Privacy Policy of the Tuca Platform
General Data Collection
The priority of SEMEIA LAB SERVIÇOS LTDA., a company registered under CNPJ (Brazilian company registration number) No. 66.940.215/0001-09, headquartered at Rua Visconde de Inhaúma, nº 134, Sala 2001 – Parte, Rio de Janeiro/RJ, CEP (postal code) 20.091-901, provider of the services made available under the Tuca brand (“SEMEIA LAB”), is to ensure the privacy and security of the information of users and visitors (“User”). SEMEIA LAB is the controller of the personal data processed within the operations that it determines for the website https://tuca.guide, the conversational web app, the personal guide on the web, and the acquisition and use of the Tuca Pass, Carnival Pass, Bundle and add-ons offered (“Platform”). Tuca is a brand of SEMEIA LAB.
SEMEIA LAB collects, uses and shares personal data for the purposes described in this Policy, in accordance with the legal basis applicable to each processing activity. Acceptance of this Policy and use of the Platform constitute consent to collection, sharing or other operations. Where consent is the appropriate legal basis, it may be revoked through the channels made available. The LGPD (Lei Geral de Proteção de Dados, the Brazilian General Data Protection Law) applies under the terms of its scope of application, and the General Data Protection Regulation of the European Union (“GDPR”) will also be observed where applicable.
SEMEIA LAB may update this Policy to reflect changes in the services and in the processing of data. Relevant changes will be communicated through the official channels and identified by the update date, with prior notice where appropriate.
1 - Registration
Registration and the provision of information enable use of the Platform’s tools. The data necessary for the chat, for PASS management and for the purchase will be processed for the performance of the contract or of preliminary procedures requested by the data subject. This Policy also covers website visitors, users of free access, persons on the waiting list, and persons who submit requests or FEEDBACKS. Sharing with suppliers will take place to the extent necessary for the purposes stated and the applicable legal basis. In selecting these suppliers, SEMEIA LAB will assess the conditions of processing, security and data protection and will distinguish their role as processors or independent controllers.
To become a User, a valid email address will be requested, used to send the personal login link, without the creation of a Platform password of its own. On purchase, name, email, the PASS acquired, the date of purchase and the payment status will be processed, together with the data necessary for invoicing. Complete card information and the security code are provided directly to the payment services provider and are not available to SEMEIA LAB. The web app works in the browser and can be added to the home screen of a compatible device.
Where the User enters personal data of third parties in a question, comment or request, the User must limit this to what is necessary and have a legal basis and authorization where required. The Platform is not intended for the collection of third-party data or for the disclosure of personal information among Users. The User must not send passport data, identity documents, card data, health data or other unnecessary sensitive information. SEMEIA LAB will remain responsible for the processing operations it carries out and will adopt the appropriate measures if it receives excessive or inappropriate information.
Additional information may be provided during use of the chat, in support requests or in the rating and comment tools. There is no public profile, member directory or conversation between Users. Questions, answers and FEEDBACKS are not automatically displayed to other Users. Access to the account takes place through an individual link sent to the registered email; this link, the session tokens and the private address of the guide must be protected against unauthorized access. The User may request access, correction and deletion of their data in accordance with applicable law and Section 3. Revocation of consent will stop the processing that depends on that basis, without preventing the retention of data on an independent legal ground and for a legitimate purpose. The retention of previous versions of registration data will depend on concrete necessity and on the criteria of Section 6, and is not carried out indiscriminately.
SEMEIA LAB uses email authentication and confirmation mechanisms to protect access and relevant changes to the account. To keep the session active and allow the web app to load, technically necessary data may be stored on the device, such as the login session and application files. This storage is not intended for advertising or commercial tracking. Control of sessions and authenticated devices may be used for security and for verification of the PASS device limit, with due regard to necessity.
The User undertakes to notify SEMEIA LAB immediately at the email tuca@semeialab.com.br of unauthorized use of the account, compromise of the email or of the login link, and improper access to the guide or to sessions. The User must protect their email, device and credentials and not share them. SEMEIA LAB may invalidate sessions and carry out proportionate checks to restore access.
