Terms of Use and Privacy
How the Student Portal works and how your personal data is processed under Brazil’s General Data Protection Law (LGPD).
English with Hilani · Version 1.1 · Updated on September 28, 2026
Translation for convenience: the Brazilian Portuguese version prevails. · Versão em português
In a nutshell
- The Portal is your student area: schedule, credits, materials, recordings, summaries, receipts and consents.
- Your login is personal. Do not share your account.
- We process your data under the LGPD, only to teach, bill, comply with the law and, with your consent, for the optional uses.
- Recording, AI summaries, personalization and biometrics are optional and can be turned off at any time under "Privacy".
- We do not sell data. We only use essential cookies.
- Questions and requests: hello@englishwithhilani.com.
Part A — Terms of Use
A1. Who provides the Portal. Hilani Mercadante, CNPJ stated in the contract, São Paulo, SP, Brazil (full address stated in the contract), trading as English with Hilani. Contact: hello@englishwithhilani.com.
A2. Relationship with the agreement. These Terms supplement the Educational Services Agreement. If they conflict, the Agreement prevails.
A3. Account and access. Access is personal and non-transferable. You are responsible for keeping your password and devices secure and must tell us immediately if you suspect misuse. Users under 18 use the Portal with the authorization and supervision of their legal guardian.
A4. Permitted use. Use the Portal only for your own study. You may not: try to access other people's accounts or data; copy, resell or publish materials, recordings or summaries; bypass security measures; or upload unlawful, offensive or malicious content.
A5. Content and materials. The Provider's materials are licensed to you for personal use (Agreement, clause 18). Content you upload remains yours. You authorize us to store and use it only to provide the service.
A6. Recordings and summaries. They exist only if you authorize them. They are available to you in the Portal for the periods in the Agreement (clause 16) and you may not publish or share them, because they contain the teacher's image and voice.
A7. Availability. We work to keep the Portal available and secure, but interruptions may occur for maintenance or due to third-party failures. If a Portal failure prevents a lesson, it is made up.
A8. Suspension. We may suspend access in case of serious misuse or a security risk, with notice and a chance to explain, always preserving your access to receipts and to your data.
A9. Changes. Material changes to these Terms are notified at least 30 days in advance. Changes that reduce your rights only apply with your express agreement. If you do not agree, the current terms continue and you may end the agreement at no cost (Agreement, clause 28.2).
A10. Law and venue. Brazilian law. Venue as set out in the Agreement (clause 23): consumers in Brazil may bring proceedings in their own domicile; for those living abroad, São Paulo/SP, without prejudice to mandatory protections of the country of residence. The Portuguese version prevails over translations.
Part B — Privacy Notice
B1. Controller and contact. Hilani Mercadante, CNPJ stated in the contract. Data protection officer and privacy channel: Hilani Mercadante · hello@englishwithhilani.com.
B2. What we process and why.
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Diagnostic and proposal | name, contact details, goals, level | pre-contractual steps (art. 7, V) |
| Lessons, Portal and support | profile, schedule, attendance, materials, progress, messages | performance of contract (art. 7, V) |
| Payments and invoices | identification, ID document, address, transaction data | contract and legal obligation (art. 7, II and V) |
| E-signature and security | OTP, IP, device, date and time | contract, exercise of rights and legitimate interest (art. 7, V, VI and IX; legitimate interest assessment available on request) |
| Access logs | IP, date and time | legitimate interest (art. 7, IX) and, when the Provider is a legal entity, legal obligation (Brazilian Internet Act, art. 15) |
| Biometric selfie (optional) | facial image, ID photo | specific consent (art. 11, I) |
| Recording and transcription (optional) | image, voice, lesson content | consent (art. 7, I) |
| AI-assisted summaries and feedback (optional) | transcripts and notes | consent (art. 7, I) |
| Professional personalization (optional) | LinkedIn link you provide, company, role, industry, public news | consent (art. 7, I) |
| Updates and news (optional) | name, e-mail, WhatsApp | consent (art. 7, I) |
B3. Artificial intelligence. With your consent, we use an AI provider to draft summaries, feedback and briefings. The teacher reviews everything before sending it. We make no automated decisions with legal effects or that significantly affect your interests. You may ask for an explanation and a review (LGPD, art. 20). We only use vendors and service tiers whose contract terms exclude the use of your data to train AI models.
