Privacy policy
What data this site processes, on what legal basis, for how long, and how to exercise your rights.
This is a static, personal site. It has no accounts, no login, no comments, and no advertising. There is exactly one place where personal data is processed: the contact form. This policy explains what happens to it, in the form required by article 9 of Brazil’s Law 13.709/2018, the General Data Protection Law (LGPD).
In short
- No cookies, first-party or third-party. See the cookie policy.
- No audience analytics, trackers, or advertising profiles.
- Nothing here relies on your consent — which is why there is no cookie banner for you to accept.
- If you write to me, your data is used to reply, and for nothing else.
- Nothing is sold, transferred, or used for advertising.
Who the controller is
The controller is Leandro Neves, a natural person, author of and responsible for this site.
As a small-scale processing agent, I am exempt from formally appointing a data protection officer under ANPD Resolution 2/2022 — but the same resolution requires me to publish a communication channel. That channel is the contact page, which also serves for exercising the rights described below. I do not publish an e-mail address on the site, to keep it out of automated harvesting.
What is processed
Contact form
When you send a message through the contact page, the following is processed:
| Data | Source |
|---|---|
| Name, e-mail, subject, and message | you type it |
| IP address, request headers, and timestamp | inherent to the connection |
Anti-abuse verification
The form uses Cloudflare Turnstile, a verification mechanism that tells people apart from bots without presenting puzzles. It analyzes technical browser signals and the IP address. It sets no cookie and creates no persistent identifier.
Access logs
The site is served by Cloudflare, which logs requests — IP address, date and time, page requested, user agent — in order to deliver pages and protect against abuse. This is inherent to hosting any site on the internet; it is not an audience measurement choice: there is no analytics tool installed on this site.
Preferences in your browser
The site stores two of your choices — light/dark theme and language — in your browser’s own local storage. These are not cookies, are not personal data, and never leave your device. Details in the cookie policy.
Why, and on what legal basis
| Processing | Purpose | Legal basis (LGPD art. 7) |
|---|---|---|
| Contact form | replying to your message | item V — preliminary procedures related to a contract, at your own request |
| Turnstile | preventing spam and abuse of the form | item IX — legitimate interest (security) |
| Access logs | delivering pages and protecting the site | item IX — legitimate interest (security) |
None of these is consent (item I). That is deliberate: you write to me because you want a reply, and the law addresses exactly that situation. It makes no sense to ask permission to use the e-mail address you just typed in order to send you the answer.
Who else has access
To function, the site depends on suppliers acting as processors (art. 5, VII) — they process data on my behalf and within the purposes above:
| Supplier | Role | What it reaches |
|---|---|---|
| Cloudflare | hosting, running the form, Turnstile | the request, IP address, and the message in transit |
| Resend | sending the message by e-mail | name, e-mail, subject, message |
| Amazon SES | delivery infrastructure used by Resend | same |
| Mail server under my control | final destination of the message | same |
Outside that chain, nothing is shared. There is no sale, assignment, exchange, data enrichment, mailing-list signup, or advertising use.
International transfer
The suppliers above process data outside Brazil, chiefly in the United States. That constitutes an international transfer (art. 33), and you should know it before writing to me.
The transfer rests on the data protection contractual clauses offered by those suppliers, in the standard recognized by ANPD Resolution 19/2024. If you would rather not have your data processed outside Brazil, reach me on LinkedIn instead of using the form.
For how long
Your message stays in my mailbox for as long as the conversation serves a purpose — an invitation answered, a matter closed. There is no systematic archiving and no contact database built from the form. You can ask for deletion at any time, and I delete it.
Cloudflare’s access logs follow that supplier’s own retention periods and are not consulted by me to identify readers.
Your rights
Article 18 of the LGPD guarantees you, at any time and free of charge:
- confirmation that processing exists, and access to the data;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of unnecessary or excessive data;
- portability to another supplier;
- deletion of the data;
- information about whom I shared the data with;
- objection to processing based on legitimate interest.
Ask through the contact page. I reply immediately in simplified form or, when the answer requires research, within 15 days (art. 19, § 1, II). If you believe I fell short, you may complain to the Brazilian Data Protection Authority.
If you are outside Brazil
This site is operated from Brazil and this policy follows Brazilian law. In practice, the substance is the same wherever you read from: the site sets nothing on your device, runs no analytics, and processes personal data only when you choose to write to me. Requests under any data protection regime — including the GDPR — reach me through the same contact page and get the same treatment.
Security
The site’s technical measures are verifiable by anyone who cares to look: enforced HTTPS with HSTS, a closed Content Security Policy — no third-party scripts beyond Turnstile on the contact page — API keys kept out of the repository, and Turnstile on the form.
No measure removes risk. Should a security incident occur with relevant risk to your data, I will notify you and the ANPD under article 48 and ANPD Resolution 15/2024.
Minors
This site is not directed at people under 18 and does not knowingly collect data from children or adolescents (art. 14). If that happens by mistake, tell me through the contact page and I will delete it.
Changes to this policy
If the site starts processing data differently, this page changes first, and the update date at the top records when. Because the site is published from a version-controlled repository, the history of changes exists and is auditable.