Privacy policy

WeBest is an AI-powered study app for iOS and Android, provided by Caterina Boff Costa LTDA, registered in Brazil under CNPJ no. 68.564.652/0001-92, with its registered office at Estrada Tenente Marques, 6765, Santana de Parnaíba - SP, CEP 06530-001, Brazil, which operates under the WeBest brand. In this policy, “WeBest”, “we” and “our” refer to that company.

We are the controller of the personal data processed in the app, on this website and in the emails we send: we decide why and how it is used, and we answer for it to you and to Brazil's National Data Protection Authority (ANPD).

This policy follows Brazil's General Personal Data Protection Law (LGPD, Law no. 13,709/2018) and applies to the WeBest app, the webest.com.br website and WeBest emails. Use of the app is also governed by the Terms of Use.

We only collect what WeBest needs to work. The data comes from you (what you type, send or record) or is generated as you use the app.

Account

Name, email and password. The password is never stored as text: we only keep an irreversible code of it (a bcrypt hash). We also record whether the account was blocked by our team, for example for abuse, and keep the version of the Terms of Use you accepted and when.

Date of birth

Asked at sign-up, as your own statement. It is used only to check the minimum age of 13 and to know whether you are 13 to 17, so the app can show the notice for parents and guardians. It is never shown to anyone and is not sent to the AI provider.

Profile and preferences

Content language, topics you want to study, daily time available, preferred reminder time, your answers to the initial setup and how you like to study: how each lesson starts (explanation first, hands-on first or balanced), review pace, how you answer exercises and reading preferences for book suggestions. If you want, also Exemplos com a sua cara (examples that look like you): up to 5 everyday topics and one line about your work or project. These fields do not accept sensitive data (health, religion, politics, sexuality, ethnic origin, address, documents or personal finances).

Learning paths and progress

Learning paths (topic, objective, reason for studying, target date, goals and steps), folders, placement tests and tests to skip a goal, with your answers, and your estimated level. Also sessions and exercises, your answers and correct answers, where you left off, mistakes saved for review, requests to adjust a path, the ratings you give to sessions and your progress on the app's getting-started checklist.

Notes, conversations and documents

Your notes, conversations with the tutor, the documents AI creates at your request (such as summaries, note compilations and study materials) and suggested books.

Materials you upload

Pasted text and PDF files used to build learning paths. We keep the extracted text, split into excerpts. The PDF file itself stays in our database only while the import is in progress and is deleted as soon as it ends, whether it succeeds or not.

Imported study folders

When you import your own study material (a .zip file or several text files), we refuse the upload, storing nothing, if it holds credentials such as access keys or private keys, and we replace any passwords, e-mail addresses, CPF numbers and phone numbers we find with placeholders before storing anything. Hidden folders (such as .git), images and configuration files with passwords (.env) are not read. The files stay in our database only until you confirm or discard the import preview, or for up to 24 hours; after that we keep only what the import created: the learning paths, the study text of each, your exercises turned into review items and your error records in the notebook. The statuses your files declare become the path's history, never proof that you have mastered a subject.

Assignments for review

The typed text, which we keep together with the review, or a photo of the assignment. The photo goes to the AI provider only to produce the review and is not stored by us: we only keep the result.

Voice

When you dictate by voice, the recording goes to the AI provider only to be transcribed. We don't keep the audio; the transcribed text stays wherever you use it, such as in a note or a message to the tutor. When you ask to hear a passage, our server sends only that text to Inworld, in the United States, to generate the audio. We do not send your name, email or recordings to Inworld. Retention by Inworld follows its contract with WeBest and the account settings; we do not assume zero retention. Generated audio stays in our cache as described in How long we keep it.

Content representations

Numerical representations (embeddings) generated from your learning paths and sessions, used to find similar content, for example to warn you that you already have a similar path. They are derived from your content and deleted along with it.

Usage and credits

Your plan (today, Grátis, unless our team assigns another one), the extra credits you receive and the history of these changes, plus a log of AI feature usage (which feature, when and how much of each allowance it consumed: AI credits, natural-voice minutes and illustration credits), to apply the plan's limits and control costs. For each session prepared in advance, also a cost record with no content: how much the preparation consumed, how many credits it will cost if you open it and whether it was opened.