B4. Who we share data with. Asaas (payments and NFS-e), Stripe (international cards), Microsoft (Teams, Microsoft 365, OneDrive), Supabase (Portal), WhatsApp/Meta (communication), AI provider (AI, with consent), e-signature provider (signature and biometrics), scheduling provider (scheduling), our accountant (tax obligations) and authorities when required by law. We do not sell data.
B5. International data transfers (LGPD, art. 33; Resolution CD/ANPD No. 19/2024). Some vendors process data outside Brazil:
| Vendor | Country or region | Purpose | Transfer mechanism |
|---|---|---|---|
| Microsoft | available on request | lessons, recording, e-mail and storage | adequacy, if EU/EEA; otherwise, ANPD standard clauses |
| Supabase | available on request | Student Portal | adequacy, if EU/EEA; otherwise, ANPD standard clauses |
| Stripe | USA / Brazil | international cards | ANPD standard clauses or performance of the agreement (art. 33, IX) |
| WhatsApp (Meta) | USA / global | communication and reminders | ANPD standard clauses or performance of the agreement (art. 33, IX) |
| AI provider | available on request | AI-assisted summaries and briefings (optional) | adequacy, if EU/EEA; otherwise, ANPD standard clauses or your specific consent (art. 33, VIII) |
| e-signature provider | available on request | signature and biometrics | if outside Brazil: adequacy or ANPD standard clauses |
| scheduling provider | available on request | scheduling | adequacy, if EU/EEA; otherwise, ANPD standard clauses |
- Adequacy: the ANPD has recognized the European Union as providing adequate data protection, covering all EU Member States, Iceland, Liechtenstein and Norway (European Economic Area) and EU bodies (LGPD, art. 33, I; ANPD Resolution CD/ANPD No. 32/2026, in force since 27 January 2026). This is what "EU/EEA" means in the table above. This recognition does not extend to other countries, such as the United States, the United Kingdom or Switzerland.
- Standard clauses: adopted without changes, under Resolution CD/ANPD No. 19/2024. You may request the full text at hello@englishwithhilani.com, and we will send it within 15 days.
- Duration: for as long as the processing lasts, for the periods in section B6.
- Responsibilities and security: the controller is Hilani Mercadante (contact in section B1). Vendors act as processors, under contract and with security obligations. Some (for example, Stripe and Meta) also process data as independent controllers, for fraud prevention and their own legal obligations, under their own privacy notices.
- Your rights: the rights in section B7 also apply to transferred data. You may petition the ANPD (gov.br/anpd).
B6. How long we keep data.
| Data | Period |
|---|---|
| Diagnostic without sign-up | 6 months |
| Recordings | 180 days after the lesson |
| Transcripts, summaries and progress | during the agreement + 180 days |
| Personalization briefings | until withdrawal or end of agreement + 30 days |
| Biometric template | deleted after verification (within 30 days) |
| Selfie, ID photo and signature audit trail | 10 years after the agreement ends |
| Tax and payment data | 5 years after the tax year, or a longer legal period |
| Portal access logs | 6 months |
| Agreement and service history needed as evidence | 10 years after termination |
B7. Your rights. Confirmation and access, correction, anonymization, blocking or deletion, portability, information about sharing, withdrawal of consent, objection and review of automated decisions (LGPD, arts. 18 and 20). Ask at hello@englishwithhilani.com. We reply within 15 days. You may also petition the ANPD.
B8. Withdrawing a consent does not affect what was done before and does not change the price or quality of lessons. Just go to "Privacy" in the Portal or write to hello@englishwithhilani.com.
B9. Security and incidents. Strong authentication, encryption in transit, role-based access and access logging. If an incident may cause relevant risk or harm, we will notify you and the ANPD within 3 business days of becoming aware of it, subject to the doubled deadline for small agents (LGPD, art. 48; Resolution CD/ANPD No. 15/2024; Resolution CD/ANPD No. 2/2022).
B10. Cookies. We only use essential cookies (login and security). If we ever use analytics or marketing cookies, we will ask for your consent first.
B11. Children and teenagers. Minors' data is processed in their best interest (LGPD, art. 14; Statute of Children and Adolescents (ECA), arts. 2 and 17; ANPD Statement CD/ANPD No. 1/2023), with the legal guardian's specific and prominent consent where required. We do not carry out professional personalization or biometrics for minors.
Last updated: September 28, 2026