Student privacy
Last updated: November 1, 2026 · Version 2026-11-01.1
This policy describes how Engliv processes visitor, student and learner data, its purposes and how to exercise rights under Brazil’s LGPD. Teachers, assistants and administrators have a separate Team Privacy Notice for professional access.
Who controls your data
ENGLIV LTDA - ME, trading as ENGLIV, registered under Brazilian CNPJ number 41.009.284/0001-64, at Avenida Prefeito Antonio Francischini, 1421, Centro, São Sebastião da Amoreira - PR, postal code 86240-000, Brazil, is the controller of your personal data. For any question or request about your data, contact us at contato@engliv.com.br.
What data we collect
We process your name, email and authentication credentials; optional profile photo; video progress, homework and quiz answers and results; uploaded files and support messages. Depending on your role and plan, we also process availability, schedules, attendance, lesson records, payment and access status. When someone asks for a refund we record the reason they picked and their comment, if any: the office sees that answer alongside the purchase, and the commercial partner sees the answer and the comment, without the buyer’s name or email. For students we also record the fee history: one record per month paid, with the amount, the date it was marked and who at the school marked it. When the school classifies a payment situation as default, the office or the assistant writes down the reason for that decision, up to 300 characters — that note is internal, is not shown to the person in the platform and is deleted when the marking is removed; you may ask to see it and to correct it at contato@engliv.com.br. Teachers and the office also write attendance, a grade and an account of how the lesson went in the lesson log. We record language preferences, recent activity and document acknowledgements. Passwords are managed by the authentication service and are not displayed to staff.
Why we collect this data
We use data to authenticate accounts, deliver education, grant content access, track learning, schedule lessons, handle requests and protect the service. The photo is optional, identifies you on your profile and may be changed or removed in settings. This notice does not authorize advertising use of your photo, image, voice or assignments. We do not sell personal data. We use no third-party audience measurement.
Live lesson recordings
Engliv records live lessons through Google Meet for internal review of what the team teaches and verification of what happened during lessons. Recordings may capture participants’ images, voices, screens and shared content; Meet features may also retain messages or captions depending on the settings used. This purpose does not include public disclosure or advertising.
Recordings are stored in the Google Drive associated with the organization that holds the meeting. Access must be limited to authorized Engliv professionals who need them for the stated purpose, with restricted sharing and protection against unauthorized disclosure. The school’s standard retention period is up to 180 days from the lesson date. Recordings must then be erased; longer retention requires a specific documented need, legal ground and period, such as an incident under investigation, a legal obligation or the exercise of rights, with restricted access and necessity reviews.
Participants must receive prior information about recording and these conditions. General acceptance of the terms does not replace any specific consent required by law, assessment of the legal basis or guardian participation where applicable. Enrollment of minors and recording their lessons require consideration of their best interests and all participants’ rights. School contracts and instructions must reflect these rules. Advertising use of image or voice requires separate, specific permission.
For questions, access, objection, erasure or consent withdrawal where applicable, contact contato@engliv.com.br. The school must assess the processing basis, legal conditions and third-party rights, explain its response and consider appropriate alternatives for the educational activity. Deleting a platform account does not automatically delete Google Drive files; erasure requests must also cover relevant external recordings. Retention is not unlimited merely because an account has ended or a recording is stored outside the platform.
The AI tutor (Castiel)
Inside the recorded lesson there is an AI tutor called Castiel, in the "Castiel, AI assistant" tab and in the button over the video. When you write a question to it, your message is sent to Anthropic, a company in the United States, which generates the answer. Only these go with your question: your first name, the English words you have already marked as known in the flashcards, the name and content of the unit you are watching, the point of the video you were at, and the latest turns of that same conversation, yours and its own, so that it understands what you have already asked. Those turns leave your browser with every question and are not stored anywhere. We do not send your surname, email, phone, photo, payment or any other account data. Engliv does not keep the conversation: what you wrote and what it answered disappear when you close the tab, and neither the administration nor your teacher can read them afterwards. All that is recorded is a counter of how many questions you asked that day, which exists for the daily limit and for cost control, and that counter holds no text at all. The platform identifies Castiel as an artificial-intelligence assistant in the very tab where it appears, so that nobody talks to it thinking it is a person. Using the tutor is optional: if you would rather not use it, simply do not write to it, and nothing about your course access changes.
