Privacy Notice
Last updated: May 2026
1. Who is responsible
Controller: João Maia (joao@joaovrmaia.com)
Website: joaovrmaia.com — consulting, content, and lead capture.
For privacy questions or to exercise your rights under Brazil's Lei Geral de Proteção de Dados (LGPD), email joao@joaovrmaia.com. I respond personally; there is no separate DPO because I am the sole operator of this site.
2. What this notice covers
This notice describes how personal data is processed when you browse the site, submit contact or service forms, subscribe to the newsletter, or interact with blog highlights. It does not cover third-party sites linked from here (LinkedIn, GitHub, Substack, etc.).
3. Data we collect
| Context | Data | How |
|---|---|---|
| Contact / services forms | Name, email, company (optional), message or problem description, page language; IP stored only as SHA-256 hash | You submit the form |
| Newsletter | Email, language preference, confirmation and unsubscribe timestamps | You subscribe and confirm via email link (double opt-in) |
| First-party analytics | Page path, language, referrer (without query string), UTM tags, pseudonymous visitor id; IP and browser stored only as SHA-256 hashes; session cookie id | Automatic on page views and limited client events (form start, time on page) |
| Blog highlights & likes | Selected quote text (public), pseudonymous reader hash | You select text on a post |
| Technical cookies | Session id, CSRF token, language preference | Browser cookies required for security and i18n |
We do not use Google Analytics, advertising pixels, or other third-party trackers. We do not intentionally collect sensitive data (health, biometrics, etc.); please avoid including such information in free-text fields.
4. Purposes and legal bases (LGPD Art. 7)
- Respond to your message or inquiry — execution of pre-contractual steps at your request (Art. 7, V) and legitimate interest in answering qualified inbound contact (Art. 7, VI).
- Send the newsletter — your consent after double opt-in (Art. 7, I). You may withdraw consent at any time via the unsubscribe link.
- Measure site usage and improve content — legitimate interest (Art. 7, IX) in understanding aggregate traffic and conversion funnels, with pseudonymization and limited retention.
- Security and abuse prevention — legitimate interest (Art. 7, IX), including rate limits, honeypots, and hashed IP for spam deterrence.
- Publish blog highlights you create — your voluntary act of publishing a selection on a public post (Art. 7, I / legitimate interest in community features).
5. Cookies and analytics
The site sets strictly necessary cookies (session, CSRF) and may store your language choice. First-party analytics runs without third-party cookies. IP addresses and user-agent strings are never stored in plain text — only salted SHA-256 hashes.
Page-view records are deleted automatically after 90 days.
6. Processors (operators)
Form, newsletter, and analytics data stay on a VPS in Brazil (hosting and email via Brazilian providers where applicable). Each provider acts as a processor under my instructions.
DNS: the domain is managed in Amazon Route 53 (AWS). AWS processes DNS records and resolution metadata; it does not receive form content or database data. A full list is kept internally — request it by email if needed.
Email notifications from forms are delivered to my inbox via SMTP.
7. Retention
- Analytics page views: 90 days, then deleted.
- Contact and service inquiries: up to 36 months after last interaction, then deleted unless a longer period is required for legal defence.
- Newsletter: while subscribed; after unsubscribe, email and consent history kept up to 36 months for proof of consent, then deleted.
- Blog highlights: until you request removal or I moderate them.
- Database backups: rolling retention on the server (14 days); off-site encrypted copies follow the same policy documented internally.
8. Security
HTTPS, hardened production settings, hashed identifiers in analytics, rate limiting on forms, and access restricted to me. No system is perfectly secure; I notify affected individuals and the ANPD when required by law if a relevant incident occurs.
9. Your rights (LGPD Art. 18)
You may request:
- Confirmation of processing and access to your data
- Correction of incomplete or outdated data
- Anonymization, blocking, or deletion of unnecessary or non-compliant data
- Portability, where applicable
- Information about sharing with processors
- Revocation of consent (newsletter)
Send requests to joao@joaovrmaia.com from the email address concerned (or explain why you cannot). I will respond within a reasonable time (target: 15 days).
10. International transfers
Primary processing (application and database) remains in Brazil. DNS is provided by Amazon Route 53 (AWS), which may involve processing or access outside Brazil under contractual safeguards (AWS Data Processing Addendum). Any additional foreign processors will be listed here if added.
11. Changes
This notice may be updated. The date at the top will change; material changes will be highlighted when appropriate.
Contact: joao@joaovrmaia.com