Privacy Policy

This Privacy Policy explains how PetCred ("the Service") processes personal data. PetCred is operated by a company established in Brazil, and processing is governed by both Brazil's Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018) and, where the Service is offered to or targets individuals in the European Union, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Where both apply, we aim to give you the higher standard of protection.

The data controller (controlador under the LGPD / controller under the GDPR) responsible for your personal data is:

PetCred
CNPJ: 12.345.678/0002-99
Rua Alcebíades Plaisant, Água Verde, Curitiba — PR, 80620-270, Brazil

Full company details are in our Imprint. For any privacy matter you can contact us at support@cred.pet.

Our Data Protection Officer / Encarregado pelo Tratamento de Dados Pessoais is your point of contact for questions about how we handle your data and for exercising your rights:

[TO BE COMPLETED: DPO / Encarregado name]
support@cred.pet

We process the following categories of personal data:

• Account data: your name, email address, and phone number, plus whether each has been verified and the date you accepted these terms.
• Payment data: processed by our payment provider Stripe. We do not store full card numbers; Stripe processes card data as an independent processor/controller under its own terms. We keep the order record, amount, and Stripe reference.
• Assessment data: the open-ended answers you submit, AI-generated evaluations and scores, topic breakdowns, and any personalized course content produced for you.
• Certification records: the credentials issued to you, their serial numbers, issue and expiry dates, and status. Serial numbers, the holder's name, the specialty and the status are shown on a public verification page — that is the purpose of the credential, and you choose whether to share the serial.
• Profile data: optional bio, services offered, and profile photo. These are stored on your account and are not published.
• Shipping data: if you order a printed certificate, the postal address you give us.
• Communication records: a log of which transactional emails we have sent you, so we do not send the same message twice.
• Connection and access logs: technical logs (such as IP address, timestamps, and application access records) that we keep to operate and secure the Service and to comply with Brazil's Marco Civil da Internet (Lei nº 12.965/2014).

We process personal data only for defined purposes and on a valid legal basis under LGPD art. 7 and GDPR art. 6:

• To create your account, deliver assessments, generate courses, issue certifications, ship printed certificates, and send you the transactional emails described in section 7 — performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• To process payments and keep tax and accounting records — compliance with a legal or regulatory obligation (LGPD art. 7, II; GDPR art. 6(1)(c)).
• To verify your phone number and email address, secure accounts, and prevent fraud and abuse — our legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• To send any optional marketing communications — consent (LGPD art. 7, I; GDPR art. 6(1)(a)), which you can withdraw at any time. We do not currently send these.

Your assessment is marked by an AI model, not by a person. The model reads the answers you wrote, scores each one against published criteria for that specialty, and that score decides whether you reach the standard required for the credential. Your answers are also used to write the personalized study course offered to you afterwards.

We are telling you this plainly because it is a decision made about you by automated means, and both frameworks give you rights over that: LGPD art. 20 gives you the right to request a review of a decision taken solely on automated processing that affects your interests, and GDPR art. 22 gives you the right not to be subject to such a decision where it produces legal or similarly significant effects, including the right to obtain human intervention, to express your point of view and to contest the outcome.

In practice: if you believe your assessment was marked wrongly, email support@cred.pet with your account email and the assessment in question and a person will review the result. Every assessment purchase also includes three attempts, and your report shows the score for each topic, so you can see what the evaluation concluded rather than only the final number.

A certification issued through the Service reflects performance on that assessment. It is not a professional licence or an accreditation, and it is not used to make any decision about you beyond whether the credential is issued.

We send transactional email only — messages about something you did or bought. These are part of delivering the service and are not marketing, so they are not sent on the basis of consent and cannot be unsubscribed from individually while you hold an account:

• Confirming your email address, and resetting or changing your password.
• Telling you your assessment results are ready.
• Delivering a course you bought, and telling you when it has finished being prepared.
• Confirming a certification, a renewal, a refund, a revocation, or a printed certificate order and its dispatch.
• Reminding you before a credential expires.
• Telling you if something went wrong with an order you paid for.
• Confirming that your account has been deleted.

Stripe separately sends you the receipt or invoice for each payment, under its own terms. If you no longer want any email from us, delete your account — see section 11.

Free email courses. If you sign up for one of our free courses, we send you one lesson a day for about five days. This is the only email we send on the basis of your consent (Art. 6(1)(a) GDPR, Art. 7(I) LGPD): nothing is sent until you click the link in the confirmation email, and each lesson ends with a short note about the related PetCred certification. We keep your email address, the course, when and to which version of the wording you consented, and which lessons we have sent. We also check whether the same address has bought that program's assessment, so we stop the course once you no longer need it. Every lesson has an unsubscribe link, and mail programs that support it offer a one-click unsubscribe button; unsubscribing stops the course at once and does not affect anything else. You do not need an account to take a course.

