Privacy Policy

1. Data We Collect

To operate the Platform effectively, we collect information you provide directly and information generated automatically during your use.

2. Legal Bases for Processing

We map each processing purpose to a specific legal basis under LGPD Article 7, rather than relying on a single blanket justification:

• •Contract performance: creating and maintaining your account, delivering core Platform features, and processing payments for paid plans.
• •Legitimate interest: fraud prevention, platform security, service improvement, and aggregate analytics, balanced against your fundamental rights and freedoms.
• •Consent: AI-powered feature usage (Interview Coach), marketing communications where applicable, non-essential cookies, and any processing of sensitive personal data you choose to share.
• •Legal obligation: tax, accounting, and financial recordkeeping requirements, and responses to lawful requests from competent authorities.

3. How We Use Your Data

• •Service Delivery & Improvement (contract performance): To enable profile creation, connections, search tools, internal communications, AI-powered features, and technical support.
• •Experience Personalization (legitimate interest / consent): To recommend relevant content, connections, job openings, or opportunities aligned with your professional profile.
• •AI Feature Operation (consent): To generate personalized interview questions, process responses, produce coaching feedback and scores, and track session progress. All AI processing is automated — see Section 4.
• •Security & Fraud Prevention (legitimate interest): To monitor suspicious activity, combat abusive practices such as scraping bots and spam, and ensure the integrity of the Connexage community.
• •Analytics & Platform Improvement (legitimate interest): We use Google Analytics 4 and similar tools to understand aggregate usage. Analytics data is pseudonymized and used only for product improvement.
• •Legal & Regulatory Compliance (legal obligation): To meet applicable obligations under LGPD, VCDPA, CCPA, and other laws, respond to lawful requests from authorities, and protect the rights of the Platform and its users.

4. Automated Decision-Making — Interview Coach

The Interview Coach uses automated processing to score your practice responses and generate feedback (STAR and CRIA frameworks). No human reviews these scores unless you ask us to.

Consistent with LGPD Article 20 and equivalent principles under U.S. state law, you have the right to:

• •Request a clear explanation of the criteria and logic used to generate your Interview Coach score or feedback.
• •Request human review of any automated score or feedback you believe is inaccurate or unfair.
• •Understand that Interview Coach output is a practice tool only — it is never shared with employers, does not determine your visibility to employers, and is not used by Connexage to make hiring, ranking, or eligibility decisions about you.

To exercise these rights, contact info@connexage.com with the subject line “Interview Coach Review.”

5. International Data Transfers

Connexage operates across Brazil and the United States. Your personal data may be transferred between these jurisdictions in the course of providing our services. Such transfers are conducted in accordance with:

• •LGPD Article 33: transfers occur only to countries or organizations providing adequate data protection, or under specific mechanisms including the standard contractual clauses approved by the ANPD (Resolução CD/ANPD nº 19/2024), and explicit user consent where required.
• •For transfers from Brazil to the United States, we rely on the ANPD-approved standard contractual clauses referenced above and, where applicable, your explicit consent collected at account creation.
• •All international recipients of your data, including AI processing partners and infrastructure providers, are contractually required to maintain protections equivalent to those described in this Policy, regardless of the country in which they operate.

6. Sharing of Information

Your personal data will only be shared in the following strictly defined circumstances:

• •Public Profile Visibility: Information you choose to include in your public profile is visible to other Platform users in accordance with your privacy settings.
• •Service Providers & Partners: Third-party companies contracted to support our technology infrastructure, data hosting, security, payment processing, and analytics, all under strict confidentiality and data protection agreements.
• •AI Processing Partners: Our AI features are powered by third-party AI providers under data processing agreements that restrict use of your data to service provision only.
• •Legal Obligations or Rights Defense: When required by government authorities, court orders, or to cooperate with legitimate legal investigations. We will notify you of such requests where legally permitted.

We do not sell, rent, or trade your personal data to advertisers or data brokers under any definition of sale, including those under the CCPA and VCDPA.

7. Security & Data Retention

We employ technical, physical, and organizational safeguards including encryption of data in transit (TLS) and at rest, strict access controls, and regular security assessments.

Data is retained only as long as necessary for the purpose for which it was collected, or as required by law:

• •Active account data: Retained for the duration of your account.
• •Account data after deletion: Retained for up to 5 years, limited to what is necessary to defend against potential legal claims within applicable statutes of limitations in Brazil and the United States, after which it is securely deleted or anonymized.
• •Interview Coach session data: Retained for 2 years from creation or until account deletion, whichever is sooner.
• •Analytics and log data: Retained in pseudonymized form for up to 26 months.
• •Payment records: Retained for 7 years as required by applicable tax and financial recordkeeping regulations in Brazil and the United States.

8. Data Breach Notification

If we become aware of a security incident that creates a relevant risk or harm to your personal data, we will, consistent with LGPD Article 48 and applicable U.S. state breach-notification laws:

• •Notify the ANPD (for Brazilian users) and/or the relevant U.S. state authorities, as required, within the timeframes required by applicable law.
• •Notify affected users without undue delay, describing the nature of the incident, the data involved, and the measures taken or recommended in response.
• •Take reasonable steps to contain, investigate, and remediate the incident.

