Privacy Policy

The party responsible for processing your data (controller) is Lucas Khawali, an individual, located at Rua Rubens Robertoni, 86 — Jundiaí, SP, who operates the firstk service at https://www.firstkbloom.com.

Our data protection officer (DPO) can be reached at lucas.khawali@gmail.com.

We collect the following personal data when you use firstk:

• Account data: name and email.
• Child data: name or nickname and age or date of birth, provided by you as the parent or guardian.
• Answers to the developmental assessment questionnaire (FADA).
• Payment data processed by Stripe — we do not store your full card number.
• Usage and device data: pages visited, identifiers and technical browsing information.
• Cookies and advertising identifiers (Meta and Google pixels).

We use your data to:

• Provide the developmental assessment service and generate personalized results.
• Process payments and manage your access.
• Send transactional messages and, with your consent, marketing communications.
• Improve the product, security and user experience.
• Run marketing and remarketing on advertising platforms.

• Performance of a contract: to deliver the service you signed up for.
• Consent: for marketing and non-essential cookies.
• Legitimate interest: for security, fraud prevention and product improvement.
• Compliance with a legal or regulatory obligation.

firstk processes children's data in their best interest, solely for the purpose of developmental assessment. This data is provided and processed under the consent and responsibility of the parents or legal guardians, who may request access, correction or deletion at any time.

We share data only with processors that help us deliver the service, always limited to the purposes above:

• Stripe — payment processing.
• Resend — transactional email delivery.
• Loops.so — newsletters and product updates.
• Supabase — database and authentication.
• Vercel — application hosting.
• Meta and Google — advertising, measurement and remarketing.

Some of these processors may process data outside Brazil. In those cases, we apply appropriate safeguards for the international transfer, as required by the LGPD.

As a data subject, you may at any time request:

• Confirmation that processing exists and access to your data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary or non-compliant data.
• Data portability.
• Information about sharing and withdrawal of consent.

To exercise your rights, write to lucas.khawali@gmail.com.

We keep your data only for as long as necessary for the stated purposes or to comply with legal obligations, after which it is deleted or anonymized.

We apply technical and organizational measures to protect your data against unauthorized access, loss or alteration.

Cookie use is detailed in our Cookie Policy. This Privacy Policy may be updated; material changes will be announced on this page.