Privacy policy
Last updated: 19 September 2026
This is a translation. The original of this policy is written in Portuguese and was drafted for the laws in force in Brazil, mainly the General Personal Data Protection Law (LGPD, Law No. 13,709/2018). This English version is provided so that people and organisations outside Brazil can read it. If there is any difference between the versions, the Portuguese original prevails.
This site is my portfolio: an informational, non-profit space that does not sell any product. I follow the visits to improve the site with data, and I do so while respecting the privacy of every person. Here is, in plain language, what happens to your data when you visit.
In short
- No analytics loads without your permission. If you decline, or simply ignore the notice, no analytics or advertising tool is loaded.
- I do not sell your data, I do not share it for other purposes and I do not ask you to sign up to use the site.
- You can change your mind at any time, using the “Cookie preferences” button in the footer or at the end of this page.
Who is responsible
Paulo Thiago, an individual based in Rio de Janeiro (RJ), Brazil, is the controller of the data processed on this site. For any privacy matter, write to [email protected].
As a small-scale processing agent (ANPD Board Resolution No. 2/2022), there is no appointed data protection officer (encarregado): this email is the contact channel for data subjects.
What happens to your data
1. Analytics, only with your consent
Tools: Google Analytics 4 (Google) and Microsoft Clarity (Microsoft), loaded through Google Tag Manager.
What is collected: pages viewed, time on site, where you came from (Instagram or a search, for example), device type, browser, approximate city, scrolling, clicks and cursor movement. Clarity records the browsing session to build heatmaps; what you type into the form fields is never recorded. When you press “Send on WhatsApp” or “Send by email”, I record only the channel and the subject you chose, never your name, phone number or message.
Why: to understand which parts of the site are read, where people give up and what needs to improve.
Legal basis: consent (LGPD, art. 7, I).
How long: in Google Analytics, 14 months at most. In Clarity, recordings are kept for 30 days; those marked as favourites and a random sample may be kept for up to 9 months. Google uses the IP address only to estimate the approximate location and, according to Google, Analytics 4 does not log or store IP addresses.
2. Advertising, only with your consent
Tool: Meta Pixel (the company behind Facebook and Instagram).
Current status: no campaign is running. The Pixel is here so I can learn and test the setup, and to gather data that will help plan campaigns in the future.
What is collected: the pages you visited and what you did here, such as clicking to send a message, linked to a Meta identifier in your browser and, if you use Facebook or Instagram, to your account.
Why: to measure visits and to allow future ads for this work to be shown to people who have already visited the site (so-called remarketing). A person stays in that audience for up to 180 days. Meta may also use this information in its own advertising systems, under its own policy.
Legal basis: consent (LGPD, art. 7, I).
3. Contact form
The form does not send or store anything: it only writes the message and opens your WhatsApp or your email, and you check it before sending. Whatever you send arrives through one of those channels and is used to reply and follow up on your request. I keep these conversations while there is ongoing work or collaboration and delete them when you ask. WhatsApp and Gmail have their own privacy policies.
Legal basis: preliminary steps at your request and legitimate interest in replying to people who contacted me (LGPD, art. 7, V and IX).
4. Contributions via Pix
If you contribute through Pix (Brazil’s instant payment system), your bank shows me your name and the amount, as with any Pix transfer. I use this only to thank you and, if you ask, to issue a receipt.
5. Hosting
The site is hosted by Vercel. Like any server, it logs technical access data (IP address, browser, page requested) to deliver the site and protect it against attacks, for a limited time. Legal basis: legitimate interest in the security and operation of the site (LGPD, art. 7, IX).
6. Content from other sites shown here
- Previews of client websites. The websites section shows the sites live, so you can browse them without leaving. When it loads, each preview connects to the services that site uses (Google Fonts, Vimeo, Cloudflare and Google Calendar), which receive your IP address and browser, just as if you had opened the site directly. Cloudflare sets a security cookie to tell people from bots. The previews carry none of my analytics or advertising tools.
- Instagram video. It only loads when you click to watch it. From then on, Instagram may set its own cookies.
