Privacy Policy

1. Introduction and Scope

Last updated: July 2026.

This Privacy Policy explains how SA Educação e Tecnologia LTDA ("Pluma," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the Pluma platform at plumaedu.com (the "Service"). It applies to teachers, educators, and other visitors and account holders.

The United States does not have a single comprehensive federal privacy law. Instead, our practices are informed by a combination of federal laws — including the Federal Trade Commission Act, the Children's Online Privacy Protection Act ("COPPA"), and the Family Educational Rights and Privacy Act ("FERPA") — and state privacy laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and comparable laws in other states.

By using the Service, you acknowledge this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account and registration data: your name, email address, password, professional role or institution, and the preferences you provide when you create an account or contact us.

Payment data: when you subscribe, payments are handled by Stripe. Stripe collects and processes your payment details (such as card information, or Pix data in Brazil) directly; we receive only limited information such as billing status, the last four digits of your card, and transaction identifiers. We do not store full payment card numbers.

Usage and device data: information about how you interact with the Service, such as pages viewed, resources accessed, tools used, log data, IP address, browser and device type, and approximate location derived from IP address. We collect this through cookies and similar technologies and through analytics.

Content you provide: text and prompts you enter into the AI tools and any content you upload. We ask that you not enter students' sensitive personal data (see "Children's and Student Data" below).

3. How We Use Your Information

To provide, operate, maintain, and improve the Service, including delivering the resource library and generating the AI drafts you request.

To create and manage your account, process your subscription and payments, provide the free trial, and send transactional and service-related communications (for example, through our email provider, Resend).

To understand usage and improve performance, security, and features; to provide support; to detect and prevent fraud and abuse; and to comply with legal obligations and enforce our Terms.

With your consent where required, to send marketing communications; you can opt out at any time.

4. Legal Framework for Processing

Because the U.S. has no single federal privacy statute, we rely on the framework described above rather than the "legal bases" concept used in some other countries. Where state law applies, we process personal information as needed to provide the Service you request, for our legitimate business purposes (such as security, analytics, and product improvement) consistent with those laws, to comply with legal obligations, and with your consent where required (for example, for certain marketing or non-essential cookies).

We do not "sell" personal information for money, and we do not knowingly "share" it for cross-context behavioral advertising as those terms are defined under CCPA/CPRA. If this changes, we will update this Policy and provide any opt-out required by law.

5. How We Share Information

Service providers (processors): we share information with vendors that process data on our behalf under contract, including Stripe (payment processing), Google / Firebase and Google Cloud (hosting, database, and storage), and Resend (transactional email). These providers are authorized to use the information only to provide services to us.

Analytics: we use Google Tag Manager to deploy analytics and measurement tags, which may involve Google and related services processing usage data as described below.

Legal and safety: we may disclose information to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of Pluma, our users, or others. We may also transfer information in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Cookies and Analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and measure and improve performance. We deploy tags through Google Tag Manager, which may load analytics services that set their own cookies.

You can control cookies through your browser settings and, where offered, through our cookie banner or preference tool. Blocking some cookies may affect how the Service works. Where required by law, we obtain your consent for non-essential cookies.

7. Your Privacy Rights

Depending on your state of residence, you may have the right to: access or obtain a copy of your personal information; correct inaccurate information; delete your information; opt out of the sale or sharing of personal information and of certain targeted advertising or profiling; and to not be discriminated against for exercising these rights.

California residents (CCPA/CPRA) have the rights above, including the right to know, delete, correct, and limit the use of sensitive personal information, and may designate an authorized agent. Residents of other states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and Texas, among others) have similar rights, including, in many states, the right to appeal the denial of a request.

To exercise your rights, contact us at [email protected]. We will verify your request as required by law and respond within the timeframes the applicable law provides. Where your state law provides for appeals, you may also appeal our decision.

8. Children's and Student Data

The Service is designed for adult education professionals and is not directed to children, and we do not knowingly collect personal information directly from children under 13 in violation of COPPA. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

Pluma is a tool for teachers. We ask that you practice data minimization and not enter students' personal or sensitive information into the Service, including the AI tools. Use anonymized references such as "Student A" or initials. As the educator, you decide what data to input, and you are responsible for that data and for complying with FERPA, COPPA, your school's or district's policies, and applicable state student-privacy laws.

Student education records are generally governed by FERPA and are controlled by the school or district. Where Pluma processes any education records on behalf of a school, we act only under the school's direction and for authorized educational purposes, consistent with FERPA's "school official" framework, and do not use them for unrelated purposes. The AI tools generate drafts for professional review and do not provide any diagnosis or medical, psychological, or legal advice.

9. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls, and reliance on reputable infrastructure providers such as Google Cloud / Firebase and Stripe.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us of any suspected unauthorized access at [email protected].

10. Data Retention

We retain personal information for as long as needed to provide the Service, maintain your account, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data and the purpose for which it is processed.

When information is no longer needed, we delete or de-identify it in accordance with our retention practices and applicable law. Certain records (such as transaction and tax records) may be retained longer where the law requires.

11. International Data Transfers

Pluma is operated from the United States, and our providers may process and store information in the United States and in other countries. If you access the Service from outside the United States (for example, from Brazil), you understand that your information may be transferred to and processed in the United States and other jurisdictions whose data-protection laws may differ from those of your country.

Where required, we take steps to ensure that transfers of personal information are subject to appropriate safeguards consistent with applicable law.

12. Regulatory Authorities

The United States does not have a single national data-protection authority. The Federal Trade Commission (FTC) is the primary federal regulator for consumer privacy and enforces COPPA and the FTC Act. FERPA is administered by the U.S. Department of Education (Student Privacy Policy Office).

State privacy laws are generally enforced by the state Attorney General; in California, the California Privacy Protection Agency (CPPA) and the California Attorney General share enforcement authority. You may contact the appropriate authority for your state if you have unresolved concerns, though we encourage you to contact us first.

13. Contact and Privacy Officer

If you have questions or requests regarding this Policy or your personal information, contact our privacy contact / data protection officer at [email protected].

SA Educação e Tecnologia LTDA — CNPJ 37.956.321/0001-74 — Piauí, Brasil. General contact: [email protected].

14. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will revise the "Last updated" date above and, where appropriate, provide additional notice (such as by email or an in-Service notice).

Your continued use of the Service after the changes take effect means you acknowledge the updated Policy.