Privacy Policy

1. Controller and data protection officer

Today Brazil is the controller of the personal data described in this Policy and is accountable for decisions about its processing.

Data protection officer (DPO): privacidade@todaybrazil.tech. Use this channel to exercise your rights, ask questions about this Policy or file a complaint.

2. Data we collect

• Registration: name, email, optional phone and company, and a password protected by Supabase Auth. We never see it in plain text.
• Preferences: edition language, delivery region and time zone, and the sectors, verticals and monitors that make up your coverage.
• Subscription: plan, billing cycle, currency and billing country.
• Country inferred from your IP address at subscription time, to set the currency and payment method. We store only the country code (BR, for example). We do not store the IP address itself.
• The email address of anyone who signs up through the footer list, with the date and origin of the signup and the chosen language, which sets the language the newsletter arrives in.
• Email (and, on the website, first name) submitted to request the free Morning Brief, with the language, the page and the campaign that brought the visit. The subscription exists only once the person confirms through the link sent to their own email.
• Technical operation and security records generated by the infrastructure that serves the site.

3. Why we process it, and on what legal basis

• To deliver the daily edition and to create and administer your account and subscription. Legal basis: performance of a contract (art. 7, V).
• To set the currency and payment method from your country of access, and to protect the platform against fraud and abuse. Legal basis: legitimate interest (art. 7, IX).
• To send the free weekly newsletter to anyone who signs up through the footer list. Legal basis: consent (art. 7, I), which you can withdraw at any time through the unsubscribe link in every edition, without having to contact anyone.
• To send the confirmation link to anyone who requests the free Morning Brief and to follow up on the request until it is confirmed. Legal basis: preliminary steps at the data subject's request (art. 7, V). After confirmation, daily delivery is based on consent (art. 7, I), revocable through the unsubscribe link in every edition.
• To measure visits and interactions through Google Analytics and evaluate ad effectiveness through Meta Pixel. Legal basis: consent (art. 7, I). The tools load only after permission is granted.
• When you allow analytics, to associate a social-content visit with the start of a checkout. We store the content ID, platform and visit time with the checkout session. Legal basis: consent (art. 7, I). A visit is not treated as a purchase or received revenue.
• To comply with legal, regulatory and tax obligations. Legal basis: art. 7, II.

4. Cookies and browser storage

Today Brazil uses Google Analytics for audience measurement and Meta Pixel to measure ad effectiveness, only after you choose Accept in the notice shown on the site. Without that permission, these scripts are not loaded. We do not sell this data.

You may reject measurement without losing any functionality. Your choice is stored in your browser's local storage; after you clear the site's data, the notice will be shown again.

What is kept in your browser, and which you can clear at any time through your browser's privacy settings:

• Chosen language: stored locally so the site opens in the language you prefer. Functional purpose.
• Supabase authentication session: stored locally while you are signed in, to keep you logged in. Strictly necessary: clearing it ends the session.
• Source of a social-content visit: stored in this browser session for up to seven days only if you accept analytics; it can be associated with a checkout started during that period.

5. Who we share it with

We do not sell personal data and never release it for third-party advertising. We share the minimum necessary with the processors that make the service work:

• Supabase: database and authentication.
• Vercel: hosting for the site and API routes.
• Inngest: scheduling and execution of the routines that build and dispatch the edition.
• Resend: email delivery.
• Cloudflare R2: storage for the official documents attached to the edition.
• Datawrapper: displays the interactive charts in the weekly report. The embedded charts set no cookies or identifiers.
• Google Cloud (Vertex AI): processes the editorial content of the edition. No subscriber data reaches it: the edition is produced once, for everyone, and only filtered by preference at delivery time.
• Google Analytics: audience and site-interaction measurement, only for visitors who authorize this collection.
• Meta: page-view and advertising-effectiveness measurement through Meta Pixel, only for visitors who authorize this collection.
• Public authorities, when required by law or court order.

6. International transfer

The processors above hold data on servers outside Brazil. This international transfer relies on specific contractual clauses under art. 33, II of the LGPD, including the standard contractual clauses approved by ANPD Resolution 19/2024.

You may request information about the safeguards applied to each processor through the data protection officer at privacidade@todaybrazil.tech.

7. How long we keep it

• Account and subscription data: for as long as the subscription exists and, after it ends, for the period required by legal and tax obligations.
• Footer list email: until you unsubscribe, through the link at the bottom of any weekly edition.
• Subscribers: you can unsubscribe from the daily edition at any time, through the link at the bottom of any edition.
• Application access logs: six months, under art. 15 of Brazil's Internet Civil Framework (Law 12.965/2014).
• Free Morning Brief request that was not confirmed: deleted within 30 days. Once the person confirms, the request is deleted immediately and the subscription record applies.

8. Your rights

Brazilian law grants you, at any time and free of charge:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate or outdated information.
• Anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully.
• Portability of your data to another provider.
• Information about who we share your data with, and about your option to refuse consent.
• Withdrawal of consent and objection to processing based on legitimate interest.
• Exercise any of these by writing to privacidade@todaybrazil.tech, or file a complaint directly with Brazil's National Data Protection Authority (ANPD).

9. Security

Passwords are stored protected by Supabase Auth, database access is restricted by row-level security policies, and the site is served over HTTPS only, with a content security policy and protective headers. No measure removes all risk, but we keep access to the minimum needed to operate the service.

10. Changes to this Policy

When this Policy changes, we update the date at the top. If a change affects the legal basis of any processing, or introduces collection that does not exist today, we will notify you by email before it takes effect.