2 – Personal information collected by SEMEIA LAB
The website does not use advertising tracking cookies. The audience measurement described in this Policy is carried out with Umami Analytics, without cookies, and SEMEIA LAB receives aggregated results. In the web app, there is storage strictly necessary for authentication and operation. In the stripe.com payment environment, Stripe may use cookies that are technically necessary for security and fraud prevention, in accordance with its own policy. The absence of cookies does not, on its own, mean the absence of processing of technical data. Any introduction of optional cookies or technologies will require prior information, identification of purpose, supplier and duration, and consent or another valid legal basis, in accordance with applicable law. The User may manage storage through the browser; disabling essential features may impair login or operation.
In addition to the information provided directly by the User, SEMEIA LAB processes: (i) on visits to the website, IP address, browser and time in the server logs; (ii) in the chat, authentication email, messages, answers associated with the conversation, date and time, and sessions of connected devices; (iii) in PASS control, type, start and expiry dates and the number of free questions used; (iv) in the “thumbs down”, the question rated, a short excerpt of the answer, language and time; (v) in the profile FEEDBACK form, written text, language, application version, time and technical device identifier stored only as a hash; (vi) in requests by email, the content of the message and data necessary for the reply; and (vii) on the waiting list, email, interest in the Tuca Pass, Carnival Pass or both, and sign-up and confirmation times. Positive ratings (“joinha” or “thumbs up”), when made available, will record the rating and the data strictly necessary for the functionality, the identification of the answer rated, the language and the time, retained for the period provided for FEEDBACKS in Section 6. Hashes and other identifiers will remain subject to data protection if they make it possible to single out or re-identify the data subject.
SEMEIA LAB may share personal data with suppliers of artificial intelligence, hosting, storage, backups, delivery and protection network (DNS, proxy and email forwarding), audience measurement, payments, FEEDBACK organization and email sending, only to the extent necessary for the purposes stated. The identification, function, role, categories of data, places of processing and retention criteria are set out in Sections 3 and 6. Suppliers will be processors when they act under the instructions of SEMEIA LAB; any role as independent controllers will depend on the activity actually carried out, as may occur with Stripe. Sharing may also take place for compliance with a legal obligation, a court order or the regular exercise of rights, respecting the legal requirements for access to records and private communications. Acceptance of this Policy is not an unrestricted authorization for disclosure.
SEMEIA LAB may examine records and information in a limited manner to identify multiple accounts created to circumvent limits, to prevent fraud and abuse, to protect authentication and to investigate incidents, provided that the processing is necessary, proportionate and supported by an appropriate legal basis. The FEEDBACK form adopts a per-device limit to prevent abusive use, by means of the hashed technical identifier described above, without this automatically turning the data into anonymous data. Disclosures to authorities will take place within the limits of a valid order and of applicable law, including with a court order when required, without depending on generic authorization from the User.
SEMEIA LAB adopts physical, administrative and technical safeguards proportionate to the risks to protect personal data against unauthorized access, use, loss, alteration or disclosure. Transmission uses HTTPS, and access to conversations is restricted to the members of the team who need it to provide the services, support, security and the other purposes stated, as well as to the processors strictly necessary for the performance of their functions. SEMEIA LAB requires appropriate measures from its suppliers and will take the appropriate legal steps in the event of an incident, including assessment and notifications to the authority and to data subjects when required.
3 – Purposes, legal bases and sharing of data by SEMEIA LAB
SEMEIA LAB may use browsing data for statistics and improvement of the Platform, within the limits of the purposes, legal bases and safeguards of this Policy. Aggregated data will only be considered anonymous if it does not allow identification or re-identification by its own means or reasonable efforts. Pseudonymized data or technical identifiers do not automatically lose the status of personal data. Use of the Platform does not authorize unrestricted use of the information nor replace specific consent for activities that depend on it.
Personal information will be used to enable the User’s direct interaction with the AI, the account, the personal guide, the PASS and payment. The performance of these necessary activities is based on contractual performance, under art. 7, V, of the LGPD and, where applicable, Art. 6(1)(b) of the GDPR. Mandatory collection will be limited to the necessary data, and failure to provide it may prevent the functionality that depends on it, without affecting services that can be provided independently.
