Privacy Policy
Last updated: 30 July 2026. Effective as of that date.
1. Controller and contact channel
This Policy describes how personal data is processed on the mediaheat.news website and in the MediaHeat / AI newsletter (together, "the Service").
The controller of personal data, as defined in Article 5, VI of Brazilian Law No. 13,709/2018 — the General Personal Data Protection Law ("LGPD") — is Claudio Medeiros, a natural person.
Contact channel for data subjects: privacy@mediaheat.news
The Service qualifies as a small-scale processing agent under Resolution CD/ANPD No. 2 of 27 January 2022, which expressly covers natural persons (Article 2, I). As such, it is exempt from appointing a Data Protection Officer (Article 11 of that Resolution). The address above is the data subject communication channel required by Article 11, § 1 of the Resolution, and serves the purpose of Article 41, § 2, I of the LGPD.
2. Scope
This Policy applies to the mediaheat.news website and to the newsletter messages.
It does not apply to third-party websites reached through headline links. When you click a headline, you leave for the originating publisher's website, governed by that publisher's own privacy policy. The Service does not control, receive, or have any means of inspecting what happens during that visit.
3. Definitions
For the purposes of this Policy:
| Term | Definition |
|---|---|
| Personal data | Information relating to an identified or identifiable natural person (Art. 5, I). For this Service, the subscriber's email address. |
| Sensitive personal data | Racial or ethnic origin, religious belief, political opinion, union or religious, philosophical or political membership, health or sex life data, genetic or biometric data (Art. 5, II). The Service collects no sensitive data of any kind. |
| Processing | Any operation carried out with personal data: collection, recording, storage, use, sharing, transfer, deletion, among others (Art. 5, X). |
| Data subject | The natural person to whom the data relates (Art. 5, V). If you subscribe to the newsletter, that is you. |
| Controller | The party responsible for decisions about the processing (Art. 5, VI). Identified in item 1. |
| Processor | The party that processes data on the controller's behalf, following its instructions (Art. 5, VII). Identified in item 6. |
| Data protection laws | The LGPD and any other rules applicable to the processing described here. |
4. Personal data processed
4.1. Newsletter subscription. The only personal data you provide directly is the email address entered in the subscription form. There is no field for name, phone number, company, job title, or any other data, and no other data is requested at any point.
4.2. Newsletter delivery and engagement data. The sending platform records operational data associated with your address: subscription date and time, subscription status (active or unsubscribed), delivery status for each message, and any bounces.
Messages also record opens, through a tracking image embedded in the email, and link clicks, through redirection. These records are used to assess whether the edition is being read and which stories draw interest, informing editorial curation. If you would rather not generate an open record, keep images blocked in your email client — most block them by default.
4.3. Website browsing. The Service uses Cloudflare Web Analytics for audience measurement. The tool runs as Cloudflare delivers the pages and collects aggregated, non-identified data about visits: page viewed, referrer, approximate country, device and browser type, and page-load performance measurements.
Cloudflare Web Analytics uses no cookies, creates no persistent identifier, and performs no device fingerprinting. This data cannot be used to identify you individually or to link your browsing to your email address.
The Service does not use Google Analytics, advertising networks, social media pixels, heatmap tools, session recording, or any form of profiling or behavioral advertising.
4.4. Server technical logs. As with any internet server, the infrastructure hosting the site records technical request data — IP address, date and time, resource requested, and browser agent — in order to operate the service and protect it against abuse and attack. These logs are held by Cloudflare under its own policy (item 6) and are processed on the basis of legitimate interest (Art. 7, IX), limited to the security and operation of the site.
4.5. Cookies. The Service uses no cookies for advertising, profiling, or audience measurement, and therefore displays no cookie consent banner. Cloudflare may set cookies strictly necessary for network security and operation; those cookies are not used to track you across sites.
5. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Email address | Sending the daily newsletter edition | Consent — Art. 7, I |
| Delivery and engagement | Ensuring delivery and assessing whether the publication is read, informing curation | Legitimate interest — Art. 7, IX |
| Browsing analytics | Measuring audience on a non-identified basis | Legitimate interest — Art. 7, IX |
| Technical logs | Operating and protecting the site | Legitimate interest — Art. 7, IX |
Your email address is not sold, rented, assigned, traded, or shared for third-party marketing purposes, and is not used for any purpose other than sending the newsletter.
You may withdraw consent at any time, without giving a reason, through the unsubscribe link in the footer of every message, or by writing to the channel in item 1. Withdrawal does not affect the lawfulness of processing carried out beforehand.