Consent

The history of each time you give or withdraw consent for AI: date and time, the notice version agreed to and IP address. See Consent for AI.

Sharing and reports

Links to the learning paths you choose to share, with the author name you choose to display (optional, up to 60 characters), and the reports you make about other people's paths (reason and details).

Help messages

What you send through the form on the help page: topic, name, email, message, the page language and, for reports, the learning path link. We also record the IP address it was sent from, to prevent abuse.

Access logs

Date and time, IP address and source port of each sign-up, login, session renewal, password reset and account deletion, as required by Brazil's Marco Civil da Internet (Law no. 12,965/2014, art. 15).

Technical data

IP address, date and time and technical details of requests to our server (logs), used for security and abuse prevention.

Study reminders are local notifications, scheduled on your own device: we don't use a push notification service or store device identifiers for them.

What we don't collect: location, contacts, advertising identifiers or payment data. We also don't ask for sensitive data (such as health, religion or political opinion). Avoid including it in materials, photos or conversations; if you do, it will only be processed to perform the feature you asked for.

The LGPD requires a legal basis for each use of data (art. 7). Here is each purpose and its basis:

Create and maintain your account

Sign-up, login, sessions and password reset.Legal basis performance of a contract (art. 7, V).

Check the minimum age

Use your date of birth to turn away anyone under 13 and to show the notice for parents and guardians to those aged 13 to 17.Legal basis performance of a contract (art. 7, V), always in the teenager's best interest (art. 14).

Provide AI-powered study

Build and adjust learning paths, generate sessions, exercises and documents, estimate your level, answer in the tutor, review assignments, transcribe your voice and read aloud the passages you ask to hear. After you complete a session or build a learning path, the app may also prepare your next session and review exercises on the key ideas you already studied in advance, without you tapping anything, so they are ready when you come back.Legal basis performance of a contract (art. 7, V) and your consent to sending data to the AI provider (art. 7, I), requested in the app before first use.

Keep your progress and content

So you can pick up where you left off, review mistakes and look up notes and materials.Legal basis performance of a contract (art. 7, V).

Personalize suggestions

Organize your next study session and reviews based on your learning paths, the interests you add to your profile and your progress. Never for advertising.Legal basis performance of a contract (art. 7, V).

Adapt examples and explanations

Adjust the depth and the examples of lessons, exercises, reinforcement, the tutor and the learning path to what you told us in the placement (including where and how you will practice), your recent results in the learning path, the reason and target date of your study and, if you chose them, your Exemplos com a sua cara (only in lessons, exercises, reinforcement and the tutor). These examples never enter the building of your learning path, the placement test, the test to skip a goal, grading or reviews. Nothing is inferred: only what you choose counts, and you can change or delete it in the app's preferences. Never for advertising.Legal basis performance of a contract (art. 7, V) and your consent to sending data to the AI provider (art. 7, I).

Manage usage credits

Measure the consumption of AI features, apply limits and control costs.Legal basis performance of a contract (art. 7, V).

Prove your consent

Keep a record of each consent given or withdrawn.Legal basis legal obligation (art. 7, II), because it is up to us to prove consent (art. 8, §2).

Send service emails

Such as the password reset link. We don't send marketing emails without your permission.Legal basis performance of a contract (art. 7, V).

Moderate shared learning paths

Automatically check, before publishing, whether a path's text and the author name contain inappropriate content, receive and review reports, disable abusive links and stop a reported path from being shared again.Legal basis legitimate interest (art. 7, IX), to keep the community safe.

Answer help requests

Answer the messages sent through the help page, review the reports made there and prevent abuse of the form.Legal basis performance of a contract (art. 7, V), when the request is about your account, and legitimate interest (art. 7, IX) in other cases.

Protect the service

Prevent fraud, abuse and unauthorized access, limit login attempts, block accounts used for abuse and investigate incidents.Legal basis legitimate interest (art. 7, IX).

Improve WeBest

Use the ratings you give to sessions and aggregated internal usage statistics. Never for advertising.Legal basis legitimate interest (art. 7, IX).