In addition, the information will be used to: (i) administer and authenticate the account, control the validity and type of the PASS and make the web guide available, on a contractual basis; (ii) send login links, confirmations and operational communications, on a contractual or relevant legal basis; (iii) prevent fraud, ensure security, assess FEEDBACKS and correct or improve the knowledge base and the application, on the basis of legitimate interest, where compatible with the necessity, expectations and rights of the data subject; (iv) measure audience and clicks on partner links, within the limits of Section 3.1, on the basis of legitimate interest; (v) send waiting list and launch messages upon consent; and (vi) comply with valid orders and regularly exercise rights with the corresponding legal basis. Legitimate interest will observe art. 7, IX, of the LGPD and, where applicable, Art. 6(1)(f) of the GDPR, with assessment of the safeguards. It will not be used as a generic basis for sensitive personal data.
The data subject may exercise, through the channel tuca@semeialab.com.br, in accordance with applicable law, the rights of confirmation and access, correction, information on sharing, anonymization, blocking or deletion of unnecessary or excessive data or data processed unlawfully, portability within the legal limits, deletion of data processed on the basis of consent where applicable, revocation of consent, and information on the consequences of refusing it. The data subject may object to processing carried out without consent in case of non-compliance with the LGPD. Where the GDPR applies, the data subject may also request restriction and object to processing based on legitimate interest, under the legal conditions, and exercise the other rights under that regime. Revocation does not affect prior lawful processing. SEMEIA LAB will assess requests and the legal grounds for retention and will inform of any impossibility of compliance with a justification, without requiring the waiver of rights.
To request closure of the account, blocking or deletion of data, the User may use the functionality available in the profile, when enabled, or send a request to tuca@semeialab.com.br. The email channel also allows requesting a copy of the data and clarifications, without the need for a specific portal. SEMEIA LAB may verify identity by proportionate means, avoiding unnecessary documents, and will inform of the effects of closure on access. The response period and the retention grounds will observe Sections 6 and 7. Requests for rights do not depend on sending FEEDBACK, on a positive rating or on the purchase of a PASS.
3.1 – Audience measurement and partner clicks. Umami Analytics, of Umami Software, Inc., measures website traffic, use of the web guide and clicks on partner links in the application, without cookies. SEMEIA LAB receives aggregated numbers, such as pages accessed, country, device type and clicks on buttons. For partner links, the partner, the type of link activated, the device type, the screen dimensions and the language are recorded; the User’s email and the User’s questions to the chat are not sent to Umami for this count. The processing has the purpose of assessing and improving the Platform and demonstrating to partners the volume of referrals, on the basis of legitimate interest and data minimization safeguards. According to the supplier, there are servers in the European Union and in the United States, by virtue of the “Hobby” (free) plan contracted, and the retention period is 6 (six) months. When the browser sends the “Do Not Track” signal, the counting of clicks on partner links will be deactivated. Links may contain a campaign parameter, such as “utm_source=tuca”, so that the partner can identify the origin of the visit. The partner’s website may process data according to its own policy; the conversation history will not be transmitted through this parameter.
3.2 – Artificial intelligence and processing of conversations
SEMEIA LAB uses the Claude model, of Anthropic, as AI supplier and processor to generate answers to the User’s questions with the support of a verified local knowledge base. For this purpose, the content of the request and the context necessary for the answer are processed, in accordance with the configuration of the service and the instructions of SEMEIA LAB. The processing may take place in the United States and in other places used by the supplier, subject to the safeguards of Section 3.4. According to Anthropic’s Commercial Terms, applicable to use of the API, Anthropic does not train models on content sent by customers. SEMEIA LAB does not participate in optional data-sharing programs for training. This commitment will be preserved through compatible configurations and contracts, without confusing the analysis of FEEDBACK to correct the base with the training of models.
Answers are generated by AI and may contain errors even with verification of the base. On matters of safety, health and legislation, the User must confirm relevant information with official sources and with professionals or competent authorities. The conversation with the AI does not correspond to human support or to an emergency service. Therefore, no exclusively automated decisions are made that produce legal effects or similarly affect the User. If decision-making processing of this nature is introduced, SEMEIA LAB will provide specific information and ensure the legal rights of review and clarification, where applicable.
