Privacy Policy

This Privacy Policy explains how Atlas ("Atlas", "we", "us"), a school management platform operated by Unidos Educação, CNPJ 68.019.608/0001-00, with registered office at SGAS 915, Bloco D, Sala 103, Asa Sul, Brasília/DF, CEP 70390-150, Brazil ("Company"), collects, uses, stores and shares personal data when you use our websites, applications and services (the "Service").

We process personal data in accordance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — Law No. 13,709/2018, "LGPD") and, where applicable, the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

By using the Service you acknowledge that you have read and understood this Policy. If you use Atlas through a school, the school remains your primary point of contact for questions about how your data is handled.

1. Who we are and our role

Atlas is a platform used by schools and other educational organizations ("Schools") to manage their academic and administrative routine: enrollment, classes, grades, attendance, assessments, communication with families, and financial management.

Depending on the data involved, our role differs:

• For data that Schools enter and manage in the platform — such as student records, guardians, grades, attendance, incidents, assessments and financial charges — the School is the controller (controlador / data controller) and Atlas acts as operator/processor (operadora / data processor), processing data only under the School's instructions and the agreement between us.
• For data related to your account and our commercial relationship — such as sign-in credentials, billing information for the School's subscription, support requests and usage logs — Atlas is the controller.

If you are a student, parent or guardian and want to exercise your data rights over school records, your request will usually be handled by your School, with our assistance where needed (see Section 12).

2. Personal data we process

Account and identification data: name, e-mail address, password (stored only as a cryptographic hash), profile type (owner, admin, teacher, student, parent/guardian or staff), language preference and, when you sign in with Google, Microsoft or Apple, the identifier and e-mail provided by that provider.

Academic records (entered by the School): student name, date of birth, enrollment data, class and curriculum assignments, grades, report cards, attendance, assignments and submissions, assessment results, and pedagogical or disciplinary incident records.

Sensitive data: incident records may include health-related information (for example, a medical incident at school) and other sensitive data as defined in LGPD art. 5, II and GDPR art. 9. This data is processed strictly for the School's legitimate educational and student-safety purposes, with restricted access.

Family and guardian data: names, contact details and relationship to the student (mother, father, guardian or other).

Financial data: tuition and other charges, discounts, payment status and payment method (Pix, boleto, card, cash or transfer). When payments are processed by a payment provider, card numbers and full payment credentials are handled by that provider — Atlas does not store full card numbers.

Content: files, images, test and question content, student ID card photos, and class audio recordings created through the platform's recording feature.

Technical and usage data: IP address, device and browser information, access logs, audit trail of relevant actions inside the platform, and cookies or similar technologies (see Section 7).

3. Purposes and legal bases

We process personal data for the following purposes, relying on the legal bases of LGPD arts. 7 and 11 and GDPR arts. 6 and 9:

• To provide the Service and perform our contract with the School (LGPD art. 7, V; GDPR art. 6(1)(b)) — creating accounts, managing academic records, generating report cards, processing enrollment and running the platform features.
• To comply with legal and regulatory obligations (LGPD art. 7, II; GDPR art. 6(1)(c)) — for example, tax, accounting and educational record-keeping obligations.
• For our legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)) — securing the platform, preventing fraud and abuse, maintaining audit logs, and improving the Service, always balanced against your rights and expectations.
• With your consent where required (LGPD art. 7, I; GDPR art. 6(1)(a)) — for optional features that are clearly presented at the moment of collection. Consent can be withdrawn at any time.
• Sensitive data is processed only where LGPD art. 11 and GDPR art. 9(2) permit, such as protecting the life or physical safety of the student, complying with the School's legal or regulatory obligations, or with specific consent.

We do not sell personal data, and we do not use student data for advertising.

4. Children's and adolescents' data

Atlas is used by Schools to manage records of children and adolescents. This data is processed in the student's best interest, as required by LGPD art. 14 and the Statute of the Child and Adolescent (ECA), and under the responsibility of the School as controller.

The School is responsible for obtaining any consent required from parents or legal guardians and for informing families about the use of the platform. Student accounts provide access only to the student's own information, according to the access profile assigned by the School.

