1. Who we are
Forge College ("Forge", "we") is operated by ARM WEB3 LTDA, registered under CNPJ no. 48.812.900/0001-60, headquartered at Av. Professor José Inácio de Souza, 1186, Sala 06, Bairro Brasil, Uberlândia, MG, 38400-732, Brazil. For LGPD purposes, we are the controller of the personal data processed under this policy.
Data protection officer (DPO): Artur Rodrigues de Moura, who you can reach at contact@forge.college.
2. What data we collect
- Sign-up: name, e-mail and password (stored encrypted). If you sign in with Google or GitHub, we receive your name, e-mail and profile picture from those accounts.
- Profile: username, picture or avatar and anything else you choose to add to your profile.
- Platform use: lessons, tracks and programs you start and finish, exercises, XP, coins, level, study streak, achievements and ranking position.
- Questions to Sparky: the lesson passage you select and the question you write.
- Communications: messages you send us, feedback you send through the platform and your e-mail, if you join a waitlist or ask to be notified.
- Technical data: IP address, device and browser type, language, pages visited, date and time of access and cookie identifiers.
We do not ask for sensitive data, such as racial origin, health, religion or political opinion. Please do not include it in your questions or profile.
3. What we use it for, and on what legal basis
- Providing the platform (creating your account, saving your progress, showing the ranking and issuing certificates): performance of our contract with you, which is our Terms of Use.
- Answering your questions to Sparky: performance of the contract.
- Sponsor rewards (checking eligibility and delivering prizes): performance of the contract and the rules of each campaign.
- Improving Forge and understanding how it is used: legitimate interest, using aggregated data whenever possible. Statistics cookies only with your consent.
- Security and fraud prevention, including in the ranking: legitimate interest.
- Communications: notices about your account are part of the service. News and marketing only with your consent, and you can unsubscribe at any time through the link in the e-mail.
- Ads and campaign measurement: consent, through marketing cookies.
- Complying with legal obligations, such as keeping access logs for the period required by the Brazilian Internet Civil Framework (Marco Civil da Internet): legal obligation.
4. What other people can see
For the ranking and your public profile to work, other people can see your display name or username, your picture or avatar, your level, your XP, your achievements and the tracks you finished. Your e-mail and sign-up data never appear publicly.
5. Sparky, the AI tutor
When you ask Sparky a question, the selected passage and your question are sent to OpenAI, our artificial intelligence provider, only to generate the answer. Under OpenAI’s API policy, this data is not used to train its models.
Answers are generated automatically and may contain mistakes. See more in our Terms of Use.
7. International transfers
Some providers store or process data outside Brazil, mainly in the United States. In those cases, the transfer follows the cases allowed by the LGPD (art. 33), with contracts that require an adequate level of protection.
9. How long we keep it
We keep your data while your account is active. If you ask us to delete your account, we delete or anonymize your data within 30 days, except what the law requires us to keep (for example, access logs, kept for 6 months under art. 15 of the Marco Civil da Internet) and what is needed to exercise rights in legal proceedings.
10. Your rights
Under the LGPD (art. 18), you can at any time:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- ask for anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
- ask for the portability of your data;
- ask for the deletion of data processed based on your consent;
- know who we share your data with;
- withdraw your consent and know what happens if you do not give it;
- object to processing based on legitimate interest.
To exercise any of them, write to contact@forge.college. We may ask you to confirm your identity to protect your account, and we reply within 15 days. You can also file a complaint with the Brazilian Data Protection Authority (gov.br/anpd).
11. Security
We use encrypted connections (HTTPS), encrypted password storage, access controls and providers with recognized security practices. No system is 100% secure: if an incident may bring relevant risk or harm to you, we will notify you and the ANPD, as the law requires.
12. Children and teenagers
Forge is intended for people aged 18 or over. Teenagers aged 16 or over may use the platform with the authorization of their parents or guardians. We do not knowingly collect data from children; if we find such a case, we will delete the data.
13. Changes to this policy
We may update this policy to reflect changes to Forge or to the law. The date at the top shows the version in force. If a change is relevant, we will let you know through the platform or by e-mail before it takes effect.
14. Talk to us
Questions about privacy? Write to contact@forge.college.