Teacher Liv, the artificial-intelligence teacher
Students and learners of English Foundations can practise with Teacher Liv, an artificial-intelligence teacher, in conversation lessons by video call inside the platform, up to 10 minutes a week. Her card on the dashboard and the call screen identify her as an artificial-intelligence teacher and, if you ask, she confirms that she is not a person. The call uses only the microphone: your camera is not turned on. During the call, your voice goes from your browser to OpenAI, a company in the United States, which understands what you say, turns your speech into text and generates Liv's speech. Only these go with it: your first name, the English words from the course flashcards up to the unit you are practising, and the lesson script. Liv's voice, once generated, passes through Simli, a company in the United States, which animates her face in the video; Simli does not receive your voice. For the Portuguese subtitle, the text of what Liv has just said and of what you have just said goes to Anthropic, the same company behind the Castiel tutor. When the lesson ends, the text of the conversation goes to Anthropic once, to write a note on what you still need to improve and where to review. Engliv does not record the call, neither video nor audio, and does not keep the conversation: what you said and what Liv answered disappear when the call ends. All that is kept is the date, the unit practised and the length of each call, for the weekly limit and for cost control, and the note from each lesson, which appears on your dashboard; these records are deleted with your account. We do not send your surname, email, phone, photo, payment or any other account data. Child accounts under 13 do not use Liv. Using the call is optional: if you would rather not use it, simply do not start the call, and nothing about your course access changes.
Pronunciation practice
Engliv is preparing a pronunciation practice section, separate from the flashcards. When it becomes available to your account and you choose to use it, the audio of your speech is sent from your browser directly to Microsoft (Azure AI Speech), processed in the Brazil South region, which returns pronunciation scores sound by sound. That audio does not pass through Engliv's servers, is not recorded by us and is not kept by Microsoft: it is analysed while you speak and discarded, and the setting that would make the provider log the audio stays off. Engliv keeps only your pronunciation scores, to build your next practice and show your progress, and those scores are visible to you and to the teaching team. When the section exists, it will not be released to child accounts under 13. Nothing changes in the flashcards or in Test yourself: there, your speech is still heard by your own browser, on your own device, as described above.
Legal basis (LGPD)
Registration, enrollment and service delivery may rely on contract performance or procedures requested by the individual. Legal obligations and exercise of rights justify only processing necessary for those purposes. Security measures relying on legitimate interests require a documented assessment of necessity and balance with individual rights. Consent-based purposes require specific, withdrawable choices. The AI tutor and Teacher Liv are part of the educational service and their use is optional, with the international transfer described in their own sections. Processing minors’ data requires a case-specific legal basis prioritizing best interests, and for children the LGPD requires specific, highlighted consent from at least one parent or legal guardian; document acceptance is neither blanket authorization nor independent proof of parental permission.
How long we keep your data
We keep data necessary to provide the service while that purpose remains valid, subject to minimization and necessity reviews. Data without a valid purpose must be erased or anonymized; legal obligations or the exercise of rights may justify specific retention with restricted access for the applicable period. You can delete your own account at any time directly in the platform, under "Delete my account" (in Settings → Privacy and account → Close my account) — there's no need to ask Engliv to do it for you. Accounts are not automatically deleted for inactivity or non-renewal. Expiration of purchased access does not delete your account. When students and learners confirm deletion, they lose account access and their linked data is removed from the platform, including their profile photo, progress, answers, homework submissions and lesson records with their attachments. Shared course content is not deleted. Records subject to mandatory legal retention follow the applicable periods. Account deletion does not mean immediate removal from backups or provider logs; contact Engliv for the applicable retention periods. You can also reach us at contato@engliv.com.br or through "Support & help" inside the platform with any questions about this.
When account protection is enabled, we record recognized devices, browser, usage times and security events. IP is used only as a protected signal, not as an identity or an automatic block. Codes expire in 10 minutes; events and revoked devices are removed after 30 days by scheduled cleanup. Authorized devices remain until revoked or the account is deleted. The recognition cookie lasts up to one year. Manage devices in Devices and access.
Your rights (art. 18 of the LGPD)
Request confirmation, access, correction and sharing information free of charge; and, where applicable, anonymization, restriction, erasure, portability, objection and consent withdrawal. You may also request review and explanation of solely automated decisions affecting your interests, such as expiry-based access blocking. Contact contato@engliv.com.br. Proportionate identity checks may be necessary; we will not request your password. LGPD provides immediate simplified confirmation/access or a full statement within 15 days; other requests follow their applicable deadlines. Any refusal must be explained. Brazil’s ANPD, Procon and the other consumer protection bodies, and the courts, remain available.
Security
The platform uses authentication and role-based access controls, bot checks on forms and attempt limits. Profile photos and personal files have restricted access; school-published materials and images may be public. There is no guarantee of zero risk. Report incidents to contato@engliv.com.br; Engliv must assess containment and notify ANPD and affected people where required by law.
