SYNCHRONOTRON
EN
Português PT Deutsch DE English EN Italiano IT Español ES
— 0 Synchronize now
LGPD · Law No. 13,709/2018

Privacy Policy

Version of October 6, 2026

This policy explains which personal data the Synchronotron (synchronotron.com) processes, for what purpose, with whom it shares them, how long it keeps them, and what your rights are. It applies to the website, the shop, the account, and the members’ area.

1. Controller and Contact

The data controller is Gerd Johannes Payr (empresário individual), CNPJ 30.682.832/0001-04, Rua Silveira Martins, 157 – Flamengo, Rio de Janeiro – RJ, CEP 22221-000, Brazil. It is the same controller that operated the Synchronotron’s previous platform.

Data protection officer (Encarregado, Art. 41 LGPD): Gerd Johannes Payr. Contact for all privacy matters: 441@synchronotron.com.

2. Which Data We Process, Why, and on What Legal Basis

  • Account: email address; country (asked during registration); city, preferred language, and how you heard about the Synchronotron (optional). If you set a password, the sign-in service stores only a hash of it (an irreversible encoding). Purpose: to create and maintain your account, to let you sign in (with a link sent to your email or with a password), and to show the website in your language. Legal basis: performance of a contract (Art. 7, V).
  • Level, access, and trial period: your account’s level, the access you have with start and end dates, and the trial period for new accounts. Purpose: to unlock content and to let you know when time-limited access is about to end or has ended. Legal basis: performance of a contract.
  • Orders: order number, email address, products, amounts, currency, coupon used, date, status, payment provider, and the payment’s ID at the provider. We also log the notifications the provider sends us about each payment (for example, approved or refunded), with payment method and amount, without card or bank account data. Purpose: to unlock access, to assist you, to document payments and refunds, and to meet tax obligations. Legal bases: performance of a contract, compliance with a legal obligation, and the regular exercise of rights (Art. 7, V, II, and VI).
  • Payment data (card, Pix details, PayPal account): you enter these directly with Mercado Pago or PayPal. We do not receive or store them.
  • Consent for messages: for each purpose (newsletter, event invitations, news from partners) we store whether you consented, when, which version of the text, and when you withdrew. Nothing is preselected, and having an account is not consent to promotional emails. Legal basis: consent (Art. 7, I).
  • Newsletter (subscription without an account): you can receive the Synchronotron newsletter without an account. To do so, you enter your email address and preferred language in the form (footer, home page or newsletter page) and tick the consent box, which is never pre-ticked. We use a double opt-in procedure: you receive an email with a link that is valid for 7 days; it opens a page where you confirm your subscription with a button (merely opening the link confirms nothing). You only receive the newsletter after confirming. Unconfirmed subscriptions are deleted automatically after 30 days. As proof of consent we store: your email address, the language, the date and time of the request and of the confirmation, the version of the consent text, the form the request came from, and your IP address only as a hash value with a secret key (not reversible). If the address belongs to an account on the website, the consent is kept in the account (My Account → Messages and consent). The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 7, I, LGPD), which you can withdraw at any time with effect for the future. Every email contains a one-click unsubscribe link; you can also write to 441@synchronotron.com. After you unsubscribe we no longer send the newsletter; we keep the record of consent and withdrawal for 5 years from the date you unsubscribe and then delete it automatically. The emails are sent through the service provider Resend (Resend, Inc., USA), which processes the data on our behalf; for the transfer to the USA, see section 5. We do not pass your data on to partners or use it for any other purpose.
  • 13 Moon Diary: the notes, the mood of the day, and the synchronicities you record. Only you can see these entries; you can download them and delete one or all of them. Legal basis: performance of a contract.
  • Escola 441: your progress in the lessons (lesson opened, watched, or completed, and the position in the video). If you request a certificate of participation, we store the name you enter for it, the course or module, the date, and a verification code. The public verification page shows the certificate only if you make it public (default: off); it then shows name, course or module, date, and validity. Legal basis: performance of a contract.
  • Contact form messages: name, email address, subject, text, and language; in the administration, also the handling status and an internal note. The message is stored in our database and forwarded to our email inbox. Purpose: to reply to you. Legal bases: consent and legitimate interest (Art. 7, I and IX).
  • Partners and events: if you are a partner or organizer, we store your partner profile and the events you submit. Once approved, the events appear publicly in the calendar, with the organizer’s name. Legal basis: performance of a contract.
  • Email log: for each email the website sends, we store recipient, type of message, language, the data used for the message content (for example, the order items or the text of a forwarded contact message), date, and delivery result. Purpose: to ensure delivery and avoid duplicate emails. Legal basis: legitimate interest.
  • Administration log: the team’s actions in the administration are logged: who changed what in accounts, access, and orders, when, and why, without the content of messages. Purpose: security and traceability. Legal basis: legitimate interest.
  • Technical data: IP address and time of access. Purpose: security and abuse prevention (for example, limits on contact messages, on newsletter sign-ups and confirmations, on requests to the certificate verification page, and on unsubscribe requests). Legal basis: legitimate interest. Account access records are kept by the authentication provider, as described in section 7.

