Privacy Notice
Last updated: May 2026
1. Who is responsible
Controller: João Maia (joao@joaovrmaia.com)
Website: joaovrmaia.com — consulting, content, and lead capture.
For privacy questions or to exercise your rights under Brazil's Lei Geral de Proteção de Dados (LGPD), email joao@joaovrmaia.com. I respond personally; there is no separate DPO because I am the sole operator of this site.
2. What this notice covers
This notice describes how personal data is processed when you browse the site, submit contact or service forms, subscribe to the newsletter, or interact with blog highlights. It does not cover third-party sites linked from here (LinkedIn, GitHub, Substack, etc.).
3. Data we collect
| Context | Data | How |
|---|---|---|
| Contact / services forms | Name, email, company (optional), message or problem description, page language; IP stored only as SHA-256 hash | You submit the form |
| Newsletter | Email, language preference, confirmation and unsubscribe timestamps | You subscribe and confirm via email link (double opt-in) |
| First-party analytics | Page path, language, referrer (without query string), UTM tags, pseudonymous visitor id; IP and browser stored only as SHA-256 hashes; session cookie id | Automatic on page views and limited client events (form start, time on page) |
| Google Analytics (opt-in) | Page views and standard GA4 event data, pseudonymous client id, Google advertising/analytics cookies | Only runs after you accept the cookie banner; declining or ignoring the banner means it never loads |
| Blog highlights & likes | Selected quote text (public), pseudonymous reader hash | You select text on a post |
| Technical cookies | Session id, CSRF token, language preference | Browser cookies required for security and i18n |
Besides the first-party analytics above, the site uses Google Analytics (GA4), gated behind an opt-in cookie banner — it does not load or set any cookie until you accept. We do not use advertising pixels or any other third-party tracker. We do not intentionally collect sensitive data (health, biometrics, etc.); please avoid including such information in free-text fields.
4. Purposes and legal bases (LGPD Art. 7)
- Respond to your message or inquiry — execution of pre-contractual steps at your request (Art. 7, V) and legitimate interest in answering qualified inbound contact (Art. 7, VI).
- Send the newsletter — your consent after double opt-in (Art. 7, I). You may withdraw consent at any time via the unsubscribe link.
- Measure site usage and improve content — legitimate interest (Art. 7, IX) in understanding aggregate traffic and conversion funnels, with pseudonymization and limited retention. Google Analytics runs only with your consent (Art. 7, I), given via the cookie banner; you can withdraw it at any time (section 5).
- Security and abuse prevention — legitimate interest (Art. 7, IX), including rate limits, honeypots, and hashed IP for spam deterrence.
- Publish blog highlights you create — your voluntary act of publishing a selection on a public post (Art. 7, I / legitimate interest in community features).
5. Cookies and analytics
The site sets strictly necessary cookies (session, CSRF) and may store your language choice. First-party analytics runs without third-party cookies. IP addresses and user-agent strings are never stored in plain text — only salted SHA-256 hashes.
Page-view records are deleted automatically after 90 days.
Google Analytics: the cookie banner shown on first visit defaults all Google
consent signals (analytics and advertising) to denied. If you click "Accept", Google
Analytics cookies are set and page views are sent to Google; if you click "Decline" or ignore
the banner, nothing is sent to Google. Your choice is remembered in your browser
(localStorage) and you can change it at any time by clearing that storage, which
brings the banner back on your next visit.
6. Processors (operators)
The site runs on Vercel (application hosting and compute) with a Neon Postgres database (form, newsletter, and analytics data). Both are US-based infrastructure providers. Transactional email (form notifications, newsletter confirmation and unsubscribe links) is delivered via Resend, also a US-based provider. If you accept the cookie banner, Google Analytics (Google Ireland Limited / Google LLC) also processes pseudonymous usage data — see section 5. Each provider acts as a processor under my instructions.
DNS: the domain is managed in Amazon Route 53 (AWS). AWS processes DNS records and resolution metadata; it does not receive form content or database data. A full list is kept internally — request it by email if needed.
7. Retention
- Analytics page views: 90 days, then deleted.
- Contact and service inquiries: up to 36 months after last interaction, then deleted unless a longer period is required for legal defence.
- Newsletter: while subscribed; after unsubscribe, email and consent history kept up to 36 months for proof of consent, then deleted.
- Blog highlights: until you request removal or I moderate them.
- Database backups: rolling retention on the server (14 days); off-site encrypted copies follow the same policy documented internally.
8. Security
HTTPS, hardened production settings, hashed identifiers in analytics, rate limiting on forms, and access restricted to me. No system is perfectly secure; I notify affected individuals and the ANPD when required by law if a relevant incident occurs.
9. Your rights (LGPD Art. 18)
You may request:
- Confirmation of processing and access to your data
- Correction of incomplete or outdated data
- Anonymization, blocking, or deletion of unnecessary or non-compliant data
- Portability, where applicable
- Information about sharing with processors
- Revocation of consent (newsletter)
Send requests to joao@joaovrmaia.com from the email address concerned (or explain why you cannot). I will respond within a reasonable time (target: 15 days).
10. International transfers
Primary processing (application hosting via Vercel, the database via Neon, and transactional email via Resend) occurs outside Brazil, on US-based infrastructure. DNS is provided by Amazon Route 53 (AWS), also US-based. These transfers rely on the contractual safeguards each provider offers (standard contractual clauses / data processing addenda) as the transfer basis required by LGPD Art. 33. If you accept Google Analytics, Google also processes data outside Brazil under its own data processing terms. Any additional foreign processors will be listed here if added.
11. Changes
This notice may be updated. The date at the top will change; material changes will be highlighted when appropriate.
Contact: joao@joaovrmaia.com