elastudio Data Processing Agreement

Version 1.5. Effective date: 27 October 2026. Version 1.5 changes no right or obligation of the Studio: section 1.2 names the European Economic Area, section 1.6 says translations are for information only, and section 14 gives the languages of support. Replaces version 1.4 (in effect earlier on 27 October 2026), version 1.3 (in effect from 22 October 2026 to 26 October 2026), version 1.2 (in effect from 15 October 2026 to 21 October 2026), version 1.1 (in effect earlier on 15 October 2026) and version 1.0 (in effect from 13 October 2026 to 14 October 2026). For a Studio that accepted an earlier version, version 1.5 applies when the Studio accepts it; until then the earlier version applies, and Brevo and Focus NFe cannot be connected.

This Data Processing Agreement (the “DPA”) is part of the elastudio Terms of Service for Studios (the “Terms”) between:

• the Studio, the business that uses elastudio, identified in its account (name, tax number such as CNPJ, CPF or business number, address and contact), acting as controller (in Portuguese, controlador); and
• Edilson Brito Bezerra Junior, operating as BRITO.AI, a sole proprietorship registered in Ontario, Canada, which operates elastudio (“elastudio”), acting as processor (in Portuguese, operador). BRITO.AI is registered under Ontario’s Business Names Act. GST/HST registration number: 786293639 RT0001. Mailing address: 73 Watt Street, Guelph, Ontario N1E 6W6, Canada.

The Studio accepts this DPA when it accepts the Terms, or by signing it. elastudio keeps a record of the version accepted, when, by whom, and the Studio’s details used to complete Annex 3, and gives the Studio a copy.

1. Purpose and scope

1.1 This DPA applies whenever elastudio processes personal data on the Studio’s behalf to provide elastudio (“Studio Personal Data”). Annex 1 describes that processing.

1.2 It is written to meet:

• Brazil’s Lei Geral de Proteção de Dados (Law 13.709/2018, “LGPD”), and the ANPD’s regulations, including Resolução CD/ANPD nº 15/2024 (security incidents) and nº 19/2024 (international transfers);
• Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, for Studios in Alberta and British Columbia, the personal information protection laws of those provinces;
• the California Consumer Privacy Act (“CCPA”), when it applies to the Studio; and
• any other data protection law that applies to the Studio’s processing, to the extent that law requires terms in a contract with a processor.

elastudio does not currently accept Studios in Quebec, the European Union, the rest of the European Economic Area (Iceland, Liechtenstein and Norway) or the United Kingdom. Before it does, it will add the terms those laws require (for the EU, the EEA and the UK, the standard contractual clauses) and tell existing Studios.

1.3 Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “security incident” have the meaning given by the law that applies. Under LGPD, “processor” means operador. “Sub-processor” means another processor elastudio engages to process Studio Personal Data. “Security incident” means any event that compromises the confidentiality, integrity or availability of Studio Personal Data.

1.4 Order of precedence. For Studio Personal Data, this DPA prevails over the Terms. For personal data subject to LGPD, the ANPD standard contractual clauses in Annex 3 prevail over everything else, including this DPA.

1.5 Where elastudio is a controller. elastudio is a controller (not a processor) of the data of studio owners and staff it needs to run and bill accounts, of its own website visitors and of its marketing contacts. That processing is described in elastudio’s Privacy Policy, not in this DPA. elastudio is a controller of staff account and billing data, and a processor of the staff data the Studio manages in its schedule.

1.6 Language. This DPA is available in English and Brazilian Portuguese. For Studios in Brazil, the Portuguese version prevails; otherwise the English version prevails. Annex 3 exists only in Portuguese, which binds. elastudio may publish translations into other languages, such as Spanish, for information only; a translation is not binding and does not prevail, unless a law that cannot be waived by contract requires otherwise.

2. The Studio’s instructions

2.1 elastudio processes Studio Personal Data only on the Studio’s documented instructions. The Terms, this DPA and the Studio’s use and settings of elastudio (for example, inviting staff, importing members, sending messages, deleting a member) are the Studio’s complete instructions. These instructions include the international transfers described in section 11. Other instructions must be agreed in writing.

2.2 elastudio will tell the Studio promptly if, in its opinion, an instruction breaks data protection law, and may refuse to follow it.