Input and output data kept by Anthropic are deleted within 30 (thirty) days, in accordance with the service conditions informed by Anthropic, with exceptions admitted for violation of the usage policies or legal obligation. The copy of the conversations kept by SEMEIA LAB observes its own period in Section 6. Anthropic’s sub-processors are listed at https://www.anthropic.com/subprocessors. Services with their own retention, such as the Batch API (API de lotes) and the Files API (API de arquivos), are an exception to this rule.
3.3 – Sending of emails and waiting list. Brevo, a supplier headquartered in Paris, European Union, acts as processor to send personal login links by email and to manage the waiting list, including confirmation and launch messages. For authentication and operational communications, the recipient’s address, the necessary content and sending records will be processed, on a contractual or relevant legal basis. For the waiting list, email, product of interest and sign-up and confirmation dates are used, with consent and confirmation by email (“double opt-in”). Unsubscription from launch messages may be requested at any time through the link in the message or through the privacy channel, without preventing emails strictly necessary for the account or the performance of the contract. According to information from Brevo, the data are hosted on servers in the European Union (France and Germany, with cloud infrastructure in Belgium). According to Brevo, transactional sending records are retained, by default, without a defined period, and the customer may configure automatic deletion within a period of between 1 (one) month and 5 (five) years. Brevo records delivery, open and click events on messages, used for statistics, spam detection and sender reputation.
3.4 – International transfers. SEMEIA LAB processes data in Brazil and uses suppliers that may process them in Germany, in other countries of the European Union, in the United States and in other jurisdictions, depending on the infrastructure and the applicable contracts. Transfers subject to the LGPD will observe a valid mechanism under art. 33 and the regulation of the ANPD (Autoridade Nacional de Proteção de Dados, the Brazilian national data protection authority), including Brazilian standard contractual clauses when this is the mechanism adopted. Transfers subject to the GDPR will observe adequacy decisions or other valid safeguards, such as appropriate contractual clauses, with assessment and additional measures when necessary. Foreign clauses will not be presumed sufficient to automatically meet Brazilian requirements. The data subject may request, through the channel tuca@semeialab.com.br, information on countries, recipients, mechanisms and a copy of the applicable safeguards, subject to the legal limits. For the European Union, SEMEIA LAB observes the recognition of adequacy of the European Union by the ANPD (Resolução CD/ANPD nº 32/2026, a resolution of the ANPD, art. 33, I, of the LGPD). Transfers to the United States will be carried out on the basis of the ANPD standard contractual clauses (Resolução CD/ANPD nº 19/2024, Annex II) or another mechanism provided for in art. 33 of the LGPD, formalized with each supplier. Where the GDPR is applicable to SEMEIA LAB under its Art. 3(2), a representative in the European Union will be designated, in accordance with Art. 27 of the GDPR.
3.5 – Ratings, comments and organization of FEEDBACK. The User may report a problem or missing content through a “thumbs down” below an answer or through the profile form and, when available, record a “joinha” or “thumbs up”. The data for each modality are described in Section 2. SEMEIA LAB reads the reports to correct failures and improve the knowledge base and the application, on the basis of legitimate interest, within the limits of necessity and the rights of the data subject. The form does not request email and adopts a per-device limit, using an identifier stored as a hash. To obtain an individual reply, the User must write to tuca@semeialab.com.br; not every FEEDBACK will receive an individual reply, without prejudice to the mandatory handling of requests for rights. The team uses Notion, of Notion Labs, Inc., to read and organize FEEDBACKS, without storing the User’s email together with them. This does not guarantee anonymity if the text itself or the associated data allow identification. According to Notion, its Data Processing Addendum forms part of the contract by reference, and Notion acts as processor of the content entered by SEMEIA LAB. The data are stored in the United States, subject to the safeguards of Section 3.4. Only the text of the report, date, answer rated and language are transferred to Notion. Access is restricted to the SEMEIA LAB team responsible for the knowledge base. FEEDBACKS are deleted within the periods of Section 6.2 and, according to Notion, permanently removed from its servers about 30 (thirty) days after deletion. Comments and ratings are addressed to SEMEIA LAB and do not constitute a conversation between Users or authorization for the publication of identifiable testimonials.
