This Privacy Policy explains how MUGNOS-IT CAPACITACAO E CONSULTORIA LTDA (“Mugnos-IT”, “we”, “us”, or “our”), a company established in Brazil (CNPJ 59.977.699/0001-97, São Paulo, Brazil), collects, uses, shares, and protects your personal data when you use the MUG IT mobile application and related services (the “Service”).
Effective date: 2026-06-30
Last updated: 2026-06-30
We act as the data controller for the personal data described below. Because our users are located around the world, this policy is written to comply with both Brazil’s Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018) and the EU/EEA/UK General Data Protection Regulation (GDPR), in addition to applicable app-store requirements.
1. Summary
- MUG IT is an educational platform for learning Site Reliability Engineering (SRE).
- We collect the data needed to create your account, deliver lessons, track your learning progress, and (optionally) send you notifications.
- We do not sell your personal data, and we do not use it for third-party advertising.
- Your data is processed using Amazon Web Services (AWS) and Google Firebase infrastructure, including servers located in the United States.
- You can request access to or deletion of your data at any time by emailing contato@mugnos-it.com.
2. Personal data we collect
2.1 Information you provide
- Account information: your name and email address when you register.
- Authentication credentials: if you register with email and password, your password is managed and stored (in hashed form) by AWS Cognito — we never see or store your plaintext password.
- Profile data: an optional profile picture/avatar selection.
2.2 Information from Google Sign-In (if you use it)
If you choose “Sign in with Google”, Google shares your name, email address, and a unique account identifier with us through the AWS Cognito hosted login flow. We do not receive your Google password.
2.3 Learning and usage data
To run the gamified learning experience, we store:
- Lessons you complete and quiz scores;
- Articles you have read;
- Your experience points (XP) and progression level;
- Your daily-login streak and last login date.
2.4 Device and notification data
- If you enable push notifications, we store a device push token provided by Firebase Cloud Messaging (FCM) so we can deliver notifications. On Android this uses the
POST_NOTIFICATIONSpermission; you can disable notifications at any time in your device settings.
2.5 Technical data
- Standard request metadata necessary to operate and secure the Service (e.g., IP address and timestamps processed transiently by our API gateway and logs).
We do not intentionally collect special-category/sensitive data (LGPD Art. 5, II / GDPR Art. 9), and you should not submit such data to the Service.
3. How we use your data and our legal bases
| Purpose | Personal data used | Legal basis (LGPD / GDPR) |
|---|---|---|
| Create and manage your account; authenticate you | Account, auth, Google sign-in data | Performance of a contract (LGPD Art. 7, V / GDPR Art. 6(1)(b)) |
| Deliver lessons and track learning progress / XP | Learning and usage data | Performance of a contract (LGPD Art. 7, V / GDPR Art. 6(1)(b)) |
| Send account emails (verification, password reset) | Email address | Performance of a contract / legitimate interest (LGPD Art. 7, V/IX · GDPR Art. 6(1)(b)/(f)) |
| Send push notifications (streaks, content, events) | Device push token | Consent (LGPD Art. 7, I / GDPR Art. 6(1)(a)) — opt-in via device settings |
| Secure the Service, prevent abuse, debug | Technical data | Legitimate interest / legal obligation (LGPD Art. 7, IX/II · GDPR Art. 6(1)(f)/(c)) |
| Comply with legal obligations | As required | Legal obligation (LGPD Art. 7, II / GDPR Art. 6(1)(c)) |
We do not use automated decision-making that produces legal or similarly significant effects on you.
4. How we share your data (processors and third parties)
We share personal data only with service providers (“operators”/”processors”) that process it on our behalf under contract:
- Amazon Web Services (AWS) — identity (Cognito), database (RDS PostgreSQL), serverless compute (Lambda/API Gateway), email delivery (SES), and message queuing (SQS). Used to host and operate the Service.
- Google LLC / Firebase — Firebase Cloud Messaging for push notifications, and Google Sign-In (OAuth) if you choose it.
We do not sell personal data and do not share it with advertisers or data brokers. We may disclose data if required by law, legal process, or to protect our rights, users, or the public.
5. International data transfers
We are based in Brazil, and our infrastructure providers process data in the United States (AWS region us-east-1) and potentially other regions. When we transfer personal data internationally — including from Brazil or the EU/EEA/UK — we rely on appropriate safeguards, such as Standard Contractual Clauses and our providers’ data-processing terms, consistent with LGPD Arts. 33–36 and GDPR Chapter V. You may request more information about these safeguards using the contact details below.
6. Data retention
We keep your personal data for as long as your account is active and as needed to provide the Service. When you delete your account (or request deletion), we delete or anonymize your personal data within 30 days, except where we must retain certain data to comply with legal obligations, resolve disputes, or enforce our agreements.
7. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Delete your data (“right to erasure” / “eliminação”);
- Restrict or object to certain processing;
- Portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time (e.g., disable push notifications), without affecting prior processing;
- Information about with whom we share your data;
- Lodge a complaint with a supervisory authority.
To exercise any right, email contato@mugnos-it.com. We will respond within the timeframes required by law (LGPD: without undue delay; GDPR: within one month).
- Brazil (LGPD): you may also contact the Autoridade Nacional de Proteção de Dados (ANPD) — https://www.gov.br/anpd.
- EU/EEA/UK (GDPR): you may lodge a complaint with your local Data Protection Authority.
For any questions about how we handle your personal data, or to exercise your rights, contact our data protection channel at contato@mugnos-it.com.
8. Account and data deletion
You can request deletion of your account and associated personal data at any time by emailing contato@mugnos-it.com with the subject “Account deletion”. We will verify your request and delete your data as described in Section 6.
9. Security
We use industry-standard measures to protect your data, including encrypted transport (HTTPS/TLS), managed authentication via AWS Cognito, and access controls. No method of transmission or storage is 100% secure, but we work to protect your data and to notify you and the relevant authorities of incidents as required by law.
10. Children’s privacy
The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact us at contato@mugnos-it.com and we will delete it. Where stricter local law applies (e.g., a higher age of digital consent in your country), that age applies to you.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, for material changes, provide additional notice (e.g., in the app). Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
12. Contact
MUGNOS-IT CAPACITACAO E CONSULTORIA LTDA
CNPJ 59.977.699/0001-97 — São Paulo, Brazil
Email: contato@mugnos-it.com
Website: https://mugnos-it.com