2.3 If a public authority or court requires elastudio to give access to Studio Personal Data, elastudio will: (a) notify the Studio and, for data subject to LGPD, the data subjects concerned, unless the law of the country where the data is processed forbids it (Annex 3, Clause 19.1); (b) take the legal steps available, including court action, where there is an adequate legal basis to challenge the request or a ban on notifying (Clause 19.2); (c) disclose only the minimum required; and (d) keep a record of every such request (date, requester, purpose, data requested, number of requests and legal steps taken) and give it to the Studio or the ANPD on request (Clause 19.3). If the law requires elastudio to process Studio Personal Data in any other way, elastudio will tell the Studio first, unless the law forbids it.

2.4 elastudio will not sell or share Studio Personal Data for advertising, will not use it for its own purposes, and will not combine it with data from other sources except as needed to provide elastudio. Where the CCPA applies, elastudio is the Studio’s service provider, and the Studio discloses Studio Personal Data only for the business purposes in Annex 1 (“Purposes”). elastudio will not: (a) sell or share it, as the CCPA defines those words; (b) retain, use or disclose it for any purpose, including any commercial purpose, other than those business purposes or as the CCPA otherwise permits; (c) retain, use or disclose it outside the direct business relationship with the Studio; or (d) combine it with personal information from other sources, except as the CCPA regulations allow. elastudio will comply with the CCPA and give Studio Personal Data the same level of privacy protection the CCPA requires; will notify the Studio if it can no longer meet these obligations; and allows the Studio, on notice, to take reasonable and appropriate steps to ensure use consistent with the Studio’s CCPA obligations and to stop and remediate unauthorised use. elastudio binds its sub-processors to these terms.

2.4A What elastudio itself may see and use. To run, support and bill the Studio’s account, elastudio may (a) see the names and contact details of the Studio’s owner and staff, data of which elastudio is the controller (section 1.5), and (b) compute, on the Studio’s instruction, counts and totals for the Studio (for example, numbers of members, bookings and sales in a month) that do not identify any member and cannot be used to identify one, and are therefore anonymised data under LGPD article 12. elastudio uses these only to run, secure, support, bill and improve elastudio, never to contact members, and never sells them.

2.5 The Studio is responsible for the lawfulness of the processing it instructs, including having a valid legal basis (and, for health notes, the specific and highlighted consent of LGPD article 11, or another basis that article allows), obtaining a parent’s or guardian’s consent for members under 18 (LGPD article 14), giving its members a privacy notice, publishing the information about the international transfer that Annex 3 requires, and the accuracy of the data it provides.

3. Confidentiality

elastudio ensures that every person it authorises to process Studio Personal Data is bound by confidentiality. Today that is one person, Edilson Brito Bezerra Junior. Any future employee or contractor will be bound in writing before receiving access, and will receive access only to what their job needs.

4. Security

4.1 elastudio implements the technical and organisational measures in Annex 2, appropriate to the risk, including for sensitive data such as health notes and for data of children and adolescents.

4.2 elastudio may update those measures, provided the overall level of protection does not go down.

5. Sub-processors

5.1 The Studio gives elastudio general authorisation to engage sub-processors. The current list, with what each does and where, is published at elastudio.app/legal/subprocessors and attached as Sub-processor list.

5.2 elastudio will give at least 30 days’ notice before adding or replacing a sub-processor, by e-mail to the Studio owner and by updating the list. The Studio may object in writing within that period on reasonable data protection grounds. The parties will discuss the objection in good faith. If elastudio cannot reasonably avoid using the new sub-processor for the Studio, the Studio may end the Terms before the change takes effect and get a refund of prepaid fees for the unused period.

5.3 In an emergency (for example, a provider suddenly stopping service), elastudio may replace a sub-processor with shorter notice, and will tell the Studio as soon as possible with the same right to object. For Studio Personal Data subject to LGPD, elastudio will use an emergency replacement before the 30-day notice ends only if that provider offers another valid transfer mechanism under Clause 18.3 of Annex 3; otherwise it will pause the affected feature until the notice period ends.

5.4 elastudio binds each sub-processor by a written contract that requires it to process Studio Personal Data only on elastudio’s instructions, keep it confidential and secure, report security incidents, help with data subject requests, delete it at the end of the service and control its own sub-processors. elastudio remains fully liable to the Studio for its sub-processors’ performance.