We do not sell personal data and we do not share it for anyone else's advertising. We use the service providers below, each of which processes data on our instructions:

We may also disclose data where we are legally required to — for example to a court or a competent authority.

Some storage is strictly necessary to provide the service you asked for, and needs no consent:

• Your sign-in tokens, kept in your browser's local storage so you stay signed in between visits. Signing out removes them.
• Stripe's own cookies on the checkout page, which Stripe uses for fraud prevention under its own policy.
• Your cookie choice itself, so we do not ask again on every page.
• Your progress in the free courses and tools (which lessons you have finished, which checklist items you have ticked), kept in your browser's local storage so you can pick up where you left off. It never leaves your device.

Everything else is optional and set only if you accept in the banner shown on your first visit. Until you do, nothing from Google is loaded at all:

• Google Analytics 4 (Google Ireland Ltd / Google LLC), to understand how people find and use the Service — pages viewed, the free sample questions, sign-ups and purchases. Cookies _ga and _ga_*, kept for up to two years. IP addresses are not stored by Google Analytics 4. We never send it your name, email or answers.
• Google Ads conversion measurement, to know whether an advertisement led to a purchase. Cookie _gcl_au, kept for 90 days.

The legal basis for these is your consent (Art. 6(1)(a) GDPR, Art. 7 LGPD), which you can withdraw at any time from “Cookie settings” in the footer of every page: withdrawing stops the measurement and removes the cookies above. Declining changes nothing about how the Service works. Google processes this data in the United States; the safeguards are described in section 10. Clearing your browser's site data removes everything we store on your device.

We are established in Brazil and use providers that process data outside Brazil and outside the European Economic Area — the table in section 8 lists where each one operates. Of these, the AI provider that evaluates your written answers is the one that matters most to be aware of, and it is currently operated from China.

Where data is transferred internationally, we rely on the appropriate safeguards required by the LGPD (arts. 33–36) and the GDPR (Chapter V), such as adequacy decisions or Standard Contractual Clauses. EU Standard Contractual Clauses (Module Two)

Depending on where you are located, you have rights under the LGPD, the GDPR, or both. In practice we honour the combined set of these rights for all users.

Under Brazil's LGPD (art. 18)

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Data portability to another provider.
• Information about the public and private entities with which we share your data.
• Information about the possibility of refusing consent and the consequences of doing so.
• Deletion of data processed on the basis of consent, and revocation of consent.
• Review of decisions taken solely by automated processing (art. 20) — see section 6.

Under the EU GDPR (arts. 15–22)

• Access to your data and a copy of it (art. 15).
• Rectification of inaccurate data (art. 16).
• Erasure — the "right to be forgotten" (art. 17).
• Restriction of processing (art. 18).
• Data portability (art. 20).
• Objection to processing based on legitimate interests (art. 21).
• Not to be subject to solely automated decisions with legal or similarly significant effects (art. 22) — see section 6.

You can exercise your access and deletion rights directly from your profile page: use Download my data to export a copy of your personal data (access and portability), and Delete my account to permanently erase your personal information and revoke your certificates (erasure / deletion). For any other request, or to revoke consent, contact us at support@cred.pet or our Support page.

Deleting your account is irreversible and revokes any certification you hold, which will then show as revoked to anyone who checks its serial number. If you only want to stop receiving email, say so instead and we will help.

We keep account, assessment, and profile data for as long as your account is active. Certification records may be retained for the validity period of the credential and as needed for verification. Invoicing, payment, and connection/access-log records are kept for the periods required by applicable tax, accounting, and consumer-protection law (including the Marco Civil da Internet for access logs) — 5 years after account deletion (Brazilian tax law). For a free email course, we keep your address and consent record while the course runs and afterwards as proof of consent and so that you are not signed up twice; you can ask us to erase it at any time. When you delete your account, personal data is erased or anonymized except where we are legally required to retain it.

Traffic to and from the Service is encrypted in transit (HTTPS). Passwords are stored only as salted bcrypt hashes and cannot be read by us or recovered — which is why a forgotten password is reset rather than sent to you. Password-reset and email-confirmation links are stored only as hashes, are single-use, and expire. Card details never reach our servers.

No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and the competent authority where the law requires it.

If you believe your data is being handled unlawfully, you may lodge a complaint with the competent authority:

• Brazil: the Autoridade Nacional de Proteção de Dados (ANPD).
• European Union: the Data Protection Authority of your country of residence, work, or the place of the alleged infringement.

We would appreciate the chance to address your concern directly before you do so.

For any privacy question or to exercise your rights, contact our DPO / Encarregado (see section 3), email us at support@cred.pet, or use our Support page.