Privacy Policy
Version of October 21, 2026
This is a translation. If it differs from the Portuguese version, the Portuguese version prevails.
This policy explains how Rabboni processes personal data on the course platform available at rabboni.ai and at the addresses of the institutions that use it (such as school.rabboni.ai). We follow Brazil’s General Data Protection Law (Law No. 13,709/2018, the LGPD).
1. Who we are
Rabboni (“Rabboni”, “we”) is an online course platform headquartered at Alameda Rio Negro, 503, Sala 2020, Alphaville Centro Industrial e Empresarial, Barueri/SP, CEP 06454-000. Privacy matters: [email protected].
2. Two roles: controller and processor
Rabboni is a platform that educational institutions use to offer courses under their own brand. So we act in two ways:
- As controller, we decide about the data of people who create an account to run an institution, people who contact us and visitors to our website.
- As processor, we process the data of learners, teachers and other members on behalf of the institution, which is the controller of that data. The institution decides who is invited, what the sign-up form asks and how long academic records are kept.
If you study or teach at an institution that uses Rabboni, that institution is primarily responsible for your data: contact it to exercise your rights (we help too, see section 9). The institution may publish its own privacy policy, which appears in its space.
3. What data we process
- Account: name, e-mail, password (stored only as a scrypt hash, never as text), photo and bio if you add them, and preferred language. If you sign in with Google, we receive your name, e-mail and photo from Google.
- Institution sign-up: the fields the institution asks learners when they join. They may include tax ID (CPF), phone, date of birth, education level and others, as the institution chooses.
- Academic life: enrollments and cohorts, lesson progress, quiz and exam answers, grades, answers to open questions, files submitted in assignments, teacher comments and retake requests.
- Institution content: documents, handouts, files and courses the institution uploads or creates.
- Technical data: IP address, date and time, address visited and browser, recorded when you use the platform, and the cookies in section 10.
We do not ask for sensitive data such as religion, health or biometrics. If an institution creates such a field in its sign-up form, it is responsible for the legal basis and the extra care the LGPD requires.
4. Why we use it and on what legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Create and keep your account, authenticate access and provide the service the institution contracted | Performance of a contract (item V) |
| Send platform e-mails: invitations, e-mail confirmation, password reset and notices about data requests | Performance of a contract (item V) |
| Keep the platform secure, prevent abuse and investigate incidents | Legitimate interest (item IX) |
| Keep access logs, as required by Brazil’s Internet Civil Framework (Law No. 12,965/2014, art. 15) | Legal obligation (item II) |
| Handle requests from data subjects and authorities | Legal obligation (item II) and regular exercise of rights (item VI) |
We do not sell personal data, do not use it for advertising and do not send marketing e-mails without your consent.
5. Artificial intelligence
When the institution asks to generate a course, module, lesson, exam or assignment brief from a document, the text of that document is sent to Gemini, Google’s AI service, which returns a proposed structure and content. We do not send learner data to the AI: sign-up data, answers, grades and submissions stay out. We use the paid Gemini API, under terms that do not allow Google to use the content sent to train its models. What the AI produces starts as a draft and is only published after a person at the institution reviews it.
6. Who we share it with
We use providers that process data on our behalf, only to run the platform:
| Provider | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH | Servers and database | Germany |
| Cloudflare, Inc. | Content delivery, attack protection and DNS | United States |
| Amazon Web Services, Inc. | File storage and backups | United States |
| Resend, Inc. | Sending platform e-mails | United States |
| Google LLC | Sign in with Google (optional) and AI (Gemini) | United States |
We also share data when the law or a court order requires it, or to defend rights in legal proceedings. Within an institution, administrators and teachers see the learner data they need to teach and follow up.
7. International transfer
Some of these providers store or process data outside Brazil, in Germany and the United States. These transfers rely on the cases in article 33 of the LGPD, including the contractual safeguards the providers offer to protect the data.
8. How long we keep it
- Account: while it exists. When the last link with institutions is deleted on request, the account is deleted too.
- Data within an institution: during its contract. After the end, it remains available for export for 90 days and is then deleted.
- Deletion request approved by the institution: name, e-mail, sign-up data, open answers and submitted files are deleted. Grades and progress may remain in the institution’s records without identifying you.
- Backups: up to 30 days. Deleted data may remain in a backup until it expires.
- Access logs: up to 6 months, under the Internet Civil Framework.
We may keep longer what the law requires or what is needed to defend rights.
9. Your rights
Under the LGPD (art. 18), you may request: confirmation that we process your data; access to it; correction of incomplete or wrong data; anonymization, blocking or deletion of unnecessary data or data processed against the law; portability; information about whom we share it with; information about the option not to consent and withdrawal of consent, when consent is the basis; and objection to irregular processing.
- In your account, under “Your data”: Download my data creates a file with what the institution holds about you, and Request deletion sends the request to the institution, which approves or declines it with a reason. You can correct your name and photo right there.
- By e-mail, at [email protected]. If the request concerns data we process as processor, we forward it to the institution and help handle it.
We reply within 15 days. You may also file a complaint with Brazil’s National Data Protection Authority (ANPD).
10. Cookies
We only use cookies the platform needs to work: the session cookie, which keeps you signed in until you sign out or the session expires (up to 30 days), and the language cookie, which remembers the language chosen on the website. We use no advertising or third-party analytics cookies.
11. Security
We use encrypted connections (HTTPS) on every address, scrypt password hashing, private files reachable only through temporary links, storage encrypted at rest, separation of each institution’s data and daily backups. If a security incident may cause relevant risk or harm, we will notify the affected institutions and, when the law requires, the ANPD and the data subjects.
12. Children and teenagers
Rabboni is contracted by institutions. If an institution enrolls minors, it is responsible for obtaining the consent of a parent or legal guardian when required (LGPD, art. 14) and for processing that data in the best interest of the child or teenager.
13. Data protection officer and contact
The person in charge of personal data processing (encarregado) is Lucas Franco Spirandeli, at [email protected]. This is the channel for data subjects, institutions and the ANPD.
14. Changes to this policy
When we change something relevant, we will announce it on the platform or by e-mail before the change takes effect. The version date is at the top of this page. See also the Terms of Use.