5.5 Stripe. Payments use the Studio’s own Stripe account, under the Studio’s own agreement with Stripe. For that processing Stripe acts under its agreement with the Studio. elastudio sends member data (name, e-mail, purchase) to the Studio’s Stripe account on the Studio’s instructions. Stripe is not elastudio’s sub-processor, and section 5.4 does not apply to it; the sub-processor list shows it as a provider the Studio contracts with directly.

5.6 Brevo. E-mail marketing through Brevo is optional and happens only when the Studio connects its own Brevo account (Sendinblue SAS, France), under the Studio’s own agreement with Brevo. For that processing Brevo acts under its agreement with the Studio; elastudio has no contract with Brevo. On the Studio’s instructions, elastudio keeps the Studio’s chosen Brevo list in step with members’ e-mail marketing consent: it sends members aged 18 or older who agreed (e-mail, name and the other fields listed in the sub-processor list; never members under 18); when a member withdraws consent, it deletes the contact and recreates it with the e-mail address only, blocklisted; it takes members off the list when they are archived or their address is suppressed, updates them when their address changes, deletes them when the member is deleted, and records in elastudio a member’s unsubscribe that Brevo reports. Brevo is not elastudio’s sub-processor, and section 5.4 does not apply to it; the sub-processor list shows it as a provider the Studio contracts with directly. By connecting Brevo, the Studio instructs elastudio to make this transfer and confirms that its agreement with Brevo requires Brevo to observe safeguards equivalent to those of Annex 3 and, for a Studio subject to LGPD, is a valid transfer mechanism under LGPD article 33.

5.7 Focus NFe. Issuing service invoices (NFS-e) through Focus NFe is optional, exists only for a Studio in Brazil that sells in reais, and happens only when the Studio connects its own Focus NFe account (FOCUS NFE LTDA, CNPJ 07.504.505/0001-32, Brazil) with its own API token, under the Studio’s own agreement with Focus NFe. For that processing Focus NFe acts under its agreement with the Studio; elastudio has no contract with Focus NFe. The Studio’s digital certificate stays with Focus NFe, and elastudio never holds it. On the Studio’s instructions, for each fully paid sale or when the Studio’s staff ask, elastudio sends Focus NFe the data the invoice needs (the buyer’s name; the CPF or CNPJ when known or, for a buyer marked as a foreigner without a CPF, their foreign tax number or the code that it was not given; the buyer’s e-mail only when the Studio chose to have the invoice e-mailed; what was sold, the amount and the date; and the Studio’s own fiscal data), as the sub-processor list describes, and Focus NFe issues the invoice with the city or the national NFS-e system. When the Studio turns on asking for the document at checkout, elastudio collects the buyer’s CPF or CNPJ, or the foreigner mark and an optional foreign tax number, at checkout and keeps it on the member’s profile for later invoices; it clears them from the profile when the member is deleted. No sensitive personal data is sent on purpose; the description is the name of the product sold, set by the Studio, which should avoid names that reveal health data. Issued invoices are tax records that the Studio must keep under Brazilian tax law; they stay in the Studio’s Focus NFe account, under its agreement with Focus NFe, and with the city or the national NFS-e system, and are not deleted when a member is deleted. When the Studio disconnects Focus NFe, elastudio deletes the token; notes already issued stay listed in elastudio, without buyer data, and in the Studio’s Focus NFe account. Documents saved on members’ profiles stay until the member is deleted, or until the Studio asks elastudio support to clear them. Any transfer of that data that Focus NFe makes outside Brazil is made by the Studio’s own provider, and the Studio is responsible for its basis under LGPD article 33. Focus NFe is not elastudio’s sub-processor, and section 5.4 does not apply to it; the sub-processor list shows it as a provider the Studio contracts with directly. By connecting Focus NFe, the Studio instructs elastudio to make this transfer, confirms that its agreement with Focus NFe requires Focus NFe to observe safeguards equivalent to those of Annex 3, and remains responsible, as controller, for the legal basis (its legal and tax obligation, LGPD article 7, II, or, where the applicable tax rules do not require the buyer’s document, another basis that LGPD article 7 allows, such as article 7, V) and for telling its members, in its privacy notice, that Focus NFe receives their data.