3. Transfer from the Previous Platform

The Synchronotron previously ran on a different platform. Because the controller remains the same, the data of the previous platform’s customers, both current and former, are transferred to this system:

  • an account under the email address used so far, without a password: you sign in with the link sent to your email address or set a new password;
  • name, country, and city, where available;
  • ongoing access, with its existing end date;
  • your newsletter subscription, if it was confirmed on the previous platform (with the date of confirmation as proof);
  • previous orders from the last 5 years (date, product, amount, status, and old order number), shown as purchase history in your account.

Card data and old passwords are not transferred. Previous orders are kept for 5 years from the order date and then anonymized; if you delete your account, all of them are kept without a link to the account until the end of that period. You can download or delete your account, including all transferred data, at any time in the Members’ Area. We will send all transferred customers a one-time email notice about the platform move and how to sign in to the new system. Automatic notices about access ending are only sent after you first sign in to the new system. After that, we send emails only with your consent (for example, the newsletter) or about your own orders and your account.

Legal bases: performance of a contract (ongoing access), compliance with a legal obligation (retention of orders), and legitimate interest (continuing the customer relationship and purchase history; Art. 7, IX, and Art. 10 LGPD).

4. What Stays Only in Your Browser

Some information is kept only in your browser’s local storage (localStorage and sessionStorage) and is not sent to us:

  • the sign-in session (key sb-…-auth-token), until you sign out – it is sent to the server only to identify you –, and a copy of your level (at most 30 days) and of your unlocked access, for offline use and for the menu; this copy is deleted when you sign out;
  • the shop cart;
  • your birth date and the dates you enter in the tools (for example, My Kin, Personal Ring, and Signature Report). Your birth date is not stored in your account;
  • preferences and progress, such as language, date mode, the First Steps tour, and the review plan for the Escola exercises;
  • pages and files of the website for offline use, in the browser cache (service worker), even if you do not install the app (PWA).

We do not use advertising or tracking cookies, and we do not use visitor analytics tools. You can delete this data at any time in your browser settings.

5. Who We Share Data With

  • Mercado Pago: payments by credit card, Pix, boleto (when offered), and other methods that Mercado Pago displays. Receives the order number, the products, the amount, and your email address.
  • PayPal: payments through PayPal. Receives the order number, the products, and the amount.
  • Supabase: database, accounts, and sign-in; servers in the São Paulo region.
  • Cloudflare: hosting of the website and the shop server, media files, course videos, and the Turnstile anti-spam protection in the contact and newsletter forms.
  • Resend: delivery of the website’s emails, including the sign-in emails.
  • Authorities, when required by law or court order.

These providers process the data on our behalf and according to our instructions. Mercado Pago and PayPal also process the payment data on their own account, under their own privacy policies. We do not sell personal data, and we do not pass your data on to partners.

Some of these providers process data outside Brazil, for example in the United States. The international transfer is based on the contractual safeguards of each provider (standard contractual clauses), in accordance with Art. 33 LGPD and the regulations of the ANPD.

