Privacy policy
Last updated: October 22, 2026
In short:
- We keep only what we need to sell and give access: your email, your purchase status and the "ref" (where you came from).
- Card and bank details stay with the payment processor, not with us.
- We don't use tracking cookies. There is only the session cookie, to keep you signed in (plus a temporary one while signing in with Google), and our analytics work without cookies.
- You can ask to see, correct or delete your data at [email protected].
This policy follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018).
Who looks after your data
The controller is 69.752.097 EDSON RAFAEL DOS SANTOS BARBOSA (MEI), CNPJ 69.752.097/0001-95, which runs Bloco Zero (blocozero.academy). For anything about personal data, write to [email protected].
What data we use, and why
| Data | When | Why | Legal basis (LGPD, art. 7) |
|---|---|---|---|
| None | In the free lessons | We don't ask you to sign up | — |
| When you buy or sign in | Sending your sign-in link, your receipt and notices about your purchase | Performance of a contract (item V) | |
| Purchase status: what you bought, date, amount, payment method, whether it was paid or refunded, and the transaction ID | When you buy | Unlocking access, processing refunds and meeting tax obligations | Performance of a contract (V) and legal obligation (II) |
| Coupon used, if any | When you use a coupon | Applying the discount and knowing which partnership the purchase came from | Performance of contract (V) and legitimate interest (IX) |
| "ref": the source code of the link you came from, if any (for example, a video) | When you buy | Knowing which channels work | Legitimate interest (IX) |
| Name and email of your Google account | Only if you choose "Continue with Google" | Signing in without a password. We never receive your password or access to your Gmail | Performance of contract (V) |
| Wallet address and transaction hash | Only if you pay in USDC or sign in with your wallet | Confirming the payment on-chain, refunding to the same address and letting you sign in | Performance of a contract (V) |
| Access logs: IP address, date and time | When you use your account | Security and compliance with Brazil's Internet Civil Framework (art. 15) | Legal obligation (II) and legitimate interest (IX) |
| Whatever you write to our email | When you write to us | Replying and solving your request | Performance of a contract (V) and legitimate interest (IX) |
What we don't collect
- Card and bank details: you enter them in the payment processor's component (currently Mercado Pago). They stay with the processor, which follows its own security rules and privacy policy. We only receive the result: paid or not paid.
- Recovery phrase and private key: never.
- On-chain checks ("done ✓"): when a lesson checks something on the blockchain, we read public network data and don't store the address we looked up.
- Lesson progress: saved only in your browser (local storage), not on our server. To delete it, clear the site's data in your browser.
We don't sell data, don't use your data for ads and don't build a profile about you.
Cookies and analytics
- One cookie only: the session cookie. It is essential, is only created when you sign in and keeps you signed in. It isn't used to track you. If you don't sign in, you don't get it.
- Only while signing in with Google: a temporary technical cookie (10 minutes) protects the round trip to Google. It expires on its own.
- Cookieless analytics: we count visits and which screens people go through, as aggregate numbers, without cookies and without identifying you.
- We don't use social media pixels or advertising cookies.
Who we share data with
Only with those who need it for the site to work:
- Payment processor (currently Mercado Pago): processes PIX and card payments.
- Cloudflare: hosting, database and cookieless visit counts.
- Email delivery service (currently Resend): sends sign-in links and receipts.
- Google: only if you choose "Continue with Google". Google confirms who you are and sends us your name and email.
- Authorities: only when the law or a court order requires it.
USDC payments: every transaction on the Base network is recorded publicly and permanently. That is how blockchains work, and it is outside our control.
International transfers: some of these providers process data outside Brazil, for example in the United States. This happens with the safeguards the LGPD requires (art. 33).
How long we keep data
| Data | Period |
|---|---|
| Email and purchase status | While you have access to the track. After that, 5 years, for tax and consumer-protection obligations |
| Unpaid order (email and status) | Deleted after 90 days |
| "ref" | Up to 12 months. After that, only as aggregate numbers, not linked to you |
| Wallet address and payment hash | Same period as the purchase |
| Access logs (IP, date and time) | 6 months, as Brazil's Internet Civil Framework requires |
| Messages sent to our email | As long as needed to solve the request. If they involve a purchase or refund, the same period as the purchase |
After that, we delete the data or make it anonymous.
Your rights (LGPD, art. 18)
At any time, you can:
- find out whether we process your data and access it;
- correct wrong or outdated data;
- ask us to anonymize, block or delete unnecessary data;
- ask for your data to be ported;
- ask us to delete your data. We keep only what the law requires, such as the purchase record;
- find out who we share your data with;
- object to processing based on legitimate interest.
How to ask: write to [email protected], ideally from the email you used to buy. We reply within 15 days. If you're not satisfied, you can file a complaint with the ANPD (Brazil's National Data Protection Authority) at gov.br/anpd. If you live in a country with its own data-protection law (such as the GDPR), you also have the rights that law gives you.
Security
- We use a secure connection (HTTPS), restrict access to data and collect as little as possible.
- If a security incident could put you at risk, we'll notify you and the ANPD.
Minors
You must be 18 or older to buy. The free lessons don't ask for any data.
Changes to this policy
If this policy changes in a meaningful way, we'll post a notice on the site and email buyers.
Contact
[email protected] Bloco Zero · 69.752.097 EDSON RAFAEL DOS SANTOS BARBOSA (MEI) · CNPJ 69.752.097/0001-95 · [email protected]