6. Helping with data subject requests

6.1 elastudio gives the Studio self-service tools to find, export (JSON and CSV), correct, anonymise and delete a member’s data, and to record and withdraw consent. Members can also download their data and request deletion themselves.

6.2 If elastudio receives a request directly from a member of the Studio, it will pass it to the Studio as soon as possible and within 2 business days (counted on the Brazilian business-day calendar), and will not answer it itself, unless the Studio asks it to or the law requires it. elastudio may tell the member that it has passed the request on and give the Studio’s privacy contact.

6.3 elastudio will help the Studio, where the tools are not enough, to meet its deadlines (for example 15 days for requests under LGPD and Annex 3, and 30 days under PIPEDA).

7. Security incidents

7.1 elastudio will notify the Studio without undue delay: within 24 hours where the incident may involve a relevant risk to data subjects, and in any case within 48 hours of becoming aware of a security incident affecting Studio Personal Data. This lets the Studio meet its own deadlines: under Resolução CD/ANPD nº 15/2024 and Annex 3, the controller must notify the ANPD and the data subjects within 3 business days when an incident may cause relevant risk or damage to them; under PIPEDA (and, in Alberta, its provincial law), the controller must report a breach that creates a real risk of significant harm to the Privacy Commissioner (in Alberta, the provincial Commissioner) and notify the people affected as soon as feasible. The parties plan to meet the 3-business-day deadline without relying on any extended deadline for small businesses.

7.2 The notice will include, as far as known at the time (and updated as more is learned): what happened and when; the date elastudio became aware; whether sensitive data (including health notes) or data of children, adolescents or elderly people is involved; the security measures protecting the data, including encryption; the reasons for any delay; the categories and approximate number of people and records affected; the likely consequences and risks; the measures taken or proposed to contain and fix it; and a contact person.

7.3 elastudio follows its written incident response plan, takes reasonable steps to contain the incident and limit harm, keeps a record of every incident for at least five years (Resolução CD/ANPD nº 15/2024; this also meets PIPEDA’s 24 months), and assists the Studio with notices to authorities and individuals. A summary of the plan is available to the Studio on request. elastudio is run by one person today; the plan covers what happens if he cannot act, but the Studio should know that response depends on that person. Notifying the Studio is not an admission of fault.

7.4 The Studio decides whether and how to notify authorities and members, and is the party designated for this in Annex 3, unless the law requires elastudio to notify directly (for example, PIPEDA’s breach reporting duties for information under elastudio’s control). The parties will coordinate the wording.

8. Impact assessments and authorities

elastudio will give the Studio reasonable information and help for its data protection impact assessments (in Brazil, relatório de impacto à proteção de dados pessoais) and for its dealings with data protection authorities, including the ANPD.

9. End of the service: return and deletion

9.1 While the account is active, and for 30 days after the account is closed, the Studio can export all Studio Personal Data in CSV and JSON.

9.2 After those 30 days, elastudio deletes Studio Personal Data from its live systems. Copies in backups are deleted as the backups expire, within 30 days, and are kept isolated and unused until then.

9.3 elastudio may keep Studio Personal Data longer only where the law requires it, and then only that data, protected and for no other purpose. Messages a Studio or member sends to elastudio’s support or privacy mailboxes are kept for up to 3 years after the request is closed, to show how it was handled, and then deleted. The Studio’s own records of sales and receipts are kept in its own Stripe account, under its own control.

10. Audits and information

10.1 elastudio will make available the information needed to show compliance with this DPA, including its security measures, sub-processor list, records of processing (LGPD article 37) and, when available, any independent security assessments or audit reports.

10.2 If that information is not enough to answer a reasonable question, or a data protection authority requires it, the Studio (or an independent auditor bound by confidentiality, not a competitor of elastudio) may audit elastudio’s compliance once every 12 months, with at least 30 days’ written notice, during business hours, at the Studio’s cost, and without access to other studios’ data. The once-every-12-months limit does not apply to audits required by a data protection authority or after a security incident. Audits of sub-processors rely on their own certifications and reports.

11. International transfers

11.1 Where data is. elastudio is operated from Canada. Studio Personal Data is stored in Cloudflare’s database and storage in eastern North America. Cloudflare offers no Canada-only option, so the data should be treated as stored in the United States. It is also processed by the sub-processors listed, mainly in the United States. elastudio will tell the Studio at least 30 days before changing the main storage region or country.