Comply with the law and defend rights

Keep the access logs required by Brazil's Marco Civil da Internet, respond to court orders and authorities and defend ourselves in legal proceedings.Legal basis legal obligation (art. 7, II) and regular exercise of rights (art. 7, VI).

Important: artificial intelligence is at the heart of WeBest. Without your consent to sending data to the AI provider, or if you withdraw it, the AI features (building learning paths, sessions, tutor, reviews, dictation and read-aloud) are unavailable, but the rest of your account keeps working, including your stored studies. This does not affect your rights: you can still access, correct and delete your data.

When we rely on legitimate interest, we assess whether the use is necessary and respects your expectations and rights. You can object to it through the contact email.

Automated decisions: the suggested level and the learning path are built automatically by AI. You can adjust the path in the app and ask for a review of any decision made solely by automated means (LGPD art. 20).

Before you first use an AI feature, the app shows a screen explaining that, to create learning paths, study sessions and answers, the content needed is sent to OpenAI, in the United States, and asks for your consent. See what goes to OpenAI in Who we share it with. Read-aloud has its own consent, described below.

How we record it

We keep each time you give or withdraw each consent, with the date and time, the version of the notice the app showed and the IP address the request came from. This is how we prove your consent (LGPD art. 8, §2).

How to withdraw

Whenever you want, free of charge and immediately, right in the app: “Perfil → Consentimento de IA” (Profile → AI consent).

After you withdraw

AI features stop working until you consent again. The rest of your account keeps working: your learning paths, notes and progress remain available. Withdrawing consent does not delete your account.

What was already processed

Withdrawal applies from then on and does not undo what was already processed (LGPD art. 8, §5). To erase your data, delete your account (see how) or request deletion through the contact email.

When the notice changes

If the notice changes in a relevant way, we ask for your consent again before the next AI feature.

Read-aloud

Listening to passages has its own consent, separate from the AI consent: the app asks for it the first time you tap “Ouvir” (Listen), on a screen explaining that our server sends the requested text to Inworld, in the United States, and that retention by Inworld follows the contract and the account settings. Read-aloud needs both consents. Withdrawing it, in “Perfil → Consentimento de IA” (Profile → AI consent), turns off only read-aloud.

Public profile moderation

Appearing in the community has its own consent, separate from the AI consent: the app asks for it when you create the public identity, on a screen explaining that our server sends the public name, the @handle, the Domina topics and the learning paths and folders you publish to OpenAI, in the United States, for automatic moderation. The community needs both consents. Withdrawing it, in “Perfil → Consentimento de IA” (Profile → AI consent), only stops new content from being sent for moderation. See Community and public profile.

We don't sell your data, don't show ads and don't track you across other apps or websites. We only share data with those who help us provide the service, and only what is needed:

OpenAI (AI provider)

OpenAI, L.L.C., in the United States, processes the content needed for each AI feature (see the list below). It acts as a processor: it handles the data only to provide the service to us, following our instructions. Under OpenAI's API terms, this data is not used to train models and may be kept for up to 30 days for abuse monitoring, unless the law requires otherwise. Privacy at OpenAI.

Inworld (read-aloud)

Inworld receives only the text of a passage you ask to hear, over a connection from our server, and returns audio. Processing takes place in the United States. We do not send names, email addresses or recordings to Inworld. Retention and use by Inworld follow its contract with WeBest and the account settings; we do not assume zero retention. Inworld privacy.

Resend (email)

Plus Five Five, Inc., the company that operates Resend, in the United States, sends our service emails: the password reset link and, to our own mailbox, internal alerts about new help requests and reports, which contain only an identifier. It receives your email address and the reset message, also as a processor, and keeps delivery logs for the period set by the plan we subscribe to. Privacy at Resend.

Hosting

Our servers (API and database) and backups are in Brazil, on infrastructure contracted by WeBest, with restricted access.

Apple and Google

The app stores process download data and your store account under their own policies, as independent controllers.

People with a path link

If you share a learning path, anyone with the link only sees its structure (topic, objective, goals and steps) and the author name you choose to display, if any. Never your progress, notes or mistakes. You can disable the link at any time.

Authorities

When the law or a court order requires it, and only to the extent required. Access logs are only disclosed under a court order.