3.6 – Hosting and storage. Hostinger hosts the website and processes the technical access records necessary for its delivery and security, as processor of SEMEIA LAB. The contracted entity is HOSTINGER INTERNATIONAL LIMITED, a company headquartered in Larnaca, Cyprus. The website is hosted on a server located in Brazil. The technical access records are kept by Hostinger for the period that it defines for the security and operation of the service; according to Hostinger, this period and the place of storage of these records are not publicly specified. Hetzner, with the application server and database in Falkenstein, Germany, hosts the web app and the personal guide and stores conversations, PASS status and login sessions, as processor, subject to the periods of Section 6. The guide is made available at a private address linked to the PASS. When it is accessed, the server processes IP, time and page requested to deliver the content and prevent abuse; use is also measured by Umami within the limits of Section 3.1. The User must protect this address and its tokens, which must not be included in analytics parameters or shared unnecessarily.
3.6.1 – Cloudflare. Cloudflare, Inc., headquartered in the United States, acts as processor of SEMEIA LAB in the delivery and protection of traffic. For this purpose, Cloudflare manages the DNS of the domain tuca.guide, operates the address app.tuca.guide as a reverse proxy, so that requests to the web app and the personal guide pass through the Cloudflare network before reaching the Hetzner server, and forwards messages sent to the address hello@tuca.guide to the email inbox of Simon Hirter at SEMEIA LAB. In this transit, Cloudflare transiently processes the IP address, the approximate country of origin, the technical headers and the content of requests and responses necessary for delivery, including chat messages; in email forwarding, the sender, the recipient and the content of the message are processed. The processing is for the purpose of delivering the service, security and abuse prevention, on a contractual basis and on the basis of legitimate interest. Cloudflare’s network is global, and the processing may take place on servers close to the User and in the United States, subject to the safeguards of Section 3.4. In the current configuration, no Cloudflare cookies were identified at app.tuca.guide.
3.6.2 – Backups. SEMEIA LAB keeps daily backups of the application database and of the server configuration file, which contains no User data. The database backups cover the data described in Section 2 that exist on the date of the backup, such as account email addresses, conversations, status of the PASSES, device sessions, ratings and comments (with the device identifier only as a hash) and purchase records. The backups are kept for 14 (fourteen) days on the Hetzner server in Falkenstein, Germany, and, encrypted with the tool age before transmission, for 30 (thirty) days at Backblaze, Inc., which acts as processor and stores the encrypted files in a region of the European Union (Amsterdam, the Netherlands); the key that opens them is not held by Backblaze. The purpose is to restore the service in the event of loss or failure of the server, on the basis of legitimate interest in the continuity and security of the service. Data deleted from the active database under Section 6 may remain in the backups until these periods end.
3.7 – Payments. Stripe processes payments and may act as processor or independent controller depending on the activity, including its own obligations regarding security, fraud prevention and compliance. SEMEIA LAB receives the data necessary to identify the purchase and make the PASS available, such as name, email, product, date and payment status, without viewing complete card data. Stripe may process data on infrastructure in the United States, Ireland and other places provided for in its instruments. The SEMEIA LAB account is registered in Brazil, and the contracted entity is Stripe Brasil Soluções de Pagamento – Instituição de Pagamento Ltda., headquartered in São Paulo, SP; Stripe, LLC, of the United States, is also a party for purposes of processing personal data. According to Stripe, transfers of personal data from Brazil observe the Brazilian standard contractual clauses, when required. When it acts as controller, its policy will also apply to the processing under its responsibility. This does not remove the obligations of SEMEIA LAB regarding the sale, support and the operations that it determines.
3.8 – Sharing of answers and external services. If the User activates the button to share an answer via WhatsApp, their device will forward the text to the external service chosen. SEMEIA LAB does not send the data directly to Meta through this command nor use a Meta pixel in the model described in this Policy. The User must check the content and the recipients, especially if there is personal data. From the moment of sharing, the processing carried out by WhatsApp and by the recipients will observe their own conditions, policies and legal obligations. The feature does not create a chat between Users within the Platform. Links to partner services also lead to external environments and do not authorize automatic transmission of email or conversations.
3.9 – Availability and updating of information. The list of suppliers and recipients is an integral part of this Policy and will be kept compatible with the services actually used. Relevant changes of purpose, data, suppliers or conditions will be communicated, with new consent when required. Any introduction of additional operations will depend on its own assessment, an appropriate legal basis and prior information; it is not generically authorized by this Policy.
