Privacy Notice
Version 1 · Last updated October 1, 2026
1. Who we are and why this Privacy Notice exists
Shadow Study is a subscription study platform. With it, you create practice exams with the artificial intelligence app you already use, such as ChatGPT or Claude, import those exams into your account, practice in exam mode or study mode, and follow how your performance evolves over time.
To offer this service, we process some personal data of the people who use the platform. We are responsible for the decisions about the processing of your account’s data, and we do so in compliance with the Brazilian General Personal Data Protection Law (LGPD – Law No. 13,709/2018) and the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet – Law No. 12,965/2014).
This Privacy Notice aims to explain, clearly and accessibly, how we process your personal data. Throughout this document, you will find information about:
- what data is collected;
- how and why this is done;
- with whom, and to where, this data may be shared;
- how long it is stored;
- how we protect your data; and
- what your rights as a data subject are and how you can exercise them.
This Notice applies to every form of interaction with Shadow Study: access to the shadow.study website, the creation and use of your account, the import and practice of exams, the optional connections with artificial intelligence apps, the subscription to the service, and the messages you send us by email.
2. What personal data is and which data we collect
Personal data is information that identifies or can identify a natural person. A name, an email address, or an IP address are examples of personal data. Data that has been anonymized, so that it is not possible to identify anyone, is not considered personal data under the LGPD.
Some data receives additional protection because of its nature: this is sensitive personal data, such as information related to health, racial or ethnic origin, religious belief, or biometric data. Shadow Study does not request or need sensitive data to work.
The data we collect varies according to how you use the platform. The following table describes the main categories of data we may collect:
Data collected during your relationship with Shadow Study
| Category | Description |
|---|---|
| Account and access data | Needed to create your account, allow sign-in, and recover access when needed. It may include: email address; password, which we store only in irreversible form (hash); display name, which can be any name you choose, up to 50 characters, and is shown only to you; and sign-in records. This data is collected when you set up your access and when you sign in to your account. |
| Study usage and performance data | Needed for the platform to work and for you to follow your progress. The exact set may vary with use. It may include: the exams you import and their origin (the artificial intelligence app and, if you provide it, the link to the conversation in which the exam was created); the answers you selected; your scores; the start and completion dates of attempts; your history; and the learning dashboard statistics. This data is generated as you use the platform. |
| Preferences | Needed to adapt the platform to the way you use it. They may include: light or dark theme, website language, and artificial intelligence prompt language. This information is collected when you make your choices in the settings. |
| Technical and security data | Needed to keep you signed in and to protect the platform against abuse. It may include: IP address, session cookie, known-device cookie, and drafts of answers not yet saved, kept in your own browser. This data is collected automatically during use. |
| Data about connections with artificial intelligence apps | Needed only if you decide to connect Shadow Study to an artificial intelligence app. It may include: the connected app, the permissions you authorized, the connection date, the date of last use, and your choice about whether to share your results. This data is collected when you approve the connection and when the app uses it. |
| Subscription and payment data | Needed to process your subscription. It may include: customer and subscription identifiers at Stripe, the subscription status, and a reference that links the payment to your account. Card details are entered by you directly on Stripe’s page and never reach us. If a card has already received a refund under the right of withdrawal, we keep that card’s fingerprint, a code provided by Stripe that does not correspond to the card number. |
| Communications with us | Needed to answer your inquiry. They may include: your email address and the content of the messages you send us. This data is collected when you write to our contact email. |
In some cases, we receive your data through third parties. The following table describes the main external sources:
Third-party sources from which Shadow Study receives your data
| Categories of third parties | Description |
|---|---|
| Connected artificial intelligence apps | When you connect ChatGPT or Claude and ask, in the conversation, for an exam to be saved, the app sends us that exam, and we record which app it came from. |
| Payment service | Stripe informs us of the payment and subscription status, the identifiers needed to link them to your account and, where applicable, the card fingerprint. |
The content of the exams you import is study material, such as questions, alternatives, and explanations. The platform is not intended for storing other people’s personal data. For this reason, we ask that you do not include in your exams information that identifies third parties and, in particular, real patient data. You are responsible for the content you import, and we may remove content that goes against this guidance.
Providing an email address is required to create an account. The display name, the link to the originating conversation, and the connection with artificial intelligence apps are optional, and you can use the platform without them.