9. Your Rights

As a data subject under LGPD, VCDPA, CCPA/CPRA, and applicable U.S. privacy law, you may exercise the following rights by contacting info@connexage.com:

• •Access & Confirmation: Confirm whether we process your data and request access to information we hold.
• •Correction: Correct incomplete, inaccurate, or outdated data via account settings or by contacting us.
• •Deletion: Request deletion of your personal data, subject to legal retention obligations described in Section 7.
• •Anonymization or Blocking: Request anonymization or blocking of unnecessarily processed data (LGPD).
• •Consent Withdrawal: Revoke consent for specific processing purposes without affecting prior lawful processing.
• •Data Portability: Receive your data in a structured, commonly used format where technically feasible.
• •Opt-Out of Sale / Sharing: Opt out of any sale or sharing of your personal information under CCPA, CPRA, and VCDPA. We do not engage in such activities, but you may exercise this right at any time — see Section 11.
• •Right to Limit Use of Sensitive Personal Information: Under the CPRA, direct us to limit the use of any sensitive personal data you have voluntarily shared to what is necessary to provide the Platform. We do not use sensitive personal data for any purpose beyond service delivery.
• •Explanation & Review of Automated Decisions: As described in Section 4, request an explanation of, or human review of, automated scoring generated by the Interview Coach.
• •Right to Appeal: If we deny a request described in this Section, you may appeal our decision — see Section 12.
• •Non-Discrimination: You will not be discriminated against, including through denial of service, a different price, or a different quality of service, for exercising any of your privacy rights.

10. Verifying Your Identity

To protect your data from unauthorized access, we will take reasonable steps to verify your identity before fulfilling a rights request, which may include confirming details tied to your account or asking you to submit the request from your registered email address. If we cannot verify your identity to a reasonable degree of certainty, we may decline the request or ask you for additional information. Requests may be submitted free of charge up to twice within a 12-month period.

11. Do Not Sell or Share My Personal Information

Connexage does not sell or share (as defined under the CCPA/CPRA) personal information, and we do not use it for cross-context behavioral advertising. We nonetheless honor the following mechanisms for users who wish to make an affirmative opt-out request:

• •A “Do Not Sell or Share My Personal Information” link available in the Platform footer and cookie consent center.
• •Recognized Global Privacy Control (GPC) browser signals, which we treat as a valid opt-out preference signal for California users.
• •Requests submitted directly to info@connexage.com.

12. Appeals Process

If we decline to act on a rights request described in Section 9, we will explain the reason for our decision in writing. You may appeal that decision by emailing info@connexage.com with the subject line “Privacy Appeal” within a reasonable time after receiving our decision.

• •Virginia (VCDPA) users: we will respond to your appeal within 60 days of receipt. If we uphold our original decision, we will provide information on how to submit a complaint to the Virginia Attorney General.
• •California (CCPA/CPRA) users: we will respond to your appeal within 45 days of receipt (extendable by an additional 45 days where reasonably necessary). If we uphold our original decision, we will provide information on how to submit a complaint to the California Privacy Protection Agency.
• •Brazil (LGPD) users: if you are not satisfied with our response, you may lodge a complaint directly with the Autoridade Nacional de Proteção de Dados (ANPD) — see Section 15.

13. Response Timelines

Because response timelines differ by law, we apply the following framework depending on where you reside:

14. Cookies & Tracking Technologies

We use cookies and similar technologies categorized as follows:

• •Strictly Necessary: Required for Platform functionality. Cannot be disabled.
• •Functional: Remember your preferences and language settings. Disabled at your option.
• •Analytics: Help us understand usage patterns via Google Analytics 4. Disabled at your option.
• •Marketing: Currently not used. We do not serve advertising through the Platform.

For Brazilian users, non-essential cookies (functional and analytics) are only activated after you provide opt-in consent through our cookie consent center. Manage cookie preferences through your browser settings or our in-Platform cookie consent center, accessible at any time from the Platform footer. We also recognize Global Privacy Control signals as described in Section 11.

15. Minors

The Platform is not directed at individuals under the age of 18 and does not knowingly collect personal data from minors. If you are under 18, you may not register or use the Platform.

For U.S. users, we comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13. For Brazilian users, we recognize the distinctions drawn by the LGPD and the Estatuto da Criança e do Adolescente (ECA) between crianças (children under 12) and adolescentes (12–17), and any processing of data belonging to an adolescente who has exceptionally accessed the Platform would require verifiable parental or legal guardian consent under LGPD Article 14.

If we become aware that we have collected data from a minor without required consent, we will delete such data promptly. Contact info@connexage.com if you believe a minor has registered.

16. Data Protection Officer (Encarregado)

In accordance with LGPD Article 41, Connexage has appointed a Data Protection Officer (Encarregado) responsible for overseeing compliance with this Policy and acting as the point of contact between Connexage, data subjects, and the ANPD:

• •Email: info@connexage.com

17. Regulatory Complaints

In addition to contacting us directly, you have the right to lodge a complaint with the data protection authority in your jurisdiction:

• •Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — www.gov.br/anpd
• •Virginia: Office of the Attorney General of Virginia, Consumer Protection Section
• •California: California Privacy Protection Agency (CPPA) — www.cppa.ca.gov

18. Changes to This Policy

We may update this Privacy Policy as new features are developed or as regulatory requirements evolve. Whenever a material change occurs, you will receive a prominent notice on the Platform or via email before the change takes effect, and where required by law we will seek your explicit re-consent prior to processing under new terms.