5. AI-assisted features

Some features of Atlas use artificial intelligence models provided by third parties (currently Anthropic) — for example, assistance with creating questions, extracting content from documents, and productivity tools for teachers and staff.

When you use these features, the relevant content is sent to the AI provider solely to generate the requested result. Our agreements with AI providers prohibit the use of this data to train their models.

AI outputs may be inaccurate. Teachers and staff remain responsible for reviewing AI-generated content before using it, and no decision producing legal or similarly significant effects for a student is made solely by automated means.

6. Class recordings

The platform includes a recording feature that allows teachers to record lessons for pedagogical purposes. Recordings are stored securely and are accessible only according to the access rules set by the School. The School, as controller, is responsible for informing students and families about recording practices and for their lawful use.

7. Cookies and similar technologies

We use strictly necessary cookies and browser storage to operate the Service:

• Authentication cookies that keep your session active and secure.
• Local storage for preferences such as language and light/dark theme.

We do not use advertising or cross-site tracking cookies. Because these technologies are essential to the Service, they cannot be disabled while using the platform; you can clear them at any time through your browser, which will end your session.

8. Sharing and service providers

We share personal data only as needed to run the Service:

• Infrastructure and hosting providers, including cloud storage of files and backups.
• Payment providers, to process Pix, boleto and card payments handled through the financial module.
• AI providers, as described in Section 5.
• E-mail and communication providers, to deliver transactional messages such as invitations, confirmations and password resets.
• Identity providers (Google, Microsoft, Apple) when you choose to sign in with them.
• Public authorities, when required by law, regulation or judicial order.

All service providers are bound by contracts that restrict their use of personal data to the services they provide to us.

9. International data transfers

Some of our service providers may process data outside Brazil or outside the European Economic Area. When that happens, we rely on the international transfer mechanisms of LGPD arts. 33–36 and, where GDPR applies, on adequacy decisions or standard contractual clauses approved by the European Commission, along with additional safeguards where appropriate.

10. Data retention

We keep personal data only as long as necessary for the purposes described in this Policy: for as long as the School maintains its contract with us and, after termination, for the period needed to comply with legal obligations, resolve disputes and enforce agreements.

Academic records are retained according to the instructions of the School, which may be subject to educational record-keeping regulations. Deleted records are first marked inactive (soft delete) and later removed or anonymized in accordance with our retention schedules.

11. Security

We adopt technical and organizational measures compatible with market standards to protect personal data, including encryption in transit, password hashing, tenant isolation (each School's data is stored in a separate database), role-based access control, audit logging and regular backups.

No system is completely secure. If a security incident likely to create relevant risk or damage occurs, we will notify the affected Schools and, where required, the Brazilian National Data Protection Authority (ANPD) or other competent authority, in accordance with applicable law.

12. Your rights

Under LGPD art. 18 and GDPR arts. 15–22, you have the right to:

• Confirm whether we process your personal data and access it.
• Correct incomplete, inaccurate or outdated data.
• Request anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully.
• Receive your data in a portable format and request its transfer to another provider, where applicable.
• Obtain information about the entities with which your data has been shared.
• Withdraw consent, where processing is based on consent, without affecting prior processing.
• Object to processing based on legitimate interests, and request review of solely automated decisions.

If your data is managed by a School (student, family and academic records), please direct your request to the School, which is the controller of that data — we will support the School in responding. For data for which Atlas is the controller, contact us using the details in Section 14.

You also have the right to lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados) in Brazil or, where GDPR applies, with your local supervisory authority.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top indicates the latest revision. If we make material changes, we will notify Schools and users through the platform or by e-mail before the changes take effect.

14. Contact and Data Protection Officer

Our Data Protection Officer (Encarregado de Dados, LGPD art. 41) can be reached at contato@ue.com.br.

For any privacy question or to exercise your rights, contact us at contato@ue.com.br, by phone at +55 61 9641-4019, or by mail at SGAS 915, Bloco D, Sala 103, Asa Sul, Brasília/DF, CEP 70390-150, Brazil.