3. What we use your data for
The LGPD only allows the processing of personal data when there is a legal basis that authorizes it. Each use we make of your data is tied to a specific purpose and to one of these bases.
The following table shows the purposes for which we process your data, the applicable legal basis, and the categories of data involved:
Purposes for which Shadow Study uses your data
| Purpose of processing | Legal basis (Art. 7 and 11) | Data category |
|---|---|---|
| Create and maintain your account, allow sign-in and access recovery | Performance of a contract (Art. 7, V) | Account and access |
| Provide the platform’s features: import and store exams, record attempts, and show results, history, and the learning dashboard | Performance of a contract (Art. 7, V) | Usage and performance, preferences |
| Remember your preferences and avoid losing answers not yet saved | Performance of a contract (Art. 7, V) | Preferences, technical and security |
| Send access, invitation, and account recovery emails, and notices about the service | Performance of a contract (Art. 7, V) | Account and access |
| Connect your account, at your request, to the artificial intelligence app you choose, to save exams and, if you allow it, read your results | Performance of a contract (Art. 7, V) | Connections with artificial intelligence apps, usage and performance |
| Process the subscription, billing, and refunds | Performance of a contract (Art. 7, V) | Subscription and payment, account and access |
| Protect the platform and your account against abuse, fraud, and unauthorized access, including limits on sign-in attempts | Legitimate interest (Art. 7, IX) | Technical and security, account and access |
| Prevent more than one refund with the same card and keep a minimal record of deleted accounts | Regular exercise of rights (Art. 7, VI) + Legitimate interest (Art. 7, IX) | Subscription and payment |
| Answer your messages and data subject requests | Performance of a contract (Art. 7, V) + Compliance with a legal obligation (Art. 7, II) | Communications with us, account and access |
| Improve the platform and produce aggregate statistics about the use of the service | Legitimate interest (Art. 7, IX) | Usage and performance, technical and security |
| Comply with legal obligations and respond to requests from authorities | Compliance with a legal obligation (Art. 7, II) | As applicable |
We use your data only to the extent needed for the purposes described. Anonymized data, which does not allow you to be identified, may be used in statistics and analyses about the use of the platform. If we need to process your personal data for a purpose different from those listed here, we will update this Notice and inform you before starting that processing.
4. With whom we share data
We share your personal data only when this is necessary for the platform to work, to process your subscription, to fulfill a request of yours, or to comply with legal obligations. This includes:
- infrastructure and technology providers that operate the platform;
- the payment service;
- the artificial intelligence apps you decide to connect; and
- public authorities, when required by law.
The following table details with whom we share your data, which categories are involved, and why:
Third parties with whom Shadow Study may share your data
| Recipient category | Data category | Reason for sharing |
|---|---|---|
| Supabase (authentication) | Email, password in irreversible form, sign-in records, and IP address | Manage sign-in, access recovery, and usage limits per account |
| Amazon Web Services (email delivery) | Email and the content of the messages sent by the platform | Send access codes, invitations, and account recovery emails |
| Hostinger (server and database) | Application data, including account, usage and performance, preferences, and connections | Host the platform and the database |
| Cloudflare (network and security) | Website access traffic and IP address | Deliver the website over a secure connection, protect against attacks, and measure performance in aggregate |
| Google Workspace (email) | Messages you send us | Receive and answer your inquiry |
| Stripe (payments) | Email, card details entered by you, and location used to set the currency | Process payments, subscriptions, and refunds |
| OpenAI (ChatGPT) and Anthropic (Claude), only if you connect | Exams and, if result sharing is on, the complete results, with questions, answers, correct and incorrect answers | Fulfill the requests you make in the conversation with your artificial intelligence app |
Connecting to artificial intelligence apps is always your choice and can be undone at any time in your Profile. When you connect an app, result sharing is turned on, and you can turn it off in your Profile for all connections at once. Turning it off prevents new reads, but does not erase results already sent to a conversation, because that content is then processed by the app’s provider, under its privacy policy and the relationship you have with it. Links to originating conversations are never sent in shared results. If you use Shadow Study without a connection, by copying and pasting the prompts, nothing is sent to the artificial intelligence app unless you do it yourself.
We require providers that process data on our behalf to adopt appropriate security measures and to use the data only for the agreed purposes, through the applicable contractual instruments.
