Privacy Policy

The controller responsible for operating the platform is GL Estrategias Digitais Ltda. (Overclock), CNPJ 29.231.457/0001-99.

Overclock is the controller of the data necessary to operate its own platform, account, subscription, payments, support, security, community, Discord/Founders, and communications.

Overclock's Data Protection Officer (DPO) is Guilherme Laschuk.

The official channel for privacy, LGPD, personal data, exercising data subject rights, and communications with the ANPD (Brazil's data protection authority) is [email protected]. The community and moderation channel is [email protected].

When you create an account, sign in to the dashboard, or use Google OAuth login, we may process data necessary to authenticate you, maintain your session, identify your account, and unlock access to contracted features.

• Data: email, user identifier, authentication provider, basic account metadata, session, and authentication status.
• Google OAuth: when you choose to sign in with Google, we may receive your Google account identifier, email, name, and profile picture, according to the scopes you authorize.
• Purpose: create an account, authenticate, maintain a session, prevent abuse, recover access, and unlock features.
• Legal basis: performance of a contract or pre-contractual steps; legitimate interest for security and abuse prevention.

When you start checkout, subscribe, cancel, or change your plan, we process data necessary for billing, unlocking access, financial support, fraud prevention, and compliance with legal obligations.

• Data: email, plan, subscription status, customer and subscription IDs in the payment processor, checkout events, billing status, and operational metadata.
• Payment methods: sensitive financial data, such as card details, is processed by Stripe or an equivalent processor, under that provider's own terms and policies.
• Purpose: unlock access, bill, cancel, reconcile payment, prevent fraud, provide support, and comply with tax, accounting, or legal obligations.
• Legal basis: performance of a contract, compliance with a legal obligation, fraud prevention, and regular exercise of rights.

When you join the community, connect Discord to Overclock, or use Founders benefits, we process the minimum data needed to operate the community, sync roles, and enforce security and moderation rules.

• Data: Discord ID linked to your account, subscription status calculated from your subscription, transient role-sync results, community messages, reports, and moderation records where applicable.
• Purpose: administer the community, sync roles, enforce rules, protect members, respond to reports, and preserve evidence of abuse or incidents.
• Legal basis: performance of a contract when a paid benefit is involved; legitimate interest for moderation, security, and abuse prevention; regular exercise of rights when necessary.
• Independent third party: Discord also applies its own terms, policies, logs, and data-handling practices.

Experimental features, waitlists, overLabs, and forms may collect additional data you provide voluntarily.

• Data: email, phone number provided, Discord name, YouTube name, open-ended answers, experimental focus, application status, and risk acceptance, sent to a CRM provider when you apply.
• Purpose: select participants, run tests, understand usage profile, get in touch, unlock access, and improve experimental features.
• Legal basis: pre-contractual steps related to a contract, legitimate interest in product improvement, and consent when the collection is optional.

When you request support, report an error, access pages, or interact with protected flows, we may process technical information proportional to resolving the issue, protecting the platform, and complying with legal obligations.

• Data: support messages, error descriptions, screenshots you send, masked logs, technical events, reports, abuse records, and security metadata.
• IP and user-agent: may appear in infrastructure or security logs. For acceptance evidence controlled by Overclock, we prefer ip_hash and user_agent_hash instead of raw IP or full user-agent.
• Error monitoring: when Sentry or an equivalent tool is active, we may send minimized error events, stack traces, and technical metadata for diagnostics, without sending cookies, authentication headers, request bodies, email, user ID, or IP, by intentional configuration.
• Purpose: support, auditing, security, fraud prevention, rate limiting, incident investigation, defense of rights, and compliance with legal obligations.
• Legal basis: legitimate interest, performance of a contract, compliance with a legal obligation, and regular exercise of rights.

We use cookies and local storage necessary for authentication, security, login redirection, handoff with the desktop app, consent preferences, and basic site operation.

Optional analytics, affiliate, advertising, or attribution scripts, such as Google Analytics, FirstPromoter, and the OpenAI advertising pixel, only load after you accept the cookie banner. If you decline, the site keeps working, but analytics metrics, referrals, and commercial attribution may not be recorded.