What goes to OpenAI

• To build and adjust learning paths: topic, objective, reason for studying, target date, daily time, placement answers and your adjustment requests.
• To generate sessions, reviews and reinforcement: your level, how each lesson starts, the points you got wrong before, what you told us in the placement (including where and how you will practice), your recent results in the learning path, the reason and target date of your study and, outside reviews, your Exemplos com a sua cara, if you chose them.
• To prepare your next session and review exercises in advance (without an explicit request at that moment, after you complete a session or build a learning path): the same data as for sessions and the key ideas of the steps you already studied. It only happens with your consent to AI processing; a prepared session only uses credits when you open it, and review exercises never do.
• To check the multiple-choice questions before you see them (those of the placement quiz, sessions, reinforcements, the test-out and review exercises): the generated questions and options themselves, with the topic, the objective, the goal and step titles and your level. Your answers are not sent with them.
• To give feedback: your written answers to exercises and the assignments you submit, as text or photo.
• The materials you upload (pasted text and PDFs) and excerpts from them, when a path is built from them.
• When you confirm the import of a study folder: excerpts of your notes for each step, your exercises with the answers you wrote in them, and the titles and lessons of your error records, to create the path's key ideas and organize the exercises. The import preview sends nothing.
• Your notes, when you ask to turn them into a review question or into a document, such as a summary.
• Your messages to the tutor and in the app's welcome conversation. Each message to the tutor also carries the open session, what you have answered in it (including your written answers and their feedback), the steps of the learning path, what you told us in the placement, your recent results and, if you chose them, your Exemplos com a sua cara. If you have already saved your preferences, the welcome conversation also carries them, so it does not ask again.
• Your reading preferences, when you ask for book suggestions.
• Voice recordings, to transcribe them. Passages for read-aloud are sent separately to Inworld.
• Text from your learning paths and sessions, to generate the numerical representations (embeddings).
• The text of a learning path you decide to share (topic, objective, goals and steps), to check for inappropriate content — the author name is not sent.
• If you create a public identity in the community, with its own moderation consent (see Community): the public name, the @handle, the topic of the learning paths that may appear under Domina on your profile and the learning paths and folders you publish on it, only for the automatic moderation of inappropriate content — never your email. They are never used to train models.

The content language goes along with these requests. We don't send your name, email or date of birth to OpenAI. Requests leave from our server, and our access key is never handed to the app.

Each processor follows a data processing agreement that limits the use of the data to providing the service, requires security measures and guarantees protection equal or equivalent to that described in this policy.

To check that suggested books exist, our server queries the public Google Books catalog with only the book's title and author. None of your data is sent in that query.

If the company goes through a merger, acquisition or reorganization, the data may be transferred to the successor, which will be bound by this policy. We will let you know beforehand.

The community is optional. You only appear to other people if you create a public identity in “Perfil → Identidade pública” (Profile → Public identity); without it, nothing about your studies is visible to anyone.

What the public profile shows

The public name you choose (it can be a nickname), your @handle, an avatar from the app's gallery, the verified badge when there is one, the learning paths you published and how many there are and, only if you turn them on, your follower count and your verified progress. Your email, your date of birth, your age and your detailed study progress never appear.

Follows and friends

Other people can follow you or send you a friend request, according to your settings in “Perfil → Privacidade” (Profile → Privacy), for example approving each new follower or limiting who can send friend requests. Requests with no answer expire after 45 days. You can unfriend, unfollow or remove a follower at any time.

Published learning paths

You choose to publish a learning path to everyone, only to friends or to selected friends. What becomes visible is a copy of the path's topic, objective, goals and steps at the time of publishing — never your answers, notes or progress in it. You can unpublish it at any time; people who already copied the path keep their copy.

Verified progress

If you turn it on, your profile shows numbers the app computes from your studies: ideas mastered, learning paths completed, your day streak and the Domina topics you choose to show. They are whole numbers only, never study time, and each topic appears only if you choose it, because a topic can reveal sensitive data.

Blocks

You can block anyone: they can no longer see your profile or interact with you, and any friendship and follows between you are undone. The block is kept until you unblock or until one of the accounts is deleted.

