Privacy Policy

Status: Version 1
Version: V1 — initial operation in Brazil
Language: Official English version — the Portuguese original prevails
Last updated: 2026-10-03
Publication date: [INSERT DATE]

Language and prevailing version

This Privacy Policy was originally drafted in Portuguese for the Brazilian market. This English version is provided so that English-speaking users, creators and partners can read the same policy, and it reproduces the Portuguese text in full, with the same section numbering.

The Portuguese version remains the governing version. This Policy is governed by and interpreted under Brazilian law, in particular the Brazilian General Data Protection Law (LGPD), and in the event of any divergence, conflict or doubt as to interpretation between the two versions, the Portuguese text prevails.

This Privacy Policy explains how Triboo collects, uses, stores, shares and protects the personal data of visitors, users, members, creators, administrators and moderators of the platform.

This Policy is made permanently and accessibly available before and during use of the platform. Acceptance of the Terms of Use is contractual; any operations that depend on consent will be presented specifically and separately.

Scope of V1

The initial version of Triboo is aimed at the Brazilian market. When services are offered in other countries, local terms, supplementary notices and additional data protection mechanisms may be published.

1. Identification of the controller

For the purposes of the Brazilian General Data Protection Law (LGPD), the controller of the personal data processed to operate the platform is:

• 66.537.277 Thiago Tanjin Chiu
• Company tax ID (CNPJ): 66.537.277/0001-66
• Address: Rua Rio de Janeiro, 707, casa — Maracanã, Foz do Iguaçu/PR, CEP 85852-050
• Privacy/LGPD e-mail: info@triboo.net.br
• Data protection officer or privacy channel: info@triboo.net.br

Where Triboo qualifies as a small-scale processing agent and relies on the regulatory exemption from formally appointing a data protection officer, it will still maintain at least one accessible channel for data subjects to exercise their rights.

2. The roles of Triboo, creators and suppliers

Triboo decides on the processing needed for the account, authentication, security, platform operation, payments, support, operational communication, product metrics and compliance with legal obligations.

Creators may act as independent controllers where they define their own purposes, such as external campaigns, lead capture outside Triboo or authorized reuse of contacts. Administrators appointed by the creator act on the creator's behalf. Within the platform, creators and administrators must use member data only for community management, service delivery, support and authorized communications. The corresponding obligations are set out in the Creator Terms.

Where the creator acts as a controller, the member may exercise their rights directly with the creator. Triboo will forward to the creator any requests it receives about that data and will let the member know it has done so.

Suppliers of hosting, storage, authentication, e-mail, automatic translation and payments act as processors or as independent controllers, depending on the service and the applicable contracts. The full list is in section 9.

3. Personal data we may collect

3.1 Registration and authentication data

• name, e-mail and profile photo received from Google when the user signs in with their Google account; photo or avatar changed by the user; phone number, where requested; country, state or city, where provided; date of birth or confirmation of legal age, where necessary.

Access to Triboo is exclusively through Google sign-in. Triboo does not create or store passwords.

3.2 Profile and community data

• bio; links; social networks; communities created; communities joined; function or role in the community; professional information or information voluntarily added to the profile.

3.3 Content and usage data

• posts; comments; replies; likes; files; event attendance; lesson progress; check-ins; points, levels, rankings or quests where those features are enabled; date and time of activities; communities accessed; activation, engagement and retention indicators.

3.4 Payment and subscription data

• plan and community purchased; the payer's individual or company tax ID (CPF or CNPJ), required by the payment provider to issue the charge; amount; currency; frequency; charge status; start, renewal and cancellation dates; transaction history; customer, subscription and transaction identifiers at the provider; information needed for billing, reconciliation, reversal, chargeback and transfer.

Charges in Brazilian communities are made in Brazilian reais (BRL) and processed by Asaas. In paid communities, the creator is the holder of the charge and receives the amounts directly through the payment provider: the charge is created in the creator's own Asaas account. For that reason, the payer's name, CPF or CNPJ and e-mail address and the charge data are recorded in that account, and the creator uses them for charging, refunds, issuing tax documents and complying with legal obligations. Triboo does not store the payer's full card numbers, security codes, banking passwords or complete financial credentials. That data is handled directly by the payment provider.

3.5 Technical, log and security data

• IP address and, where technically or legally required, the source logical port; device identifiers; browser; operating system; access logs; date and time; pages and resources accessed; login attempts; fraud prevention records; cookies and similar technologies; records of administrative and security actions.