4 – The obligations of the User
It is the duty of the User to observe the Terms of Use and this Policy, respect intellectual property and the rights of third parties, and provide correct and up-to-date registration data. SEMEIA LAB remains responsible for the lawfulness, transparency, security and other duties relating to the processing that it determines. Awareness of the User’s duties does not constitute a waiver of rights nor transfer to the User risks that are proper to the service provider.
The User must not send to the chat or to the FEEDBACK form unlawful, discriminatory or rights-infringing content, nor enter unnecessary personal information. Legitimate questions about safety, health, prevention or legislation will not be considered unlawful merely because they mention sensitive topics. The Platform is intended for interaction with the AI and for sending ratings and comments to SEMEIA LAB, without a conversation environment between Users. Good-faith critical reports do not prejudice the exercise of rights.
The User must not provide a passport, identity document, complete card data, health data or other unnecessary sensitive information, nor include confidential information of third parties without a legal basis. The User must check the text before sharing an answer outside the Platform and protect email, login links, sessions and the private address of the guide. If the User notices improper sending or unauthorized access, the User must notify SEMEIA LAB for assessment of the appropriate measures. SEMEIA LAB does not use these recommendations to set aside its own duties of protection.
5 – Underage Users
The Tuca Platform is intended exclusively for persons aged 18 (eighteen) years or older. Registration or autonomous use by children or adolescents is not permitted, even where there is authorization from a guardian. Family travel planning by an adult does not require the sending of identifiable information about the minors accompanying them. The User must avoid entering such data when unnecessary.
If SEMEIA LAB identifies the account of a minor or incidentally receives data of a child or adolescent, it will assess the need to restrict access and to delete or take other appropriate measures, with due regard to the best interests and to the legislation. The protection of incidentally received data does not authorize a minor’s account nor remove the responsibilities of SEMEIA LAB. Requests may be forwarded through the privacy channel.
6 – Retention Period and Export of Data
SEMEIA LAB will retain personal data only for the period necessary for the purposes stated, for compliance with legal and regulatory obligations and for the regular exercise of rights, with restricted access. Periods will be differentiated by category, in accordance with the criteria below. Once the need has ended, the data will be deleted or effectively anonymized, subject to legal grounds for retention. A supplier’s period does not determine the period for the copy kept by SEMEIA LAB. Exceptional retention due to legal obligation, security or the regular exercise of rights will be limited to the necessary data, with justification, purpose and access control, without indiscriminate maintenance of the complete history.
6.1 – Conversations kept by SEMEIA LAB. Conversations linked to a PASS acquired will be kept for up to 30 (thirty) days after its expiry; conversations from free access without a purchase will be deleted 30 (thirty) days after the last message. The data subject may request deletion before these milestones, without undue delay after the necessary verifications and subject to legal grounds for retention. These periods refer to the SEMEIA LAB copy, not to Anthropic’s temporary storage. When the User shares an answer, the sharing is done by the User’s own device, through the application chosen by the User; SEMEIA LAB does not transmit the conversation to third parties for this purpose, and deletion by SEMEIA LAB does not reach the shared copies.
6.2 – FEEDBACKS. (i) Messages from the profile form are deleted 30 (thirty) days after the PASS expires; without a PASS, 90 (ninety) days after sending. (ii) “Thumbs down” reports, including the question and the excerpt of the answer, and positive ratings are retained for 12 (twelve) months and then deleted. These periods also apply to the copies organized in Notion; according to Notion, deleted items are permanently removed about 30 (thirty) days after deletion. The data subject may request early deletion, subject to legal grounds.
6.3 – Copies at the AI supplier. Anthropic retains inputs and outputs for up to 30 (thirty) days, with the exceptions of its usage policy and legal obligations described in Section 3.2. The deletion request will also be handled with processors where applicable; SEMEIA LAB does not promise instant deletion of all supplier copies or backups without verification of the routines and of the legal exceptions.
6.4 – Purchases and tax documents. They will be kept for the period required by the applicable tax and accounting rules and for the period necessary for the regular exercise of rights. The retention of tax documents does not impose equivalent retention of all conversations or FEEDBACKS.