Reports

You can report a profile, a learning path or a published folder. The report goes to our moderation team, which reviews it within 24 hours, as promised in the Terms of Use. The person reported does not learn who reported them.

Automatic moderation

Before something of yours appears to other people — the public name, the @handle, the Domina topics and the learning paths and folders you publish —, our server sends that content to OpenAI, in the United States, for an automatic check for inappropriate content. This has its own consent, asked when you create the public identity, and it also needs the AI consent. The content is not used to train models. You can withdraw it in “Perfil → Consentimento de IA” (Profile → AI consent): from then on nothing new is sent, and what is already published stays until you change or remove it.

Teenagers

Accounts of people aged 13 to 17 are always private: they do not appear in search or to other people, and never show public numbers or rankings.

How long we keep it

• The public identity, the relationships (followers, friends and blocks) and the publications are kept for as long as you keep them or until the account is deleted.
• An @handle you change stays reserved for 90 days, so no one can pass as you, and is then released.
• Reports are kept as the moderation record. If the reported profile is deleted, only a minimal record of the report remains (the @handle and the public name at the time), deleted 12 months after the decision.
• The decisions of our moderation team are recorded for accountability; when an account is deleted, the link to it and the written reason are erased.

Our servers, our database and backups are in Brazil. Three processors receive data in the United States: OpenAI, for AI, Inworld, to read aloud the passages you ask to hear, and Resend, for service emails. The US is not currently recognized by the ANPD as a country with an adequate level of protection, so here is how the transfer works (LGPD art. 33 and ANPD Resolution CD/ANPD no. 19/2024):

Destination country

United States.

Who receives it

OpenAI, L.L.C. (AI study features), Inworld (read-aloud) and Plus Five Five, Inc., which operates Resend (service emails), as processors. Each uses its own sub-processors, which they list publicly.

What goes and why

For OpenAI, the content needed for each AI feature, detailed in Who we share it with. For Inworld, only the text of the passage requested for read-aloud. For Resend, your email address and the service message.

For how long

For the processing time and the processors' periods described in How long we keep it.

Legal basis

For AI, your specific and prominent consent to the transfer (art. 33, VIII), requested in the app before first use, on a screen that explains data is sent to OpenAI, in the United States. For read-aloud, a separate consent, requested the first time you tap “Ouvir” (Listen), on a screen that explains the text is sent to Inworld, in the United States. For service emails, the transfer being necessary to perform the contract with you (art. 33, IX, with art. 7, V).

Safeguards

Data processing agreements with each processor, encryption in transit, sending only what is needed, deleting PDFs right after use and, under OpenAI's terms, a ban on using the data to train models.

You can ask for more information about these transfers at contact@webest.com.br.

Account and study content

For as long as your account exists. When you delete the account, we immediately erase the account and study content from our database, with the exceptions below.

Consent history

For as long as your account exists; it is erased along with it.

AI credit usage

When the account is deleted, this log is anonymized: it loses its link to the account, with no name or email, and is kept only for the platform's cost control. Your plan and extra credits are deleted with the account; the log of changes made by our team is also anonymized, without the written reason.

Reports you made

They are also anonymized when the account is deleted and stay in the moderation history, with no link to you. The free text you wrote in the report stays in it, so avoid putting personal data there.

Help messages

12 months from when they are sent, then they are deleted. They are not linked to your account: if you want them deleted sooner, ask through the contact email.

Access logs

6 months, as required by art. 15 of Brazil's Marco Civil da Internet (Law no. 12,965/2014), and deleted automatically shortly after. They are kept in a confidential and secure environment, disclosed only under a court order and, as a legal obligation (LGPD art. 16, I), kept even if you delete your account, linked to its identifier, until that period ends.

Backups

One daily copy of the database, stored on the same server, in Brazil, and deleted automatically after 14 days. Deleted data may remain in those copies until then, protected and unused. If backups are ever also stored with another provider, we will update this policy first.

Read-aloud requests

The requested text stays in the queue while awaiting processing, for up to 5 minutes while the service is running, and is erased when the request finishes. The result is available for 1 hour after completion and removed by the automatic cleanup. These records are deleted with your account. The audio cache follows the period below.