Who accesses data
Authorized administrators, assistants and teachers access information according to their role and lesson relationships, for support, scheduling and educational follow-up. Names, photos and participation data may be visible to authorized contacts. Group lessons and calendar invitations may expose information such as name, image, voice or email to fellow participants depending on the feature; avoid sharing unnecessary data. The platform does not provide student-to-student chat. Courses with at least 3 people have a weekly ranking, which resets every Saturday: students and learners of the same course see the first name and points of those in the top three places, and each person sees their own position. Classmates do not see the position of anyone outside the podium or any grade. Points come from the course tasks and the right answers in them: homework (from the first attempt), recorded lessons watched to the end, video questions answered right on the first try, flashcards marked as “I know it”, pronunciation practice, with its score, and every 7-day study streak. Live lessons and lessons with Teacher Liv do not count. During the week the podium can change at any moment, and whoever moves up, moves down or gets close to the podium gets a notice in the platform bell (and on the phone, if notifications are on). The ranking medals a person earns and the best position they have reached stay saved in their account, even if they leave the podium; classmates do not see them, and they are deleted with the account. Children's and teenagers' accounts also take part, with first name only. Staff have no blanket authorization to copy or disclose data.
Services and browser storage
Supabase provides authentication, databases and storage; Render hosts the platform; Kiwify and Mercado Pago, depending on the purchase, process recorded-course payments and receive what the purchase requires, including the buyer’s name, email and mobile number — card and ID details are given by you to the payment company and never pass through Engliv; Resend supports transactional email. Cloudflare Turnstile protects forms. Google may provide sign-in and Calendar/Meet; JMVstream and, depending on the lesson, YouTube/Vimeo deliver video. WhatsApp opens an external service. Anthropic, in the United States, receives the messages sent to the AI tutor and the text of the lesson with Teacher Liv, as described in their own sections of this policy. OpenAI, in the United States, receives the student's voice during the call with Teacher Liv, and Simli, in the United States, receives only Liv's voice to animate her face, as described in its own section of this policy. Microsoft, with processing in Brazil, receives the audio of the pronunciation practice, as described in its own section of this policy. These services may receive technical and feature-related information. The browser stores session, language, preferences and local progress. Providers and authorized teachers abroad may receive or access data outside Brazil; this requires a legal basis, minimization and a valid international-transfer mechanism, not blanket permission through acceptance. Engliv must provide recipients, countries and safeguards applicable to the operation upon request.
Google Analytics was removed on 8 October 2026, and its cookies are no longer set. Since 21 October 2026, the public pages of the site (homepage, plans, checkout, placement test and, since 31 October 2026, the free class sign-up) load the Meta pixel (Facebook and Instagram) as soon as they open, to measure and target Engliv's ads: Meta receives the pages visited, technical browser data and the notice that a sign-up happened, and sets its own cookies in your browser. When you submit your details to see the plans, the test result or to sign up for the free class, Meta also receives your email, phone and first name, encoded by the pixel itself (hashed), to recognize whether you saw an ad. For the free class sign-up, Engliv's server also sends this notice to Meta, with the same encoded details, the IP address and the browser type, so the count does not depend on the browser. The student area does not load the pixel. The visit journey that Engliv records itself still stores nothing in your browser. Details are in our Cookie Policy.
Children, teenagers and guardians
Engliv serves minors and must consider their best interests when processing data. Brazilian law separates two groups: a child is someone under 12, and an adolescent is someone from 12 to 18. For children, the LGPD requires specific, highlighted consent from at least one parent or legal guardian; in those cases Engliv deals with the guardian, and the child's own acceptance does not replace that authorization. Parents and guardians may contact Engliv regarding enrollment and rights concerning a minor's data, subject to verification of their relationship where necessary. A student's acknowledgement alone must not be considered proof of guardian authorization. Do not send identity documents through this form; staff will explain if additional verification is needed. On minors' accounts created by the school, Engliv records a guardian's name and WhatsApp number, and on child accounts under 13 also their email. In the self-service registration after a purchase we record the declared age band and no guardian: children under 13 cannot create an account that way, and the school completes the guardian details afterwards. It is with that guardian that the school handles an overdue payment, and it is to their email that Engliv writes when these documents change in something that applies to the child's account; they have no account and no access to the platform, and what we keep about them is that contact information. On child accounts under 13, the artificial-intelligence features are switched off: the Castiel tutor and Teacher Liv do not appear and, when pronunciation practice exists, neither will it. Engliv states that it processes children's and adolescents' data in compliance with Brazil's General Data Protection Law and with the Statute of the Child and Adolescent, prioritising the best interests of the minor.
When enabled, learner self-registration records the declared age range (13–17 or 18 and older). Teenagers acknowledge guardian authorization when accepting the terms. This flow does not request separate email confirmation and the declaration is not treated as verified authorization. The age range does not appear on the public profile other students see.