Privacy Policy
How Projeto Diário handles your data on the website, in the games and in certifications. Last updated: 2026-10-16.
Who we are
This policy covers www.kanban.global and jogo.kanban.global, operated by Projeto Diário (CNPJ 12.118.354/0001-14 · Diadema). For anything about personal data, contact our Data Protection Officer at info@kanban.global.
What we collect
Account: name, email, country and password (stored only as a hash). Platform use: progress in paths, challenge results, Kanban Game matches (moves, score and the replay used to verify the score), exam answers and issued credentials. Contact: name, email, phone (optional) and message. Technical: IP address and approximate country, used for security, abuse limits and the initial language choice.
Why we use it
To provide the service (save your progress, compute rankings, issue and verify credentials); to answer your contact; to send account emails (confirmation, password reset, team invites, exam results and credentials); to send the weekly newsletter, only if you opt in; to send account holders occasional messages about platform features related to what they use, with one-click decline and unsubscribe; to protect the platform against fraud and abuse; to meet legal obligations.
Legal basis
Performance of a contract (your account and the services you use), consent (the weekly newsletter and non-essential cookies, if any), legitimate interest (security, fraud prevention, service improvement and occasional messages to account holders about features related to what they use) and legal obligation (tax records for purchases).
Email communications
We keep three kinds apart. Account emails (password, exams, credentials, purchases) are always sent, because they are part of the service. The weekly newsletter (40 emails, one a week) is only sent if you opt in, at sign-up, in My account or with the button in the email itself; your choice is recorded with its date and source, and you can cancel anytime. Account holders may receive, based on legitimate interest, occasional messages about platform features related to what they use, such as the invitation to the free certification, always with the option to decline and to unsubscribe in one click; anyone who declines or unsubscribes stops receiving this kind of message.
Cookies
Necessary cookies: kbg_sess (login session), kg_lang, kg_lang_src and kg_country (chosen or detected language). Our own usage measurement: kg_vid, a random browser identifier with no name or email, valid for 12 months; and kg_optout, which stores your choice not to be measured. No advertising cookies and no third-party trackers. Cloudflare Web Analytics measures audience without cookies and without identifying people.
Platform usage measurement
On our own server we record usage events: pages viewed, practices started and completed, clicks on next-step recommendations, offers seen, account created, contact sent and purchase confirmed. Each event stores the random kg_vid identifier, the page, the language, the approximate country and where the visit came from. No event stores your name, email, IP address or the content of files you analyze. When you sign in, earlier events from this browser become linked to your account. The legal basis is legitimate interest in understanding and improving the product. Events are deleted after 13 months. We honor the Global Privacy Control signal, and you can turn measurement off at any time with the button below.
Who we share with
Providers that run the platform under contract: hosting and CDN (Cloudflare, with servers outside Brazil), transactional email, Google sign-in (only if you choose to sign in with Google) and, for purchases, the payment provider. We do not sell personal data.
International transfers
Some providers process data outside Brazil and the European Union. We apply contractual clauses and technical measures compatible with LGPD and GDPR.
Retention
Account data: while the account exists and up to 12 months after deletion, for security and legal obligations. Purchase records: for the applicable tax period. Issued credentials: kept for public verification during their validity and afterwards as history (you can request removal). Contact messages: up to 24 months.
Your rights
Confirm whether we process your data, access, correct, anonymise, port, withdraw consent and request account deletion. Write to the DPO to exercise them; we reply within 15 days. You may also complain to ANPD (Brazil) or your local data protection authority.
Security
Strong password hashing, HttpOnly and Secure session cookies, HTTPS everywhere, login attempt limits and audit logs in the back office. No system is infallible; if an incident puts you at risk, we will notify you as required by law.
Children
The platform is intended for people aged 16 and over. Accounts of minors without authorisation will be removed.
Changes
When this policy changes materially, we will notify you by email or on the site. The date at the top shows the current version.
Your measurement choice
Usage measurement is on in this browser.
