Skip to content

Privacy policy

Under review

This text is still under review, and the details of the company responsible will be published soon.

Last updated: October 27, 2026.

This is a translation of the Portuguese version of this Privacy Policy. In case of any discrepancy, the Portuguese version prevails.

This policy explains which personal data Indicora (indicora.com) processes, for what purpose, with whom it is shared, how long it is kept and how you can exercise your rights, under the Brazilian General Data Protection Law (Law No. 13,709/2018, the LGPD). It complements the Terms of Use.

1. Who the controller is

The controller of your personal data is Indicora, also referred to here as “we”.

For any matter regarding your data, contact us through our contact page.

2. What data we process

Browsing without an account

You can read the site without identifying yourself. Even so, as with any website, the servers record the IP address and the date and time of each access (access logs), along with technical request data, such as the browser used.

Account

Sign-in is done only with your Google account, using the OpenID Connect protocol with the openid, email and profile scopes. We do not ask for or store a password. For the account, we store:

  • your Google account identifier (the “sub”);
  • your email address, already verified by Google;
  • your name and the address of your profile picture;
  • the date the account was created and of the last sign-in;
  • your role on the site: reader, author, editor or administrator (team roles are granted by invitation only).

Sessions

Each sign-in creates a session. For it, we store the hash of the token kept in your cookie (never the token itself), the IP address, the browser’s user agent, the creation date and the date of last use. The session is valid for 30 days, renewed with each use.

Supporter subscription

Payment is made through Stripe, by card or Pix. Indicora does not see or store your card details. We store your Stripe customer and subscription identifiers, the subscription status, the plan and the end date of the paid period. Tax records of the charges are kept for the period required by law.

Newsletter

The newsletter is being rolled out. A subscription only takes effect after you confirm your address through the link we send by email (double opt-in). We store your email address and the consent record: date, IP address, user agent and the origin of the subscription (where on the site it was made).

Audit trail

Actions taken by the team (authors, editors and administrators) in the editorial panel are logged, for security and to know who published or changed what.

Messages you send us

If you write to us, we use your address and the content of the message to reply, and keep the conversation for as long as needed to handle the matter.

3. What we use the data for and on what legal basis

We only process data under one of the legal bases in article 7 of the LGPD:

  • Performance of a contract: creating and maintaining your account, authenticating you and managing the supporter subscription.
  • Legitimate interest: keeping the site secure, preventing fraud and abuse, and producing aggregate usage metrics that do not identify you.
  • Legal obligation: keeping the access logs required by the Brazilian Internet Civil Framework (Marco Civil da Internet) and the tax records of the charges.
  • Consent: sending the newsletter and using measurement and advertising cookies. You can withdraw your consent at any time, without affecting what was done before.

We do not sell personal data.

4. Cookies and local storage

Currently the site only uses cookies that are necessary for it to work, which do not depend on consent:

  • __Host-ind_session: keeps your session after sign-in. It is not accessible to JavaScript (HttpOnly) and lasts 30 days, renewed with each use.
  • __Host-ind_oauth: exists only during sign-in, for up to 10 minutes, and protects against forgery of Google’s response.
  • ind_hint: only tells whether there is a session and whether you are a supporter, so the menu can adjust without waiting for the server. It is readable by JavaScript, lasts 30 days and does not authorize anything on its own.
  • ind_consent: stores your choice in the cookie banner (the accepted categories, the policy version and the date), also in your browser’s local storage. It lasts 1 year; after that, or when the policy changes, the banner asks again.
  • ind_locale: stores the language you picked in the footer (Portuguese or English). It is only set when your choice differs from your browser’s language, which is used by default, and lasts 1 year.

Your light or dark theme preference is kept in your browser’s local storage (localStorage) and is not sent to us.

Measurement and advertising cookies, including Google’s, are only used if you consent in the cookie banner. You can change your choice at any time through the same banner.

5. Ads

The site may display Google ads (AdSense). With your consent, Google may use cookies to measure and personalize ads, under its own privacy policy. Without consent, these cookies are not used. Supporters do not see ads.

6. Who we share data with

We only share data with suppliers needed for the site to work, each limited to what it needs for its service:

  • Google: sign-in with your Google account and, when applicable, ad delivery.
  • Stripe: processing of supporter subscription payments.
  • Vercel: hosting of the site, with functions running in the United States.
  • Oracle Cloud: hosting of the API and the database, in Ashburn, United States.
  • Cloudflare: DNS, API proxy, and storage of images and backups.
  • Email delivery provider: not yet contracted; it will be listed here before it starts receiving data.

We may also share data when required by law or court order, or to defend Indicora’s rights in judicial, administrative or arbitration proceedings.

7. International transfer

Your data is processed in the United States, where the site hosting, the API and the database are located. This transfer is based on article 33 of the LGPD, with the standard contractual clauses approved by the ANPD (CD/ANPD Resolution No. 19/2024) or equivalent safeguards offered by the suppliers.

8. How long we keep data

  • Account: for as long as it exists. When you delete your account, we erase your personal data, except for the minimum the law requires us to keep, unlinked from you.
  • Sessions: until you sign out, end them in the account area, or 30 days pass without use.
  • Access logs (IP, date and time): 6 months, as required by article 15 of the Brazilian Internet Civil Framework (Law No. 12,965/2014). They are kept even after the account is deleted, unlinked from you, and erased at the end of the period.
  • Subscription: tax records, for the period required by tax law.
  • Newsletter: for as long as you are subscribed.
  • Audit trail: team actions remain logged, but are anonymized when the account of the person who took them is deleted.

9. Security

We adopt technical and organizational measures such as:

  • always-encrypted connections (HTTPS);
  • HttpOnly and Secure session cookies;
  • only the hash of the session token in the database, so a database leak does not allow anyone to sign in to your account;
  • access to data restricted to those who need it;
  • encrypted backups.

No system is completely immune to incidents. If an incident occurs that may cause you relevant risk or harm, we will notify you and the ANPD, as required by the LGPD.

10. Your rights

Under article 18 of the LGPD, you may request:

  • confirmation that we process your data;
  • access to the data;
  • correction of incomplete, inaccurate or outdated data;
  • anonymization, blocking or erasure of unnecessary or excessive data, or data processed in breach of the law;
  • portability of the data to another provider;
  • erasure of data processed based on your consent;
  • information about whom we share your data with;
  • information about the possibility of not giving consent and its consequences;
  • withdrawal of consent;
  • objection to processing carried out without consent, if it does not comply with the law;
  • review of decisions made solely on the basis of automated processing.

In the account area you can, without having to write to us:

  • export your data in JSON format;
  • see your open sessions and end any of them;
  • delete your account. Deletion cancels the subscription, ends all sessions, erases the link to your Google account and your personal data, and keeps only the minimum required by law, anonymized.

To unsubscribe from the newsletter, use the link included in every email; it works without signing in. Other requests can be made through our contact page. We respond within 15 days. We may ask for some confirmation of your identity before acting on a request, to protect your data.

If you are not satisfied with our response, you may file a complaint with the Brazilian National Data Protection Authority (ANPD).

11. Children and teenagers

The account and the subscription are intended for people aged 18 or over. Minors may only use them with the authorization and supervision of a parent or legal guardian. We do not knowingly collect data from children. If we learn that this has happened, we erase the data.

12. Data protection officer

Data subject requests and communications from the ANPD are handled through our contact page.

13. Changes to this policy

We may update this policy to reflect changes to the site, our suppliers or the law. The date at the top shows the current version. Material changes are announced on the site and, for account holders, by email, before they take effect.

Newsletter

Indicora's highlights in your inbox.