UUDO
Institutional & Administrator Privacy Notice
Effective date: June 22, 2026
Introduction
This notice explains how UUDO processes the personal data of university administrators who use the UUDO administrator dashboard. The data controller responsible for this personal data is João Pedro Vartanian, who can be reached at privacy@uudo.app.
This notice is provided for transparency. It describes how UUDO processes personal data in connection with the service agreement between UUDO and your institution. It is not a contract, and it is not something you are asked to accept or agree to — the legal relationship that governs the service is the agreement between UUDO and your institution.
Who this notice is for
This notice applies to university administrators — staff of a partner institution who are given access to the UUDO administrator dashboard to manage their university’s presence on the platform.
It does not cover:
- Students and other app users: UUDO’s processing of student personal data is described in our Privacy Policy (uudo.app/privacy).
- UUDO’s own team members: UUDO staff personal data is handled under their employment or contractor relationship with UUDO, not under this notice.
- The terms of the institutional relationship: The commercial and contractual terms between UUDO and your institution are set out in the service agreement between the two organizations, not in this notice.
Personal data we process
We process the following personal data about university administrators:
| Category | Data |
|---|---|
| Account identity | Your name and the email address you use to sign in, together with your assigned role and permissions. |
| Administrator profile | Your name, institutional email address, department, office number, office location, office hours, and any profile photo or banner image you choose to add. |
| Institutional affiliation | The university you are associated with. |
| Technical records | The dates your account and profile were created and last updated. |
Legal basis for processing
We process administrators’ personal data on two legal bases under the LGPD (and, for administrators in the EU/EEA, the GDPR):
- Performance of a contract: processing necessary to provide the administrator dashboard under the service agreement between UUDO and your institution (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
- Legitimate interests: operating, securing, and supporting the platform (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).
This processing is not based on your consent. Because we rely on the service agreement with your institution and on our legitimate interests — not on consent — UUDO does not ask administrators to tick a consent box or to accept this notice. The absence of a consent step is intentional: it reflects the legal bases above and does not mean your data is processed without a lawful basis.
How and why we use your data
| Purpose | Legal basis |
|---|---|
| Creating and managing your administrator account | Contract |
| Authenticating you and securing access, including required two-factor authentication | Contract / legitimate interest |
| Showing an administrator directory within your institution | Contract |
| Providing support and operating the platform | Legitimate interest |
Who can access your data
| Who | What they can access |
|---|---|
| You | Your own account and administrator profile. |
| Other administrators at your university | Your administrator profile, visible only to other administrators within your own institution. Administrators at other institutions cannot see it. |
| The UUDO team | UUDO staff can access administrator data in order to operate and support the platform. |
| Our infrastructure providers | We use Supabase to host the platform; it processes data on our behalf under appropriate safeguards. |
| Our communication and support providers | We use Resend to send administrator account and invitation emails (your name and email address) and Atlassian Jira to handle support requests you submit (your message, name, and email). Each processes data on our behalf under appropriate safeguards. |
International data transfers
UUDO’s infrastructure and several of our providers are located in the United States, so your personal data is processed outside Brazil and outside the EU/EEA. These transfers are carried out on the basis of our legitimate interests in operating UUDO, subject to oversight by the ANPD (LGPD Art. 33, VIII) and, for EU/EEA users, on the basis of standard contractual clauses or other lawful mechanisms under Chapter V of the GDPR.
How we protect your data
All data is transmitted over encrypted connections (TLS/HTTPS).
We require two-factor authentication (TOTP) for all administrators, and we enforce database-level access controls so that each university’s data stays separate.
No method of storage or transmission is completely secure, but we protect your data using industry-standard measures.
How long we keep your data
We keep administrator personal data for as long as you hold an administrator role and your institution’s service agreement with UUDO remains in effect. When your role ends or the agreement concludes, we delete or anonymize your personal data, except where we need to keep it to comply with a legal obligation or to resolve a dispute.
UUDO is in beta and is in the process of formalizing a data processing agreement with partner institutions; specific retention periods will be confirmed as part of that agreement.
Your rights
Under the LGPD (Art. 18), you have the right to:
- confirm that we process your data, and access it;
- correct incomplete, inaccurate, or outdated data;
- anonymize, block, or delete data that is unnecessary, excessive, or processed unlawfully;
- request the portability of your data to another provider;
- be informed about the public and private entities with which we share your data.
If you are in the EU or EEA, the GDPR also gives you the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing. To exercise any of these rights, email privacy@uudo.app. We will respond within the timeframes set by law.
Data Protection Officer (Encarregado)
We have designated a Data Protection Officer to serve as the point of contact between you, UUDO, and the data protection authorities on any question about how we handle your personal data. Under the LGPD (Art. 41) this role is the Encarregado; under the GDPR (Arts. 37–39) it is the Data Protection Officer (DPO).
Our designated Encarregado and Data Protection Officer is João Pedro Vartanian, who can be reached at privacy@uudo.app. You may contact this address to exercise any of the rights described above or to raise any concern about how your personal data is handled.
Changes to this notice
We may update this notice as UUDO evolves. When we do, we will revise the effective date at the top of this notice. For material changes, we will notify administrators by email or within the dashboard.
Contact
For any question about this notice or your personal data, contact the data controller, João Pedro Vartanian, at privacy@uudo.app.