• Session and authentication: Supabase/Auth session storage/cookies or equivalents, necessary for login and security.
• Temporary redirection: cookies such as auth_next, desktop, desktop_qa, desktop_dev, desktop_state, and desktop_flow may be used for a few minutes to complete login, callback, and handoff with the desktop app.
• Consent preference: overclock:cookie-consent:v1 records in the browser whether you accepted or declined optional scripts.
• Analytics: _ga and _ga_* may be used by Google Analytics after acceptance to measure aggregate site usage.
• Affiliates and attribution: overclock:fpr, overclock:fpr-param, and overclock:fpr-test-mode may be used after acceptance to preserve referral codes; the attribution provider may also use its own cookies.
• Advertising: the OpenAI advertising pixel may load after acceptance to measure visits, registrations, checkout starts, and purchases coming from campaigns; the provider may use its own cookies. These events only send the signal that the action happened and, for purchases, the transaction amount and currency — never a name, email, account identifier, tax ID, or payment data.
• Media attribution: first-party cookies oc_gclid, oc_touch, and oc_touch_last store technical ad-click identifiers (gclid/fbclid), utm parameters, landing page, and referrer, with no personal data. On purchase, these identifiers and the pseudonymous analytics identifier may be linked to the transaction to measure which campaign drove the sale.
• Legal basis: performance of a contract or legitimate interest for necessary cookies; consent for optional affiliate, analytics, or marketing cookies.

To protect you, your clients, and the community, do not send data that isn't necessary for support or participation.

• API keys, bearer tokens, refresh tokens, passwords, cookies, .env files, secrets, private keys, and signed URLs.
• Database dumps, full logs, OAuth callbacks, unmasked screenshots, or confidential client data.
• Sensitive personal data, financial data, documents, health data, or data belonging to children/teenagers.
• Material protected by NDA, contract, trade secret, copyright, or professional confidentiality without authorization.

• Perform a contract and deliver account, subscription, benefits, downloads, licenses, Discord roles, and contracted features.
• Comply with legal, tax, accounting, regulatory, and rights-defense obligations.
• Protect the platform, prevent fraud, abuse, improper chargebacks, incidents, malicious use, and security violations.
• Respond to support, reports, privacy requests, and the exercise of data subject rights.
• Operate the community, moderation, overLabs, participant selection, and experimental features.
• Send necessary communications about account, billing, security, terms, privacy, and relevant changes.

We may share data with vendors necessary to operate the platform, always proportionally to the purpose.

• Supabase/Auth/database for authentication, account, and operational storage.
• Stripe or an equivalent processor for checkout, billing, subscription, taxes, and fraud prevention.
• Discord for community, OAuth, identification, and role syncing when you connect your account.
• ActiveCampaign or an equivalent CRM to receive overLabs form submissions, organize participant selection, and related operational communications.
• Google OAuth for login/sign-up when you choose that option.
• Google Analytics for aggregate site usage analysis, only after optional cookie acceptance when configured.
• Cloudflare Turnstile or an equivalent mechanism for abuse protection where applicable.
• FirstPromoter or an equivalent tool for affiliates/attribution, only when the feature is active and there is acceptance for optional scripts.
• OpenAI, as an advertising platform, to measure visits and registrations coming from campaigns, only after optional cookie acceptance.
• Sentry or an equivalent tool for error and security monitoring, with minimization and filters to avoid sending PII, cookies, sensitive headers, or request bodies, by intentional configuration.
• AI providers you configure; in that case, your requests also follow those providers' own terms and policies.

Overclock is designed to be local-first. Code, files, prompts, workspace, and terminal should not leave your machine to reach Overclock, except when a feature, support request, integration, or your own action requires sending it.

When you use an AI provider you configured, the request may be sent to the provider you chose, according to your settings, terms, policies, and keys.

We keep data for as long as necessary to operate the account, perform the contract, deliver benefits, comply with legal obligations, prevent fraud, protect the platform, respond to requests, preserve acceptance evidence, and exercise rights.

Billing data may be retained for the period required by legal, tax, accounting, and rights-defense obligations. Community/moderation data may be kept when necessary for security, investigation, abuse, incidents, or defense. Cookie preferences stay in your browser until you clear local data or we change the consent version.

You may request confirmation of processing, access, correction, portability where applicable, deletion, information about sharing, objection, and other rights under the LGPD, through the [email protected] channel.

Some requests may depend on identity verification and may be limited by legal obligations, fraud prevention, security, defense of rights, or proportional technical impossibility.

We adopt reasonable security and minimization measures, including a preference for technical hashes for acceptance evidence instead of raw IP and full user-agent.

If we identify a security incident involving personal data under Overclock's responsibility, we will assess the risk, adopt appropriate measures, and make the communications required by applicable law.

This Policy may change to reflect changes in the product, vendors, legal obligations, or security practices. Material changes may require new acceptance or a highlighted notice.

This Policy was originally written in Portuguese and translated into English for convenience. In case of any conflict, ambiguity, or divergence between the Portuguese and English versions, the Portuguese version prevails.