11.2 From Brazil: the ANPD standard contractual clauses. When the Studio is subject to LGPD, transfers of Studio Personal Data to elastudio outside Brazil are governed by the standard contractual clauses approved by the ANPD in Annex II of Resolução CD/ANPD nº 19/2024, which are incorporated into this DPA, in full and without change, as Annex 3. In those clauses:

• the Studio is the exporter and controller (Exportador/Controlador) and elastudio is the importer and processor (Importador/Operador);
• Clause 3, Option B: elastudio may make onward transfers only to the recipients listed there (the sub-processors named in Clause 3, the same as section A of the Sub-processor list, Stripe, which receives payment data for the Studio’s own Stripe account on the Studio’s instructions, Brevo, which receives the data of members who agreed to marketing e-mails for the Studio’s own Brevo account, only when the Studio connects that account, on the Studio’s instructions, and Focus NFe, which receives the data needed for the Studio’s service invoices (NFS-e) for the Studio’s own Focus NFe account, only when a Studio in Brazil connects that account, on the Studio’s instructions), for the purposes listed, under Clause 18; new sub-processors are authorised only through the 30-day notice in section 5;
• Clause 4, Option A: the Studio is the designated party (Parte Designada) for publishing the transparency document (Clause 14), answering data subject requests (Clause 15) and notifying security incidents to the ANPD and data subjects (Clause 16); elastudio helps it as Section IV of Annex 3 and sections 6 and 7 of this DPA describe;
• Section IV: disputes about the clauses go to the courts of the Studio’s domicile in Brazil, under Brazilian law.

The parties apply the clauses to all Studio Personal Data subject to LGPD, including data that members, staff and the Studio enter directly through elastudio’s booking pages, widget, dashboard and imports on the Studio’s behalf, even where a particular flow might legally be a collection rather than a transfer. elastudio is in any case subject to LGPD under its article 3. The official Portuguese text of the clauses is the binding version; this English summary is for information.

11.3 Onward transfers. For each recipient listed in Clause 3 of Annex 3, elastudio relies on a written contract (section 5.4; for Stripe, elastudio’s Stripe Connect platform agreement and the Studio’s own agreement with Stripe; for Brevo, the Studio’s own agreement with Brevo; for Focus NFe, the Studio’s own agreement with Focus NFe), as Clause 18 requires, and elastudio is responsible to the Studio for the recipient’s compliance as Clause 18.2(c) provides. Where a sub-processor offers the ANPD standard contractual clauses (today, Google, in its Cloud Data Processing Addendum), elastudio also relies on them. The sub-processor list states the mechanism for each one.

11.4 Transparency in Brazil. elastudio gives the Studio, in Portuguese, the text about the international transfer that the Studio must publish under Clause 14 of Annex 3 (it is included in the member privacy notice template), and a copy of the completed clauses that the Studio can give to data subjects who ask for them.

11.5 From Canada. elastudio protects Studio Personal Data with contractual protections comparable to those required by PIPEDA, and gives the Studio the information it needs to tell its members that their data is stored outside Canada.

11.6 Laws of the destination countries. elastudio has assessed the laws and practices of Canada, the United States and, for Brevo, the European Union that apply to the processing (Focus NFe is a Brazilian company, under Brazilian law) and has not identified any that prevent it from meeting Annex 3 (Clause 22.1); a summary is available to the Studio on request. elastudio will notify the Studio immediately if a change in law affects this (Clause 22.2), or if it breaches or cannot comply with Annex 3 (Clause 23.1). The Studio may then suspend the transfer, ask for the data to be returned or deleted, or end the Terms (Clause 23.2), with a refund of prepaid fees for the unused period.

12. Liability

12.1 Each party’s liability under this DPA is subject to the limits in section 13 of the Terms, to the extent the law allows. For personal data subject to LGPD, those limits, the indemnity in section 14 of the Terms, and the Terms’ choice of law and courts do not apply to liability arising from a breach of Annex 3 or of Brazilian data protection law, including the right of recourse between the parties under Clause 17.9. They never apply to rights of data subjects.