- External links (Instagram, WhatsApp, Google Calendar): once you click, the policy of that service applies.
7. Mão no Bolso newsletter (beta)
Mão no Bolso is a collection of resources for diverse communities, with a newsletter in which you choose what you want to receive.
What is collected: your email address, the countries and topics you chose and your language. No name, phone number or postal address.
Why: to send only the content you asked for. No other use.
Legal basis: consent (LGPD, art. 7, I), confirmed in two steps: you are only added to the list after clicking the link sent to your email.
How long: until you unsubscribe. Every email includes an unsubscribe link, which truly deletes your registration, keeping no copy. Subscriptions not confirmed within 30 days are also deleted.
Who helps: registrations are stored in a database at Neon, and emails are sent through Resend, from servers in São Paulo. Both process the data only to make this service work. The Mão no Bolso pages use no audience analytics or advertising tools, and the YouTube videos in the cards only load after a click.
Mão no Bolso forms
The site has four forms: sending material for a story, sending a donation receipt, requesting coverage and commenting on an article.
What is collected: the name you type, your email address, the message and, if you attach one, a PDF or an image. For comments, also the article you select. The attached file is not public: it only opens for people with a login to the admin panel.
Why: to read and reply to you. No comment is published on the site: comments help the editorial team know what matters to readers.
Legal basis: your request for contact and legitimate interest in replying to people who write (LGPD, art. 7, V and IX).
How long: while the matter is open. You can request deletion at any time through the email at the top of this page.
8. Error monitoring
I use Sentry (Functional Software, Inc.) to know when something breaks on the site or on Mão no Bolso and to fix it quickly. This is different from audience analytics: it does not count visits, it only records failures.
What is collected: when an error happens, the page, the browser and operating system, the time, the piece of code that failed and technical records of what the site was doing. No IP address, cookie, name, email, phone number or anything you typed is sent: this data is filtered out before it leaves your browser or the server. Sentry does not record the screen and does not use cookies.
Legal basis: legitimate interest in keeping the site working and secure (LGPD, art. 7, IX).
How long: up to 30 days, the retention period of Sentry’s free plan.
Cookies and what stays in your browser
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| Necessary, always on | |||
| consentimento-v1 | This site | Stores your cookie choice (stays on your device, is never sent) | Until you change or delete it |
| idioma-escolhido | This site | Avoids asking for the language again during the same visit (stays on your device) | Until you close the tab |
| __cf_bm | Cloudflare, in the previews | Security against bots | 30 minutes |
| Analytics, with consent | |||
| _ga, _ga_* | Google Analytics | Tells one visit apart from another | 2 years |
| _clck, _clsk | Microsoft Clarity | Links the pages of the same visit | 1 year (_clck) and 1 day (_clsk) |
| MUID | Microsoft (clarity.ms, bing.com) | Recognises the browser across Microsoft services | About 1 year |
| Advertising, with consent | |||
| _fbp | Meta | Recognises the browser to measure visits and build ad audiences | 90 days |
If you withdraw your consent, the site immediately deletes the analytics and advertising cookies set on its own domain, and Clarity deletes its own. Cookies set on third-party domains, such as MUID, can only be deleted by you, in your browser settings.
Data outside Brazil
Google, Microsoft, Meta, Vercel, Cloudflare, Neon, Resend and Sentry may process data on servers outside Brazil, mainly in the United States, and in Europe in the case of Sentry, under the contractual safeguards each company offers (LGPD, art. 33). Newsletter emails are sent from servers in São Paulo.
Your rights
Under the LGPD (art. 18), you may at any time:
- confirm whether I process your data and access it;
- correct incomplete or inaccurate data;
- request anonymisation, blocking or deletion of unnecessary data;
- request the portability of your data;
- find out with whom it has been shared;
- withdraw your consent;
- lodge a complaint with Brazil’s National Data Protection Authority (ANPD), at gov.br/anpd.
For any request, write to [email protected]. I reply within 15 days.
Children
This site is not directed at children and does not ask anyone for data in order to be used.
Changes to this policy
When something changes, I update this page and the date at the top.