BackPrivacy Policy — Arena Sensei
Last updated: October 13, 2026 Version: 5.0
This Policy explains how Juno Woz (Juno Woz), CNPJ 58.515.433/0001-60, at R. Belo Horizonte, 889, Sala Z, Aleixo, Manaus/AM, CEP 69.060-601, collects, uses, shares, and protects personal data under Brazil's LGPD and Internet Civil Framework.
1. Scope
This Policy applies to academies and administrators, students with or without academy membership, and visitors to https://arenasensei.com.
2. Processing roles
2.1. The operator is the controller for accounts, community, training logs, academy SaaS billing, security, and Platform operation and improvement.
2.2. Academies are controllers, and the operator is a processor, for student management data such as enrollment, plans, contracts, and manual records of agreed amounts, due dates, and payment status.
2.3. Requests about academy-managed data may be referred to the responsible academy or handled in cooperation with it.
3. Data collected
We collect name, username, email, hashed password, photo, birth and entry dates, belt and stripes, biography, academy data, content, orders, enrollments, manual records of agreed amounts and due dates, support information, IP addresses, user agents, visited pages, aggregate metrics without tracking cookies, push subscriptions, and acceptance records. Subscription payment details are entered directly in Stripe Checkout or the Stripe billing portal. The Platform receives subscription identifiers and status, not full card numbers or CVV.
The Platform does not request sensitive data. Photos and belt information support identification and the community experience.
4. Purposes and legal bases
| Purpose | LGPD legal basis |
|---|---|
| Accounts and features | Contract performance, art. 7(V) |
| Arena Sensei Pro subscription billing and renewal | Contract performance, art. 7(V) |
| Enrollment, contracts, store requests, and academy's manual tracking | Academy-student contract performance, art. 7(V), under academy instructions |
| Contract and Terms acceptance | Exercise of rights, art. 7(VI) |
| Pro subscription, account, and security messages | Contract performance, art. 7(V) |
| Fraud prevention and security | Legitimate interest, art. 7(IX), and legal obligation |
| Access logs | Legal obligation, Internet Civil Framework art. 15 |
| Aggregate usage analysis and improvement | Legitimate interest, art. 7(IX) |
| Marketing, where used | Consent, art. 7(I) |
| Data subject requests and LGPD obligations | Legal obligation, art. 7(II) |
5. Sharing
We do not sell data. Necessary sharing may include Stripe for Pro subscription billing, transactional email, hosting and infrastructure providers, users according to permissions, authorities where legally required, and successors in corporate reorganizations.
6. International transfers
Some providers process data outside Brazil. Appropriate LGPD safeguards apply, including providers with adequate protections and contractual data protection clauses.
7. Cookies
Essential cookies and local storage support authentication, language preferences, and operation. Audience metrics are aggregated without advertising tracking cookies.
8. Retention and deletion
Data is retained as required for its purpose or legal obligations. Account data remains while active; financial and contractual records follow legal periods; acceptance evidence follows limitation periods; access logs are retained for at least six months under the Internet Civil Framework.
Deleting a post or changing a profile photo removes the relevant operational files. We back up our servers every day to encrypted storage in the European Union with Backblaze: we keep daily copies for 7 days, weekly copies for 4 weeks, monthly copies for 12 months and yearly copies for 2 years. Deleted data can stay in these backups for up to 2 years, until the copy that holds it expires, and backups are used only to recover lost data. Legal obligations may require longer periods.
9. Data subject rights
Under LGPD art. 18, you may request processing confirmation, access, correction, anonymization, restriction, deletion, portability, sharing information, consent information, and withdrawal of consent.
10. Children and adolescents
Individual accounts are intended for adults aged 18 or older. Processing of minors' data follows LGPD art. 14 and their best interests. An academy managing a minor student must obtain specific, prominent guardian consent.
11. Security
We use TLS, hashed passwords, no storage of sensitive card data by the Platform, tenant isolation, record authorization, rate limits, and webhook validation for Pro subscriptions. Relevant incidents will be communicated to ANPD and affected people as required by LGPD.
12. Privacy requests
Contact inbox@arenasensei.com with the subject "Privacy — LGPD". Additional information may be needed to verify identity.
13. Changes
Material changes will be communicated by email or Platform notice.
14. Governing law
Brazilian law applies and disputes are subject to Comarca de Manaus/AM, except where consumer law requires the consumer's local court.
Controller: Juno Woz, CNPJ 58.515.433/0001-60 Privacy contact: inbox@arenasensei.com