We may share data with public authorities when required by law or by court order, always to the minimum extent necessary and in good faith.
Anonymized or aggregated data, which does not identify any person, may be used for statistical analysis of the use of the platform.
5. How long we retain the data collected
We keep your personal data for as long as needed to fulfill the purposes for which it was collected or to meet legal obligations and the regular exercise of rights. When the data is no longer needed, we delete or anonymize it.
The main criteria and periods we adopt are:
- account, usage and performance, preferences, and connection data: for as long as your account exists. When you delete your account in your Profile, we immediately erase the account, its access, and all study data, and the subscription is canceled;
- exams and attempts you delete: they can be restored for 10 minutes and, after that, are erased;
- backups: deleted data may remain in backups for about 3 days, until they are replaced;
- access sessions: ended when you sign out or after up to 45 days without use;
- accounts created and never confirmed: removed after a short period;
- drafts of answers kept in your browser: remain on your device until they are saved or until the account is deleted;
- minimal record of deleted accounts, with internal identifiers, reason codes, counts, and access periods, with no email, no exam content, and no free text: up to 5 years;
- fingerprints of cards that have already received a refund: up to 5 years, with no link to your identity;
- record of automatic refunds: 30 days;
- email addresses that bounced messages or generated complaints: kept on the email delivery service’s suppression list, so they do not receive new messages; and
- payment data kept by Stripe: according to Stripe’s privacy policy.
After the applicable retention period ends, the data is securely deleted or anonymized.
6. Cookies and similar technologies
Cookies are small text files stored on your device when you visit a website. They allow the website to recognize your browser and keep you signed in. Similar technologies, such as the browser’s local storage, work in a similar way.
At Shadow Study, we use only our own cookies, needed for the platform to work, and the browser’s local storage for features you use. We do not use advertising or social media cookies.
The following table describes the categories of cookies and technologies we may use:
Cookies Shadow Study may use
| Cookie category | Description |
|---|---|
| Necessary Cookies | Essential for the platform to work. The session cookie keeps you signed in, cannot be read by scripts, and expires after up to 45 days without use. The known-device cookie is used to limit password attempts and protect your account. Without them, the platform does not work and, for this reason, they cannot be turned off. |
| Performance Cookies | We do not use performance cookies. To measure the website’s performance, we use Cloudflare Web Analytics, which counts visits in aggregate, without cookies and without identifying you. |
| Functional Cookies | We do not use functional cookies. The browser’s local storage keeps the website language chosen on this device and a recovery copy of answers not yet saved, so that you do not lose them if the connection drops. |
| Social Media Cookies | We do not use them. |
| Advertising Cookies | We do not use them. |
Because we use only necessary cookies and local storage for features you trigger, we do not show a consent banner. You can delete cookies and local storage data in your browser settings, but this will end your session and remove drafts not yet saved.
We adopt the following principles when collecting data through cookies and similar technologies:
- minimal collection: only the data needed for the platform to work;
- transparency: every technology used is described in this Notice; and
- control: you can delete this data at any time in your browser settings.
7. International Data Transfers
The platform’s main data, such as your account, your exams, and your results, is stored on servers located in Brazil. Even so, some services we use may send, access, or process data outside Brazil, because they operate with servers in other countries.
This happens with Cloudflare’s network, which delivers the website from servers distributed around the world, and with Stripe, which processes payments. It also happens when you connect ChatGPT or Claude: in that case, the exams and, if you allow it, the results are sent to OpenAI or Anthropic, in the United States, at your request and to fulfill what you asked for in the conversation. These transfers are instrumental, that is, they happen because we use these services or because you asked, and not as a business decision to transfer data abroad.
To ensure your data is protected even outside Brazil, we adopt the following measures:
- entering into data processing agreements, the Data Processing Agreements (DPAs), with providers, with protection obligations at a level equivalent to that required by the LGPD;
- assessing providers’ risk before hiring them, checking that their security practices are adequate;
- observing the standard contractual clauses established by the Brazilian National Data Protection Authority (ANPD) in Resolution CD/ANPD No. 19/2024, where applicable; and
- adopting additional safeguards whenever the situation requires it.
If you have questions about international data transfers or the destination countries, contact us through the channel listed in Section 12.