12.2 Those limits do not reduce any data subject’s rights against either party. Under LGPD article 42 and Clause 17 of Annex 3, a processor is jointly liable with the controller when it breaches data protection law or the clauses, or does not follow the controller’s lawful instructions. Each party is responsible to the other for the part of any damage caused by its own breach. Where the damage arises from a consumer relationship between the Studio and a member, the liability rules of Brazil’s Consumer Protection Code also apply (LGPD article 45).

13. Duration

This DPA lasts as long as elastudio processes Studio Personal Data, including during the 30 days after the account is closed and until deletion under section 9. Obligations that by their nature continue (confidentiality, deletion, incidents discovered later) survive.

14. Contacts

• elastudio privacy officer and encarregado: Edilson Brito Bezerra Junior, privacidade@elastudio.app
• elastudio security incidents: security@elastudio.app
• elastudio support: support@elastudio.app, in English and Brazilian Portuguese only
• Studio: the owner account’s e-mail address, and the privacy contact or encarregado the Studio records in its settings.

---

Annex 1: Details of the processing

Item	Details
Subject matter	Providing elastudio, a class booking and studio management platform, to the Studio
Duration	The term of the Terms, plus 30 days for export after the account is closed, plus backup expiry (30 days)
Nature of processing	Collection through booking pages, the booking widget, imports and entries by the Studio’s staff in the dashboard; storage; organisation; display to the Studio’s staff; sending transactional e-mails; transmission to the Studio’s Stripe account; when the Studio connects its own Brevo account, transmission to it of members who agreed to marketing e-mails, and updates and deletions there; when a Studio in Brazil connects its own Focus NFe account, transmission to it of the data of each paid sale needed for the Studio’s NFS-e; export; anonymisation and deletion
Purposes	Running the Studio’s schedule, bookings, waitlists and private sessions; selling and tracking passes and memberships; payments through the Studio’s Stripe account; recording Pix payments made directly to the Studio’s bank account, as confirmed by the Studio’s staff; messages from the Studio to its members; keeping the Studio’s own e-mail marketing list in Brevo in step with members’ consent, when the Studio connects it; issuing the Studio’s service invoices (NFS-e) through its own Focus NFe account, when a Studio in Brazil connects it, to meet the Studio’s tax obligation; reports; team profiles and the Studio’s public teacher profiles; members’ optional profile photos, so the Studio’s team recognises them; data rights requests; support and security
Categories of data subjects	The Studio’s members and prospective members, including guests who book without an account; people who attend private sessions; parents or guardians of members under 18; people who pay by Pix directly to the Studio’s bank; the Studio’s staff and teachers
Categories of personal data	Members: name, e-mail, phone (and whether it uses WhatsApp), preferred language, date of birth (optional), country and city, address line, state or province and postal code (optional), gender (optional: a choice from a list or the person’s own words), emergency contact (optional), buyer reference for receipts, CPF or CNPJ (optional; for a Studio in Brazil that issues NFS-e, it may be asked at checkout, or replaced by a mark that the member has no CPF because they are a foreigner, with their own country’s tax number if they give one), how they heard about the Studio, tags, staff notes, bookings, attendance, purchases, passes and memberships, payment status (no card numbers), consent records and accepted terms and waivers (with time, IP address and browser), sign-in records, a password the member creates (optional; stored only as a salted hash, never visible or e-mailed), a profile photo the member adds themselves (optional; private: seen only by the member and the Studio’s team, meaning owner, admins and front desk, and teachers only for members booked or waitlisted in a class they teach; never shown to other members, on public pages, in e-mails or in calendar events; the Studio’s staff cannot add or change it). The address of a private session, when the member chooses to have it outside the Studio. Staff and teachers: name, e-mail, role, public profile (photo, bio, Instagram) if the Studio publishes it, a profile photo the person adds themselves (optional; also shown on their teacher profile when that profile has no photo of its own), activity log, optionally gender, address line, city, state or province and postal code (seen only by the Studio’s owner and admins and by the person), and for teachers who connect Google Calendar, busy and free periods only. Parents or guardians of minors: name, e-mail and the consent record. Pix paid directly to the Studio’s bank: the payer’s name and the date paid, as the Studio’s staff enter them when they confirm the payment, the amount and the Pix charge reference (elastudio does not receive, read or keep the bank’s e-mails or statements)