6. Other Services and External Links

  • YouTube videos (Google): the videos on the home page, in the video library, and in the blog load only after a click, from the address youtube-nocookie.com. Only then does your browser connect to Google.
  • Embedded content in the members’ area: some content unlocked for you includes players or documents from third parties (YouTube, Vimeo, SoundCloud, Spotify, Google Drive, or Google Docs). When you open such content, your browser connects to that service.
  • WhatsApp (Meta): the help button and some links in the blog open WhatsApp. Data is transmitted only if you use the link.
  • External forms and websites: some pages and articles link to external forms (for example, Google Forms) or to other websites. When you open the link, that service’s privacy policy applies.
  • Calendars: if you subscribe to one of our public calendars (for example, in Google Calendar), the subscription lives in your account with that service. The calendar files contain no data about you.
  • Fonts and libraries: fonts and programming libraries (for example, for the 3D scenes) come from the website itself. Your browser makes no requests to Google Fonts or to other distribution networks.

7. How Long We Keep Data

  • Account, profile, level, and access: as long as the account exists;
  • 13 Moon Diary: until you delete the entries or delete the account;
  • Escola 441 progress and certificates: until you delete the account;
  • Consent: as long as the account exists, including the record of when you consented and when you withdrew;
  • Orders: 5 years from the order date (retention of tax records), even if the account still exists. After that period the order is anonymized: we remove the link to the account, your email address, and the payment reference at the provider; only data without personal reference remain (number, date, status, products, amounts, and payment method), and the order no longer appears in your account. Access already granted is not affected. If you delete the account earlier, canceled orders are deleted and the others are kept without a link to the account until the end of that period;
  • Payment notifications from the providers: 5 years;
  • Email log: 90 days after sending;
  • Administration log: 5 years;
  • Contact form messages: 2 years; the copy forwarded to our mailbox is deleted manually within the same period. If you delete your account, messages sent with the same email address are deleted immediately; the copy in the email log is deleted no later than 90 days after sending;
  • Newsletter without an account: confirmation link valid for 7 days; unconfirmed subscriptions: 30 days; confirmed subscriptions: until you unsubscribe; after that, the record of consent and withdrawal: 5 years from the date you unsubscribe;
  • IP address used for request limits: up to 1 day;
  • Account access records (date, time, and IP address of the sign-in) are kept in the technical logs of the authentication provider (Supabase), for the period it defines;
  • Sign-in links: valid once and for a short time; sessions: until you sign out.

8. Your Rights

Under Art. 18 LGPD, you can request confirmation of processing and access to your data, correction, anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law, portability, deletion of data processed on the basis of consent, information about whom we share your data with and about the possibility of not giving consent and its consequences, and you can object to processing (Art. 18, § 2). You can withdraw consent at any time.

You can do much of this yourself in the Members’ Area: download all the data we store about you (JSON file), correct your profile, withdraw consent, and delete your account. When you delete your account, we delete profile, level and access (including any remaining time), consent, Diary, Escola progress and certificates, and contact messages; canceled orders are deleted, and all other orders are kept as described in section 7. If your account came from the previous platform, we keep only an irreversible code (hash) of your email address in the administration log, so that the account is not recreated in a new transfer; this entry is deleted after 5 years.

Every email we send on the basis of consent contains a one-click unsubscribe link. Service emails (sign-in link, purchase confirmation, notice that access is ending) are part of the service and do not require consent.

For any other request, write to 441@synchronotron.com, preferably from your account’s email address. You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).

9. Security

We use encrypted connections (HTTPS), sign-in links that are valid once and for a short time, passwords stored only as hashes, and access rules in the database (Row Level Security): each person sees only their own data and the content unlocked for them. Notifications from payment providers are verified before any access is unlocked, and secret keys are kept only on the server.

10. Changes and Languages

This policy may be updated; the version date is at the top of the page. If a change alters the wording of a consent, we will ask you to confirm it again. This policy exists in five languages (Portuguese, German, English, Italian, and Spanish). In case of discrepancies, the Portuguese version prevails.