Read-aloud audio

The audio generated for you stays in our database, linked to your account, for up to 30 days and at most the 200 most recent clips, so the same passage is not generated again. It never serves another account and is deleted together with yours, or when you withdraw the AI consent or the read-aloud consent. Fully heard clips may also stay in the app's private device cache for up to 30 days, limited to 200 clips and 64 MiB, for offline playback. Signing out, deleting the account or withdrawing either consent erases the local copy. Offline playback uses the last verified consent and voice allowance until the earliest known expiry; changes on another device become known on reconnection. The operating system may evict the cache.

Lessons saved on this device

The app may keep up to 20 copies of opened lessons, including their saved position and answers, for up to 30 days and at most 8 MiB in the private device cache. Offline, they only allow rereading previously viewed content and replaying saved audio; they create no new grades or mastery evidence. Copies are account-scoped and erased on sign-out, account deletion or definitive session expiry. The operating system may evict them.

Earlier pronunciation results

Automatic pronunciation assessment has been discontinued in this version. Results of earlier attempts are deleted by the daily cleanup after 30 days from creation, or sooner with the session or account. We do not send new recordings to Microsoft.

Earlier voice-conversation records

Realtime calls have been discontinued in this version. Earlier records, without audio recordings, are deleted by the daily cleanup after 30 days from creation, or sooner with the learning path or account. No new calls are created.

Generation requests

When you ask the AI for something (a learning path, a session, a review, a document, an import or a text review) or the app prepares something in advance, we create a record in our database. When the request ends, we delete the request content and temporary files. We also delete the answer not yet saved, with one exception: if the lesson was generated but question checking became unavailable, we keep a private copy of the lesson and the necessary study context (such as topic, objective and step) so you can try to finish checking without generating the same lesson again. This copy is not presented as a ready lesson. It and the request record (type, status, dates and any error code) are removed by daily cleanup after 30 days from the original request, or earlier with account deletion. Trying again does not renew this period.

Study imports

The files of an import are deleted as soon as you confirm or discard it, or 24 hours after the preview. The import record (dates, counts and which learning paths it created, with no content) is kept while your account exists and is deleted with it.

Sessions prepared in advance

A session the app prepared in advance that you did not open stays invisible to you and is deleted after 14 days, or earlier if the learning path changes so that it no longer fits or stops being active. The cost record of that preparation, with no content, is deleted 90 days after it is settled.

Photos, voice recordings and PDFs

Photos and voice recordings are not stored by us. A PDF stays in our database only while its import is in progress and is deleted as soon as it ends; it goes to the AI provider only to extract its text and is deleted there right afterwards; if that deletion fails, the provider erases the file automatically within 1 hour. We keep only the extracted text, in our database.

At the AI provider

Up to 30 days for abuse monitoring, unless the law requires otherwise, under OpenAI's terms.

At the email service

Delivery logs for the period set by the plan we subscribe to with Resend. We don't store the content of emails: the reset link is recorded only as an irreversible code.

Server logs

For a short time, with automatic rotation, only for security and troubleshooting.

Password reset links

Valid for 30 minutes and work only once.

Legal obligations

Apart from the cases above, we only keep data after deletion where the law allows it, such as to comply with a legal obligation or exercise rights in legal proceedings (LGPD art. 16).

The LGPD (art. 18) guarantees you, at any time and free of charge:

1. confirmation that we process your data;
2. access to your data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
5. portability of your data to another provider;
6. deletion of data processed with your consent, except where the law provides otherwise (art. 16);
7. information about who we share your data with;
8. information about the possibility of not consenting and the consequences of refusing;
9. withdrawal of consent (see how);
10. objection to processing that breaches the LGPD (art. 18, §2);
11. review of decisions made solely by automated means (art. 20).

How to exercise them

Email contact@webest.com.br from the address registered to your account, or use the form on the help page with that same address, saying which right you want to exercise. We may ask for a confirmation to make sure it's you. Confirmation and access in simplified form are provided immediately whenever possible; a complete statement, within 15 days (art. 19).

Several actions you can take yourself in the app: delete notes and folders, remove goals from a learning path, disable shared links, withdraw your AI consent and delete your account.

