- bncc.dev
- privacy
bncc.dev privacy policy
Version 1.0 · last updated October 2026
The BNCC dataset contains no personal data. This policy covers what happens when you use the website, the API, the hosted MCP server, the contact form and the newsletter: what we receive, why, who we share it with, how long we keep it and how you exercise your rights. The Portuguese version is the reference text.
1. Who is responsible
bncc.dev is a solution of Profy Tecnologias Educacionais Ltda, trade name Profy IA, CNPJ (Brazilian company registry) 53.669.787/0001-45, with registered office at CLN 206, Bloco A, Loja 09 (Parte RB), Asa Norte, Brasília (DF), Brazil, CEP 70.844-510. Profy is the controller of all processing described here.
The data protection officer is Leonardo Ornelas Pereira, at leo@profy.com.br.
This policy applies to bncc.dev, api.bncc.dev, mcp.bncc.dev and contato.bncc.dev. It does not apply to Profy AEE or Profy Planejamento, which have their own policies. The repositories on GitHub and the packages on npm and PyPI follow the terms of those platforms. The packages and the MCP server running on your own machine send nothing to Profy.
2. Data we receive
There are no accounts, passwords or sign-up. We receive only what is listed in the table below.
| When | Data | Origin |
|---|---|---|
| You use the contact form | Name, email, subject and message. IP address and technical browser signals, used by the anti-bot check and by the submission limit | You and your browser |
| You subscribe to the newsletter | You | |
| You browse the website | Pages viewed, usage events, device type and approximate region, measured by Google Analytics with cookies | Your browser |
| You or a program access the website, the API or the MCP server | Technical records of each request: IP address, date and time, address accessed (for the API, this includes the search terms sent) and the identification of the browser or program | Generated automatically |
| You write to contato@bncc.dev or leo@profy.com.br | The message and whatever you include in it | You |
Do not ask for or send sensitive data, such as health information about students, through these channels. If it arrives, it is deleted.
When an AI assistant queries the MCP server, the request is made by the assistant's provider. Your conversation with the assistant is covered by the provider's policy. bncc.dev receives only the technical query.
3. What we use it for and on which legal basis
We follow the principles of article 6 of Brazil's General Data Protection Law (Law 13,709/2018, LGPD), such as purpose limitation, necessity and transparency.
| Purpose | Data | Legal basis |
|---|---|---|
| Answering messages | Form or email data | Legitimate interest (art. 7, IX), or steps prior to a contract you requested (art. 7, V) |
| Sending the newsletter | Consent (art. 7, I). You can leave the list at any time | |
| Protecting the service against abuse, with an anti-bot check and request limits | IP and technical signals | Legitimate interest (art. 7, IX) |
| Keeping access records required by law | Access records | Legal obligation (art. 7, II; Brazilian Civil Rights Framework for the Internet, Law 12,965/2014, art. 15) |
| Measuring website audience | Browsing data | Legitimate interest (art. 7, IX). You can object by blocking cookies (section 9) |
We do not sell data, we do not use data for advertising or commercial profiling, and we do not use data from bncc.dev visitors to train AI models.
4. Who we share data with
Each provider receives only what its function requires.
| Provider | Function | Where |
|---|---|---|
| Cloudflare | DNS. Running the hosted MCP server and the forms. Anti-bot check (Turnstile). Technical request records | United States and global network |
| Amazon Web Services | Hosting of the website and the API, with the access records | United States (us-east-1) |
| Resend | Sending the form and newsletter emails. Storing the subscriber list | United States |
| Google Analytics 4 (audience) and Google Fonts (font of the Profy logo in the footer) | United States | |
| Profy's email provider | Receiving messages sent to contato@bncc.dev and leo@profy.com.br | According to the provider |
Data may be disclosed to authorities when there is a legal obligation or a valid order, limited to what is necessary.
5. International transfer
The providers above process data outside Brazil, mainly in the United States. The applicable legal mechanism is article 33, II, of the LGPD, through contractual clauses, observing Resolution CD/ANPD No. 19/2024. Profy is formalizing the incorporation of the standard contractual clauses of Brazil's National Data Protection Authority (ANPD) with its international providers. You can ask the data protection officer about the destination, purpose and mechanism of each transfer.
6. How long we keep data
| Data | Period |
|---|---|
| Contact messages | Up to 24 months after the last interaction |
| Newsletter email | Until you leave the list. Every email sent includes an unsubscribe link |
| Application access records | 6 months, as required by article 15 of the Brazilian Civil Rights Framework for the Internet, with no use for any other purpose |
| Technical records of the Cloudflare Workers | Up to 3 days |
| Google Analytics data | Up to 2 months |
7. Security
- Protected connection. Every bncc.dev address uses HTTPS.
- Minimum stored. The service that receives the forms does not store the messages or the newsletter emails. It forwards them to Resend and discards them.
- Defense against abuse. The forms have an anti-bot check and a submission limit per IP. The API and the MCP server have a request limit per IP.
- Restricted access. Only the people responsible for operations access the providers' dashboards. Keys and secrets are kept in secret stores, outside the code.
In case of a security incident that may cause relevant risk or damage, Profy notifies the ANPD and the affected data subjects under article 48 of the LGPD and Resolution CD/ANPD No. 15/2024.
8. Your rights
Under article 18 of the LGPD, you can request, free of charge: confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent, and objection to processing carried out without consent.
Write to leo@profy.com.br. We confirm receipt within 2 business days and respond within 15 days. Before providing or changing data, we may ask for simple proof of identity. You can also file a complaint with Brazil's National Data Protection Authority at gov.br/anpd.
10. Children and adolescents
Anyone can browse the website, including students. There are no accounts, advertising or commercial profiling. The contact form and the newsletter are meant for adults. If we notice that we received data from a child or adolescent through these channels, we delete it.
11. Changes
Each version of this policy has a number and a date. Relevant changes are announced on this page and in the newsletter before they take effect.
12. Contact
Data protection officer: Leonardo Ornelas Pereira, leo@profy.com.br. For other matters, use the contact form or write to contato@bncc.dev. Mail can be sent to the address in section 1.