3.6 Support and relationship data

• messages sent to support; requests; attachments; support history; satisfaction surveys; product feedback; information needed to resolve problems.

3.7 Preferences and consent evidence

• version of the text presented; purpose; status of the choice; date and time; collection source; user identifier; IP or another technical record where necessary; withdrawal date; history of preference changes.

3.8 Integrations and connections authorized by the user

• identification of the tool or assistant connected; connection date; permissions granted; records of the actions performed by the integration; revocation date.

3.9 Creator identification and verification data

• name or company name; individual or company tax ID (CPF or CNPJ); identity and corporate documents; address; bank details; information about the activity, revenue and beneficiaries; results of the identity verification and fraud prevention checks required by Triboo or by the payment provider; in paid communities, the API key of the creator's Asaas account, stored encrypted, and the details of that account read through it, such as the account holder's name, CPF or CNPJ and the account identifier.

3.10 Reports and moderation

• content or account reported; identification and contact details of the person reporting, where provided; reason for the report; decisions taken and their grounds; challenges and their outcomes.

4. How data is collected

Data may be provided directly by the user, generated during use of the platform, or received from authorized third parties, such as Google at sign-in and the payment providers.

• when creating or accessing an account;
• when creating, administering or joining a community;
• when subscribing to, renewing, cancelling or obtaining a refund for a plan;
• when posting, commenting, liking, watching lessons or attending events;
• when completing onboarding, progress, quests or activities, where available;
• when filling in forms, configuring preferences, accepting or rejecting cookies;
• when connecting an external tool or assistant to the account;
• when contacting support or taking part in surveys;
• when registering as a creator and going through identity checks;
• when reporting content or challenging a moderation decision.

5. Purposes and legal bases

The applicable legal basis depends on the purpose and the context. Triboo does not use consent as a blanket justification for every operation.

Where Triboo relies on legitimate interest, it will assess necessity, suitability, impact on data subjects, reasonable expectations, minimization and safeguards. The data subject may object where the processing does not comply with the LGPD.

6. Operational and promotional communications

6.1 Communications necessary for the service

Triboo may send messages necessary to create and protect the account, confirm login, notify payments, grant or block access, announce events purchased, reply to support, communicate relevant changes and meet administrative obligations. Those messages do not depend on a promotional opt-in.

6.2 Triboo marketing

Newsletters, news, content, events and offers from Triboo will be sent in accordance with the applicable legal basis and the user's preferences. Where sending depends on consent, the option will not be pre-checked and may be withdrawn at any time.

6.3 Community marketing

Promotional communications from creators or communities will be configured per community wherever possible. Essential notices about access, delivery, confirmed events or changes to the service purchased may be sent as operational communications.

Every promotional communication must offer a simple way to unsubscribe, without preventing receipt of messages that are indispensable to the service.

7. Data visible to creators, administrators and members

On joining a community, the member understands that certain data may be visible to the creator, administrators, moderators and other members, according to role and necessity: name, avatar, bio, links, role, level, points, participation, posts, comments, progress, membership status and activity indicators.

E-mail, payment status and administrative data must only be made available to authorized people where necessary for management, support, access, charging or authorized communication. Triboo may log exports, queries and other sensitive actions.

In paid communities, the creator's name or company name, individual or company tax ID (CPF or CNPJ), address and contact channel are displayed on the offer page, as required by e-commerce law.

Creators and administrators may not sell lists, carry out scraping, use data for incompatible purposes, send spam or share information with third parties without an adequate legal basis and authorization.

8. Sharing with commercial partners

Triboo does not sell contact lists. Sharing a name, e-mail or other contact data for partner campaigns will happen only where:

• the partner or the partner category is clearly identified;
• the purpose is described before the choice is made;
• the consent is specific, prominent, freely given and revocable;
• refusal does not prevent account creation or access to the service purchased;
• there are contracts and controls consistent with the authorized purpose.

Consent for partners will be kept separate from acceptance of the Terms of Use, from being informed of this Policy, from Triboo marketing and from community communications.

9. Processors, suppliers and authorities

Triboo shares data, to the extent necessary, with the suppliers below, as well as with accounting and legal advisers.

Triboo does not use third-party analytics, advertising or error-tracking services.

For automatic translation and topic classification, Triboo uses one of these two suppliers at a time, always through the official API, with no intermediary. Any other supplier or intermediary will be added to this list before it is used.