When we correct or delete data at your request, we notify the processors that received it, where applicable (art. 18, §6).

If you feel we didn't resolve your request, you can file a petition with the ANPD and contact consumer protection bodies.

You can delete your account at any time, right in the app: “Perfil → Excluir conta” (Profile → Delete account). For security, we ask you to confirm with your password.

• Deletion is immediate and permanent: it erases your account and your study content, such as learning paths, sessions, progress, notes, materials, reviews, pronunciation-analysis results, conversations, documents, consents and sharing links.
• All open sessions are signed out, and the links to paths you shared stop working.
• Two records are not deleted but anonymized, with no link to the account, no name and no email: the AI credit usage history, kept for cost control, and the reports you made, kept for moderation along with the free text you wrote in them.
• Access logs are kept for 6 months, as required by Brazil's Marco Civil da Internet, and then deleted automatically.
• Backups that still hold your data are deleted automatically within 14 days.
• It cannot be undone. If you want a copy of your data, ask for it first through the contact email.

No access to the app? Request deletion at contact@webest.com.br from the address registered to your account. We confirm it's you, complete the deletion within 15 days and email you when it's done.

Copies other people made of a path you shared belong to them and don't carry your name, your progress or your account data.

• Encrypted connections (HTTPS/TLS) between the app, our servers and the processors.
• Passwords stored only as bcrypt hashes, never as text.
• Sessions with short-lived tokens; refresh tokens are rotated, stored only as hashes and can be revoked.
• On your device, your credentials live in the system's secure storage (Keychain on iOS, Keystore on Android).
• Rate limits on login and other sensitive actions.
• Internal access restricted to those who need it, with one-time code sign-in.
• Daily database backups, in Brazil, with restricted access.
• Access logs cannot be looked up from the app or from our internal dashboard; they only come out under a court order.

No system is 100% secure. If a security incident occurs that may bring you relevant risk or harm, we will notify you and the ANPD, as the LGPD requires (art. 48).

WeBest is for people aged 13 and over. It is not intended for children, who under art. 2 of Brazil's Child and Adolescent Statute (ECA, Law no. 8,069/1990) are people under 12, nor for 12-year-old adolescents.

At sign-up, we ask for your date of birth and don't accept anyone who states they are under 13. If we learn that an account belongs to someone under 13, we delete it.

Teenagers aged 13 to 17 should use WeBest with the knowledge and permission of a parent or legal guardian, who should read this policy together with the teenager. The app shows this notice at sign-up.

We always process teenagers' data in their best interest (LGPD art. 14), mindful of Brazil's Digital Statute of Children and Adolescents (ECA Digital, Law no. 15,211/2025). In practice: we collect only what is needed; the date of birth is used only to check age and is never shown to anyone; we show no ads and build no advertising profiles; and sharing learning paths is optional and off by default.

Parents and guardians can request access to, correction or deletion of a teenager's data, or tell us about an account belonging to someone under 13, at contact@webest.com.br.

This website uses no cookies, analytics tools or tracking pixels. Fonts are served from our own server, with no third-party calls. The server logs technical access data, such as the IP address, for security.

In the app, we use no advertising identifiers, third-party analytics tools or cross-app tracking. The app only keeps on your device what it needs to work, such as your session credentials (in secure storage) and your preferences.

We may update this policy when the service or the law changes. The version date is at the top of the page.

If a change is relevant, for example to the purposes, the form or duration of processing, the controller or data sharing, we will notify you in advance through the app or by email, highlighting what changed. If it requires new consent, we will ask for it before applying the change.

Controller

Caterina Boff Costa LTDA, CNPJ 68.564.652/0001-92, WeBest brand. Address: Estrada Tenente Marques, 6765, Santana de Parnaíba - SP, CEP 06530-001, Brazil.

Data protection officer (DPO)

Caterina Boff Costa, at contact@webest.com.br. The encarregado is the person who receives your requests and complaints, deals with the ANPD and guides our team on data protection (LGPD art. 41 and ANPD Resolution CD/ANPD no. 18/2024).

Email

contact@webest.com.br, for questions, requests about your data, reports and complaints.

Help

Form for questions, requests and reports on the help page.

Authority

National Data Protection Authority (ANPD).