Sensitive data	Health notes (optional), which are health data under LGPD article 5, II. A member adds one only after ticking a separate consent box; when staff type or import a note, they must confirm that the member (or, for a member under 18, a parent or guardian) gave written consent. Both are recorded with date and version. Visible to the Studio’s authorised staff, never to other members. Gender is optional, never required to book and hidden from teachers; a description in the person’s own words may reveal sexual orientation or sex life, so the Studio collects it only as described in its member notice. Profile photos are not processed by biometric or facial recognition means and are not used to identify anyone automatically; elastudio will not do so without a written instruction and an update to this Annex
Children	Members under 18 cannot sign themselves up (self sign-up requires confirming 18 or older). Staff may add a minor with a parent’s or guardian’s name, e-mail and consent recorded. The Studio is responsible for that consent, including for any health note or profile photo. No marketing to minors
Frequency	Continuous
Retention	As configured by the Studio and as described in section 9. Member deletion anonymises the profile (name, contact, profile photo, password (when the person has no profile at another studio), notes, health notes, CPF, CNPJ or foreign tax number and the foreigner mark cleared) and, in the same step, removes the member’s personal data everywhere else in elastudio: payer names on payments and Pix charges, guests’ first names, private-session addresses, sign-in links and codes, the log of e-mails sent to the member, data export files, the member’s subscriptions and customer record on the Studio’s Stripe account (through Stripe’s API the subscriptions are cancelled and checked, then the customer is deleted, or emptied where Stripe does not allow deletion; invoices already issued stay with Stripe as the tax record), and the member’s contact in the Studio’s Brevo account, when the Studio connected one. NFS-e already issued are tax records that the Studio must keep under Brazilian tax law; they stay in the Studio’s Focus NFe account, under its agreement with Focus NFe, and with the city or the national NFS-e system, and are not deleted; elastudio’s own record of each invoice keeps no buyer data (only the order link, number, status, amount and description). If the Stripe step fails, elastudio keeps retrying and warns the Studio after 24 hours; the deletion is reported as complete, and the member’s confirmation e-mail is sent, only after every step has succeeded. The Studio’s opt-outs of the member’s e-mail address and phone number (unsubscribes and complaints) are kept only as a keyed hash per Studio, never the address or number itself, and used only to make sure the member is never messaged again. Sales records are kept with the member’s identity removed, for the Studio’s legal retention, and the records of consent and accepted documents are kept as proof of what the member agreed to (who, by the member’s record at the Studio; which document and version; in which language; and when), for no fixed period while the Studio’s account is active, because the Studio, as controller, must be able to prove the consent it obtained (LGPD article 8, paragraph 2) and to meet a legal or regulatory obligation (Annex 3, item 20.1(a)); when the account closes, they are exported and deleted with the rest of the Studio Personal Data under section 9. The IP address and browser stored with each of these records are erased 5 years after the member’s last booking at the Studio (for a parent’s or guardian’s consent, the last booking of the minor concerned), or 5 years after the date of acceptance if the member never booked, and from backups as they expire, within 30 days. Copies held by the e-mail providers expire on their own schedule (Resend, the backup sender: up to 30 days, backups up to 7 days more) and are not deleted earlier when a member is deleted; addresses that bounce or complain may be kept on Resend’s suppression list until elastudio removes them. Automatic deletion: the IP address and browser of consent and acceptance records 5 years after the member’s last booking (or after the date of acceptance, if the member never booked), the e-mail log after 90 days, data export files after 7 days, bug reports and their screenshots after 1 year, IP addresses in the audit log after 12 months, and sign-in links and codes within a day after they expire. A staff member’s optional profile photo is kept until the person replaces or removes it or is erased, and a member’s optional profile photo until the member replaces or removes it or the member’s account is deleted or erased; the stored file is then deleted at once and has no separate backup. A member’s password hash is deleted when the member removes the password or the account is deleted
Location	Cloudflare database and storage in eastern North America (treated as the United States); elastudio operated from Canada; sub-processors as listed; when the Studio connects its own Brevo account, Brevo in the European Union; when a Studio in Brazil connects its own Focus NFe account, Focus NFe, a Brazilian company (its own terms govern where it hosts data and say some transfers may occur outside Brazil, without naming countries)