Data may also be provided to public authorities under a legal or regulatory obligation, a valid order, or for the regular exercise of rights. This list will be updated whenever a supplier is added, removed or replaced.

In the event of a corporate reorganization, merger, acquisition, spin-off, incorporation or sale of assets, personal data may be transferred to the successor entity, which will be subject to this Policy until there is a valid and communicated change. The transfer will not broaden the purposes originally disclosed, and Triboo will notify data subjects where the transaction involves a relevant change in the processing or in who controls the data.

10. International data transfers

Part of the data is stored or processed outside Brazil. In particular, the platform's database is currently kept on a server in Tokyo, Japan.

The table below sets out, for each supplier that receives data from Triboo outside Brazil, the destination country and the purpose. Transfers take place for as long as the service is provided, and the data follows the retention periods in section 12.

For Google sign-in and for YouTube and Vimeo videos, it is the user's own browser that connects to those services, which act as independent controllers under their own policies.

Where a transfer relies on standard contractual clauses, the data subject may request the text of those clauses through the privacy channel. Before adding a new supplier outside Brazil, Triboo will assess the country, the supplier, the purpose, the necessity of the transfer and the technical and contractual safeguards available.

11. Cookies and similar technologies

Triboo uses first-party cookies to keep the session alive, protect login, complete sign-up, remember the cookie choice and remember the user's language, theme and time zone. Those cookies are necessary for the platform to work.

The only category that depends on consent is embedded content: third-party videos, such as YouTube and Vimeo videos, are only loaded after the user's choice, because those services may set their own cookies. Triboo does not use analytics or advertising cookies.

The user can accept, reject or change their choice at any time at triboo.net.br/cookie-preferences. Withdrawing consent is as simple as giving it. Further information is set out in the Cookie Policy.

12. Retention and deletion

Data will be kept for as long as necessary for the purpose disclosed, the contractual relationship, the exercise of rights, fraud prevention and compliance with legal, tax, regulatory or judicial obligations.

• account data: during the relationship and, as a rule, for up to 5 (five) years after closure, to meet obligations and defend rights;
• content published in communities by someone who closed their account: is deleted or may remain visible without data identifying the author, in line with the Terms of Use, unless deletion is requested;
• application access logs: kept for the minimum period of 6 (six) months required of application providers by the Brazilian Internet Civil Rights Framework (Marco Civil da Internet), and may be kept for longer under a court order, a request from a competent authority or where needed for the regular exercise of rights;
• payment and billing data: for 5 (five) years, the period set by tax law, or longer where the law requires it or a chargeback or dispute is ongoing;
• creator identification and verification data: during the relationship and for up to 5 (five) years after closure;
• consent evidence: while the choice is in force and for up to 5 (five) years after withdrawal or account closure, to demonstrate its validity;
• reports and moderation records: for the period necessary to defend rights and to comply with the applicable regulation;
• support and security data: according to operational need, risk and the periods for the defence of rights;
• backups: deleted or overwritten in line with documented technical cycles.

Once the purpose has ended and where there is no legal basis for retention, data will be deleted, anonymized or blocked. Deletion from active systems may not be immediate in backup copies, but it will be reflected in line with the applicable retention cycle.

13. Data subject rights

Under the LGPD, the data subject may request:

• confirmation that processing exists, and access to the data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• portability, where regulated and applicable;
• information about data sharing;
• information about the possibility of refusing consent and the consequences of doing so;
• withdrawal of consent and deletion of data processed on that basis, subject to legal exceptions;
• objection to unlawful processing;
• review of decisions taken solely on the basis of automated processing, where applicable.

Requests may be sent to info@triboo.net.br. Triboo may ask for additional data to confirm identity and prevent fraud. Where applicable, it will provide an immediate simplified response or a clear and complete statement within 15 (fifteen) days of the request.

Requests about data that a creator processes as a controller follow section 2. The data subject may also petition the National Data Protection Authority (ANPD).

14. Security and governance

Triboo will adopt technical and organizational measures proportionate to the risks and to the product's stage, which may include:

• role-based access control and the least-privilege principle;
• authentication through Google sign-in and session protection;
• stronger authentication for administrative accounts where available;
• separation between development, test and production environments;
• security logs and auditing of sensitive actions;
• backups, restore testing and monitoring;
• management of secrets and credentials;
• restriction and logging of data exports;
• supplier review and secure development good practice.

No system is completely free of risk. Users must protect access to their Google account, their Triboo account and their devices, and report any suspicion of unauthorized use.