6.5 – Access and measurement records. Where the obligation under the Marco Civil da Internet (the Brazilian Internet legal framework) applies, application access records will be kept for the legal period of 6 (six) months, under confidentiality, in a controlled and secure environment, without confusion with retention of the content of communications. Preservations by valid order or on another legal ground will be limited to what is necessary. Aggregated analytical data may only be kept as anonymous if there is no reasonable possibility of re-identification.
Internal records and data from operational emails, including recipient and necessary content, will be kept for the period appropriate to authentication, proof of sending, security and the regular exercise of rights The technical access records to the guide and to the application, kept on the Hetzner server, are retained for 6 (six) months and then deleted automatically. Website access records are kept by Hostinger for the period that it defines, in accordance with the hosting item. Umami data are retained for 6 (six) months, according to the plan contracted. The waiting list will be kept until unsubscription, subject to the limit of 12 (twelve) months after the last email. A minimal unsubscription record may be kept to prevent new promotional sendings, with restricted access and periodic review.
Cancellation of the account does not extinguish the rights of access or of obtaining a copy provided for by law. The data subject may request their available data through the privacy channel, subject to identity verification, protection of third parties and legal limitations. Data already legitimately deleted or irreversibly anonymized may not be recoverable. The deletion request will be processed without undue delay, subject to the permitted grounds for retention, which will be informed to the data subject.
7 – Communication Channel with the User
If the User has a question, suggestion, request or complaint about personal data processed by SEMEIA LAB, the User may write to tuca@semeialab.com.br. The encarregado (the person designated under the LGPD as data protection contact, a data protection officer) for the processing of personal data is Simon Hirter. SEMEIA LAB will assess requests with proportionate identity verification and will provide clear information on the steps taken, without requiring excessive information or payment in the cases of free-of-charge service provided for by law.
7.1 – Response periods. Under the LGPD, confirmation and access will be provided immediately in simplified format or by a clear and complete declaration within 15 (fifteen) days, in accordance with art. 19. Other requests will observe their own legal and regulatory periods, without unjustified delay. Where the GDPR applies, the response will take place without undue delay and within 1 (one) month of receipt; an extension of up to 2 (two) additional months will depend on necessity due to complexity or number of requests, with information and justification within the first month. Shorter periods will be respected when mandatory, and the reasons for any refusal or impossibility of compliance will be informed.
7.2 – Protection in handling. SEMEIA LAB may request elements strictly necessary to confirm that the request concerns the data subject themselves or a duly authorized representative. Copies will be delivered by means appropriate to the security of the data, safeguarding the rights of third parties and trade and industrial secrets within the legal limits. The absence of a public form or of an individual reply to FEEDBACK does not prevent the exercise of rights through the privacy channel.
8 - Right to Lodge a Complaint
If the User considers that the processing by SEMEIA LAB is not in compliance with the legislation, the User may lodge a complaint with the service provider itself at tuca@semeialab.com.br and/or with the competent authority, without any obligation to first exhaust internal handling where the law does not require it. In Brazil, the User may go to the Autoridade Nacional de Proteção de Dados (ANPD); in the European Union, to the competent data protection authority, including that of the country of habitual residence, in accordance with the GDPR. The exercise of these rights will not be conditioned on maintaining an active PASS.
9 – Newsletter
SEMEIA LAB uses the waiting list to send sign-up confirmation and launch information for Tuca products, according to the interest indicated by the User in the Tuca Pass, Carnival Pass or both. Sign-up depends on consent and confirmation by email (“double opt-in”), with sending operationalized by Brevo. The User may revoke consent and cancel the mailings at any time through the link in the messages or through the email tuca@semeialab.com.br. Unsubscription will not prevent communications necessary for authentication, purchase, security or compliance with a legal obligation. The data will observe the periods of Section 6. Waiting list data are deleted after unsubscription or 12 (twelve) months after the last email, whichever occurs first, unless the User acquires a PASS. SEMEIA LAB does not send a newsletter or periodic promotional messages to the waiting list.
Date of last update: 29 October 2026
Service provider and controller: SEMEIA LAB SERVIÇOS LTDA.
Encarregado: Simon Hirter
Email for privacy and exercise of rights: tuca@semeialab.com.br