Privacy Policy
Effective October 26, 2026.
This Policy explains how QI Agora handles personal data, in line with Brazil's General Data Protection Law (Law No. 13,709/2018, LGPD). The data controller is NotifyPay Ltda (QI Agora is a NotifyPay product), a Brazilian company registered under CNPJ 69.633.968/0001-51, based in São Paulo, Brazil.
1. What data we collect
| Data | When | What for |
|---|---|---|
| Date of birth | When starting the test and creating the account | Confirm you are 18 or older |
| At the end of the test | Confirm your identity, create the account, send codes and service notices | |
| Name | When creating the account | Certificate and account identification |
| Phone (optional) | When creating the account, if you want | Contact about your account |
| Answers, times and result | During the test | Calculate and show your result, answer key and report |
| Attention signals (leaving the screen, copy attempts) | During the test | Security and fraud prevention |
| IP address (stored as an irreversible code, a "hash") and browser type | When using the site | Security, rate limiting and fraud prevention |
| Approximate country (from the IP, not stored) | On your first visit | Show the site in Portuguese or English |
| Purchase data (product, amount, status) | When buying | Unlock the product and meet tax obligations |
| Browsing statistics | Only if you accept analytics cookies | Understand how the site is used and improve it |
We do not collect your card details: payment happens on Mercado Pago's page. We don't ask for ID documents, photos or precise location.
2. Legal bases
- Performance of a contract (art. 7, V): running the test, creating the account, showing the result, unlocking purchases and issuing the certificate.
- Legitimate interest (art. 7, IX): security, fraud prevention, the 1-free-test-per-email limit, language detection and test improvement (statistical calibration with aggregated data).
- Legal obligation (art. 7, II): keeping payment and access records for the period required by law.
- Consent (art. 7, I): analytics cookies and the optional phone number. You can withdraw consent at any time.
3. Who we share it with
We use providers that process data on our behalf (processors), only to make the service work:
- Supabase: database, sign-in and server functions;
- Vercel: website hosting;
- Cloudflare: anti-bot check (Turnstile);
- Brevo, Mailjet and Resend: sending emails with codes;
- Mercado Pago: payment processing;
- Google Analytics: statistics, only if you accept.
Some of these providers store data on servers outside Brazil. In these cases, the transfer follows art. 33 of the LGPD, with providers that adopt adequate protection clauses and standards. We do not sell personal data. We may share data with authorities when the law requires.
If you share your result, the public image and link only show the estimated IQ, the range and your name as you chose it. The public certificate page only shows your first name and the initial of your last name.
4. How long we keep it
- Tests not linked to an email: automatically deleted after 30 days.
- Account data, tests and results: while the account exists.
- Payment records: for the period required by tax law (usually 5 years), even if the account is deleted, without any link to it.
- Irreversible code of an email that already used the free test: kept to prevent repeated use of the free test.
- Audit and access logs: up to 12 months.
- Codes sent by email: deleted after 7 days.
5. Your rights
Under art. 18 of the LGPD, you can request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; deletion of data processed with consent; information about sharing; and withdrawal of consent. If you live in a country with its own data protection law (such as the GDPR), you may also exercise the rights it gives you.
In My tests you can yourself: correct your name and phone, download all your data and delete your account. For other requests, use the form on the Your data page. We reply within 15 days. You can also complain to Brazil's National Data Protection Authority (ANPD) or to your local authority.
6. Security
We use encrypted connections (HTTPS), hashed passwords, server-only database access, bot protection, rate limits and two-step verification for administration. No system is 100% invulnerable; if an incident creates a relevant risk, we will notify the people affected and the ANPD, as the law requires.
7. Minors
QI Agora is only for people aged 18 or older. We do not knowingly collect data from minors. If you become aware of such a case, let us know through the form so we can delete the data.
8. Data protection officer
QI Agora's data protection officer can be contacted through the form on the Your data page.
9. Changes
This policy may be updated. The current version is always here, with the date at the top.