15. Security incidents

Triboo will maintain a procedure to detect, log, investigate, contain and remediate incidents. Where an incident may give rise to relevant risk or harm, Triboo will notify the National Data Protection Authority (ANPD) and the affected data subjects within the applicable legal deadline, currently 3 business days from the controller becoming aware of the incident, unless the authority determines otherwise.

The notification may state the nature and category of the data, the affected data subjects, the measures taken, the risks, protective recommendations and a contact channel, as required by the regulations.

16. Minimum age

Triboo V1 is intended exclusively for people aged 18 or over. On creating an account, the user declares that they meet the minimum age requirement. Accounts belonging to minors may be suspended or closed, and the data collected will be deleted, unless there is a legal obligation to retain it.

Should Triboo decide in future to offer services to children or adolescents, it will publish specific rules, carry out a risk assessment and implement appropriate mechanisms before allowing such use.

17. Voluntarily published data and sensitive data

Information published in profiles, posts, comments, lessons, events and interactive areas may be seen by members and administrators in accordance with the community's settings. Users must not publish sensitive personal data, confidential information, sealed court record data or third-party data without authorization and a legal basis.

17.1 Communities on sensitive subjects

Taking part in some communities may, in itself, reveal sensitive data — for example, a support community for people with a physical or mental health condition, a religious community or a community centred on a sexual orientation. For that reason, in V1, Triboo does not allow communities of that kind, in line with the Terms of Use and the Creator Terms. If such a community is identified, it may be suspended or closed, and the related data will be handled under this Policy.

18. Gamification, metrics and automated decisions

Where available, points, levels, rankings, progress and recommendations may be calculated automatically from activity on the platform. Those features exist for organization and engagement and have no financial value, except in a campaign that expressly states otherwise.

Should a decision taken solely by automated means produce relevant effects on the data subject, Triboo will provide information and the possibility of review under the LGPD, where applicable.

19. Artificial intelligence and authorized integrations

Triboo uses artificial intelligence to automatically translate community text — such as posts, comments, course content, community names and descriptions, event titles and descriptions, tags, and channel and channel-group names — and to classify content by topic (tags). To do so, that content is sent to an artificial intelligence supplier — OpenAI or Anthropic, through the supplier's official API — which processes it to return the translation or the classification, does not use it to train models and may keep it for a limited period to prevent abuse, under its own terms. Direct messages are never sent to those suppliers. Automatic translation is part of how the platform works, and it relies on the performance of the contract and on the legitimate interest of allowing people who speak different languages to take part in the same communities. The suppliers and countries involved are listed in sections 9 and 10.

Triboo does not use content published in communities — including posts, comments, lessons, files and messages — to train its own artificial intelligence models or to train third-party models.

Triboo may use aggregated, statistical or anonymized data that does not identify users or communities in order to measure use, improve the product and produce internal indicators.

Triboo may offer integrations that let the user themselves connect external assistants or tools to their account. In those integrations, access takes place with the user's authorization and under their instruction, limited to the permissions they already hold on the platform, and the external tool's use of the data is governed by the respective supplier's terms. The user may request that an integration be disconnected at any time.

When a creator or administrator connects an integration, the tool may access content and data of that community's members within that person's permissions. In that case, data is shared with the tool's supplier, under the responsibility of whoever connected it, in line with the Creator Terms.

Should Triboo come to offer other artificial intelligence features that use identifiable content from a community, those features will be announced specifically, with clear information about the purpose, the data used, the controls available and the applicable legal basis, and, where required, with consent or fresh acceptance.

20. Member data obtained by the creator

If the creator exports or extracts data from their community through any feature the platform offers, they become an independent controller of that data and take on the corresponding obligations under the LGPD, including as regards purpose, legal basis and the recorded communication preferences. Marketing preferences given on Triboo do not, by themselves, authorize communications outside the platform.

Full payment data, data on members of other communities and Triboo's internal security logs are not made available to the creator.

21. Changes to this Policy

Triboo may update this Policy to reflect legal, technical or operational changes. Relevant changes will be communicated by reasonable means. Where a change requires fresh consent or fresh contractual acceptance, Triboo will ask for a specific statement of choice before applying the new purpose.

22. Contact

• Privacy/LGPD e-mail: info@triboo.net.br
• Support e-mail: info@triboo.net.br
• Privacy officer or channel: info@triboo.net.br
• Address: Rua Rio de Janeiro, 707, casa — Maracanã, Foz do Iguaçu/PR, CEP 85852-050