval of each transfer checked against the recorded request. In case of a security incident that may cause relevant risk or harm, we will notify the ANPD and the people affected within the legal deadlines (LGPD art. 48).

12. Children and adolescents

The Program is only for people aged 18 or over. An adolescent aged 13 to 17 may have joined the Platform through an invitation, with the consent the Privacy Policy requires. In that case the person who invited them sees only what is in section 3, and we process that data in the adolescent's best interest (LGPD art. 14). Parents and guardians may exercise the rights in section 10 on their behalf.

13. Changes and contact

We may update this notice. The date of the last update is at the top of this page, and relevant changes are announced on the Program dashboard or by email. Questions and requests: info@mistereducation.com.