6. Sharing with processors
The email address is shared with a single third party:
Buttondown, LLC — Richmond, Virginia, United States. Stores the subscriber list and performs the sending. It acts as a processor (Art. 5, VII), processing data solely on the controller's instructions. The platform's own practices, including the sub-processors it engages, are set out in the Buttondown privacy policy.
Cloudflare, Inc. — United States. Hosts and delivers the website and operates the measurement tool described in item 4.3, also as a processor. Its own practices are in the Cloudflare privacy policy.
Those links describe what each vendor does on its own account. What this Service collects, why it collects it, and with whom it shares it is described in this Policy, and is the responsibility of the controller identified in item 1 — a vendor's privacy policy neither replaces nor transfers the duty to inform that the LGPD places on the controller (Articles 6, VI and 9, III).
Data may also be disclosed to public authorities where required by legal or regulatory obligation or by court order.
6.1. Succession. Should MediaHeat be transferred to another party — by sale, assignment, merger, or any other form of succession — subscribers will be notified in the newsletter itself, before the transfer takes effect, with time to unsubscribe beforehand. The subscriber list is not offered or transferred as a standalone asset, separated from the publication: it travels only with the Service subscribers signed up for.
7. International data transfer
Buttondown and Cloudflare operate from the United States. Subscribing to the newsletter necessarily involves transferring your email address outside Brazil, for storage and sending on servers located in that country, which does not hold an adequacy decision from the ANPD.
The transfer is carried out on the basis of Article 33, IX, "b" of the LGPD: it is necessary to perform the service you requested. An email newsletter cannot be delivered without the address being processed by the sending platform, and it is you who requests that delivery by subscribing. This is not additional sharing or a secondary purpose — it is the performance of what was asked for.
Processing by the processor is subject to its contractual terms and the safeguards it offers (item 6).
If you would rather your address not be processed outside Brazil, do not subscribe to the newsletter — reading the website does not depend on it, and the site does not identify who reads it (items 4.3 and 4.5).
8. Retention and deletion
The email address is retained for as long as the subscription lasts.
When you unsubscribe, sending stops immediately and your address is marked as unsubscribed on the platform. The unsubscribe record itself is retained, precisely to ensure you are not added back to the list — it is the mechanism that makes the unsubscribe effective.
Permanent deletion of the address from the processor's servers is a request distinct from unsubscribing, and may be made at any time through the channel in item 1. Buttondown states that deletion requests are honored immediately.
Aggregated audience data, because it does not identify you, is not deleted individually — there is no way to locate it from your address.
9. Security
Website traffic and the subscription form travel over an encrypted connection (HTTPS). Access to the subscriber list is restricted to the controller and protected by authentication on the processor's platform.
No security measure is infallible. In the event of a security incident presenting relevant risk or harm to data subjects, notice will be given to the ANPD and to the affected data subjects under Article 48 of the LGPD.
10. Data subject rights
The LGPD (Article 18) guarantees you, at any time and upon request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in non-compliance with the Law; portability to another provider; deletion of data processed on the basis of consent; information about the entities with which the data has been shared; information about the option not to give consent and the consequences of refusal; and withdrawal of consent.
How to exercise these rights: write to privacy@mediaheat.news. Because the only identifiable data is your email address, a request sent from the subscribed address is itself sufficient proof of identity. Requests are answered within 15 (fifteen) days.
You also have the right to lodge a complaint with Brazil's National Data Protection Authority at gov.br/anpd.
11. Residents of other jurisdictions
United States. The Service does not sell or share personal information within the meaning of the California Consumer Privacy Act (CCPA/CPRA), does not serve behavioral advertising, and does not meet that law's applicability thresholds. The newsletter is an editorial publication, free of charge and free of advertising. Regardless of applicable law, the rights described in item 10 are offered to all subscribers, whatever their residence, and every message carries a one-click unsubscribe mechanism, honored immediately.
European Economic Area and United Kingdom. The Service is not directed at those territories and is not offered in those languages. Where subscribers reside there, the legal basis for sending is consent (Article 6(1)(a) GDPR), and the rights of access, rectification, erasure, restriction, portability, and objection may be exercised through the same channel in item 1.
12. Children and minors
The Service is not intended for persons under 18 and does not knowingly collect data from children or adolescents (Article 14 of the LGPD and, as applicable, the Children's Online Privacy Protection Act). If we learn that an address belongs to a child, the record will be deleted.
13. Changes to this Policy
This Policy may be amended to reflect changes in the Service or in applicable law. The "Last updated" date at the top changes with each revision.
Material changes to collection or sharing will be announced in the newsletter itself before taking effect — they will not be introduced through a silent revision of the text.
14. Versions
This Policy is published in Portuguese and English. In the event of any discrepancy between the versions, the Portuguese version prevails.