Annex 2: Technical and organisational security measures

1. Encryption. All traffic uses HTTPS (TLS). Data at rest is encrypted by the hosting provider. Secrets such as sign-in tokens, connection keys, Google tokens, a Studio’s Brevo API key and a Studio’s Focus NFe API token are additionally encrypted by elastudio (AES-GCM) before storage and are never shown again after saving. The Studio’s digital certificate for NFS-e stays with Focus NFe; elastudio never holds it. Brevo’s unsubscribe notifications to elastudio are authenticated by a random bearer token that elastudio stores only as a hash.
2. Separation between studios. Every record carries the studio it belongs to; every query is limited to that studio; sessions are bound to one studio. One studio is prevented from reading another’s data, and automated tests check this before every release.
3. Access control. Studio staff have roles with least privilege (for example, teachers see members’ names only, and the optional profile photo of members booked or waitlisted in their classes, not their contacts or notes). Refunds require a specific permission. elastudio’s own access to production is limited to one authorised person, through Cloudflare Access with Google sign-in and two-step verification, and is logged. elastudio looks at a Studio’s member data only to provide support the Studio asked for, to fix a problem or to protect security. elastudio’s internal back office shows the owner’s and staff’s contact details and counts and totals that identify no member (section 2.4A). If elastudio adds a support access tool, it will require the owner’s approval, be time-limited, read-only by default and logged, and this Annex will be updated before it is used.
4. Authentication. Sign-in by one-time e-mail link and code, or Google. Members may also create an optional password, stored only as a salted hash (PBKDF2), with sign-in attempts limited. The Studio’s owner and staff may sign in with a password only together with two-step verification by an authenticator app (time-based one-time codes; the password stored as a salted PBKDF2 hash, the shared secret encrypted with AES-GCM, backup codes kept only as hashes, each code accepted once, wrong codes limited per person and per network address, and an e-mail to the person on every change). No passwords are generated or e-mailed. Sessions use secure, HttpOnly cookies, and tokens for the embedded widget are short-lived and rotated with reuse detection.
5. Payments. Card data never reaches elastudio; it is entered directly into Stripe, a PCI DSS Level 1 service provider.
6. Logging and audit. Security-relevant actions (imports, refunds, staff changes, data deletions, support access, password and two-step verification changes, and support resets of sign-in) write an append-only audit log.
7. Data minimisation. Address, city, state or province, postal code and gender in member, staff and teacher profiles are optional, never required to book and hidden from teachers; staff and teacher details are seen only by the Studio’s owner and admins and by the person; a private-session location is stored on that session only. Health notes are optional and need recorded consent. Teachers’ calendars are read only as busy and free periods. Bug reports have contact details removed automatically before any text is sent to the AI triage provider, and screenshots never leave elastudio’s storage. Profile photos have location, camera and other hidden details removed before storage.
8. Resilience and backups. Hosted on Cloudflare’s network. The database has point-in-time recovery for 30 days (Cloudflare D1 Time Travel on the Workers Paid plan) and nightly backups kept for 30 days. Stored files (Cloudflare R2) have no separate backup.
9. Secure development. Changes are checked by automated tests (including security tests) and reviewed before release; dependencies are audited.
10. Incident response. A written incident response plan with roles, severity levels, containment steps and the deadlines in section 7; an incident log kept for at least five years; an after-action review after every incident.
11. Sub-processor management. Providers are chosen for their security certifications (for example Cloudflare: SOC 2 Type II and ISO 27001; Stripe: PCI DSS Level 1) and bound by written data processing terms.
12. People. Confidentiality obligations; two-step sign-in on every administrative account (Cloudflare, Stripe, Google, GitHub, password manager).

Annex 3: ANPD standard contractual clauses (Brazil)

Annex 3 is published as a separate document in Portuguese: Anexo 3: Cláusulas-padrão contratuais da ANPD (elastudio.app/legal/dpa/anpd-clauses). It reproduces Sections I, II and III of Annex II of Resolução CD/ANPD nº 19/2024 in full and without change, completed with the information in section 11.2 of this DPA, and adds Section IV (additional clauses). It forms part of this DPA. If the ANPD changes or replaces the clauses, the parties will adopt the new version within the period the ANPD sets, and elastudio will tell the Studio.