8. How we protect your personal data
We are committed to protecting your personal data and adopt technical and organizational measures to prevent unauthorized access, loss, alteration, or improper disclosure of information.
Among the security practices we adopt:
- encrypted connection (HTTPS) for all access to the platform;
- passwords stored only in irreversible form, so that no one can read them;
- a session cookie protected against reading by scripts, and browser security rules that prevent third-party code from running on the platform;
- limits on sign-in attempts per device and protection against abuse;
- the option to end your session on all devices, and automatic ending of your other sessions when you change your password;
- encrypted backups, kept in a location separate from the main server; and
- access to data restricted to the people responsible for operating the platform.
No security system is absolutely infallible. In the event of an incident that may affect your data, we will take the necessary measures to reduce its impact and, when required by the LGPD, we will notify you and the Brazilian National Data Protection Authority (ANPD) within the legal deadlines.
9. Your rights and how to exercise them
The LGPD guarantees you, as a personal data subject, a set of rights that can be exercised at any time. The following table shows all of these rights and what each one means:
Your rights as a Data Subject
| Right | What it means |
|---|---|
| Confirmation and access (Art. 18, I and II) | You can request confirmation that we process your data and access information about that processing. |
| Correction (Art. 18, III) | You can request the correction of incomplete, inaccurate, or outdated data. |
| Anonymization, blocking, or deletion (Art. 18, IV) | You can request the anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in breach of the LGPD. |
| Portability (Art. 18, V) | You can request the transfer of your data to another provider of a service or product, subject to the ANPD’s regulations. |
| Deletion of data processed with consent (Art. 18, VI) | You can request the deletion of data processed on the basis of your consent, except in the cases provided for by law. |
| Information about sharing (Art. 18, VII) | You can request information about the public and private entities with which we share your data. |
| Information about the possibility of not consenting (Art. 18, VIII) | You have the right to be informed about the possibility of not giving your consent and about the consequences of that decision. |
| Withdrawal of consent (Art. 18, IX) | When processing is based on your consent, you can withdraw it at any time, without affecting processing already carried out on that basis. |
| Objection (Art. 18, § 2) | You can object to processing carried out on bases other than consent, when the LGPD is not complied with. |
Some of these rights can be exercised directly on the platform: you can correct your display name and delete your account in your Profile, and you can export the results of your attempts from History. For other requests, write to contato@shadow.study. We may ask to verify your identity before fulfilling the request, to keep your information secure. We respond within 15 days of receiving the request.
10. Processing of children’s and adolescents’ data
The Brazilian Statute of Children and Adolescents (ECA – Law No. 8,069/1990) defines a child as a person under 12 years of age, and an adolescent as a person between 12 and 18 years of age. The LGPD, in its Article 14, sets specific rules for processing the personal data of children and adolescents.
Shadow Study is intended for people over 18, such as undergraduate students and candidates for public-service examinations, and is not directed at children or adolescents. We do not knowingly collect data from people under 18.
If, in the future, the platform starts admitting children, the processing of their data will depend on the specific and prominent consent of at least one parent or legal guardian, under Article 14, § 1, of the LGPD. With regard to adolescents, any processing will observe their best interests, their progressive autonomy, and ANPD Statement CD/ANPD No. 1/2023.
Among the safeguards we adopt:
- we do not use users’ data for targeted advertising;
- if we identify an account belonging to a person under 18, we may suspend it and delete the corresponding data; and
- we give priority to requests from parents and guardians on this subject.
If you are a parent or legal guardian and believe that a person under 18 has created a Shadow Study account, contact us through the channel listed in Section 12.
11. Changes to this Notice
This Privacy Notice may be updated to reflect changes in our data processing practices, because of new features, legal adjustments, or other relevant circumstances.
When the changes are relevant, we will inform you reasonably in advance, through a notice on the platform or by the email registered to your account.
The most up-to-date version of this Notice will always be available at shadow.study/privacy, with the date of the last update shown at the beginning of the document. Continued use of the platform after changes are published means you acknowledge the new conditions described.
12. How to contact us
If you have questions about this Privacy Notice or about how we process your data, or want to exercise any of your rights as a data subject, we are here to help.
For matters related to privacy and personal data protection, contact us by email at contato@shadow.study.
We may ask to verify your identity before fulfilling any request, to keep your information secure. We respond to requests within 15 days of receiving them, as provided for in the LGPD.