Privacy Policy
Last updated: 13 October 2026. In force from 14 October 2026.
1. Who we are
This Policy explains how MediaHeat handles personal data on mediaheat.news, in the MediaHeat / AI newsletter and in MediaHeat / Reader, including its Premium plan (together, "the Service").
The controller is Claudio Medeiros, a natural person, under Brazil's General Data Protection Law (Law 13,709/2018, "LGPD"). Contact for anything in this Policy: privacy@mediaheat.news.
As a small-scale processing agent (ANPD Resolution CD/ANPD No. 2/2022), MediaHeat is not required to appoint a Data Protection Officer. The address above is the channel for data subjects.
2. What we collect and why
You can read the site without an account or a newsletter subscription. We collect personal data only when you use a feature that needs it.
| What you do | Data | Why | Legal basis (LGPD) |
|---|---|---|---|
| Subscribe to the newsletter | Email; delivery status; opens and clicks | Send the newsletter; see which stories interest readers | Consent (art. 7, I) for sending; legitimate interest (art. 7, IX) for opens and clicks |
| Create an account | Email, name and profile picture when available, sign-in and session data | Sign you in and protect your account | Performance of a contract (art. 7, V) |
| Use Reader | Preferences, feeds, folders, saved stories, read state | Provide Reader and keep it in step across your devices | Performance of a contract (art. 7, V) |
| Subscribe to Premium | Plan, subscription status and dates, payment records; card details go only to the payment provider | Charge Premium and apply its limits; meet tax duties | Performance of a contract (art. 7, V); legal obligation (art. 7, II) |
| Join the Reader waitlist | Name, email, language | Organise access and send you an invitation | Consent (art. 7, I) |
| Send feedback | What you write in the form, and your email if you give it | Fix problems, improve Reader, reply to you | Legitimate interest (art. 7, IX) |
| Visit the site | Technical request records (IP address, browser, page, time); anonymous traffic statistics without cookies | Run and protect the site; measure audience | Legitimate interest (art. 7, IX) |
| Accept measurement cookies | Pages viewed, where you came from, how you move around the site, through Google Analytics cookies | Understand which pages are read | Consent (art. 7, I) |
| Decline or ignore the cookie notice | Cookieless Google Analytics signals with no persistent identifier | Estimate traffic volume | Legitimate interest (art. 7, IX) |
A few points about this table:
- Opens and clicks. Newsletter messages carry a tracking image and redirected links. If you would rather not be counted, keep images blocked in your email client.
- Measurement. Google Analytics sets cookies only if you accept the notice on your first visit, and you can change your choice at any time here: . Advertising and ad personalisation are always off. We do not use advertising networks, social media pixels, session recording or profiling.
- Country. To show Premium in the right currency, we read the country your connection comes from. We do not store it.
- Reading history. The stories you read or save can reveal your interests. We use them only to run Reader, never for advertising or to infer sensitive traits. We do not ask for sensitive data.
- Summaries and full articles. Some features send a story's text or public address to outside services. No personal data goes with them.
- Separate purposes. The newsletter and your account are separate. Subscribing does not create an account, creating an account does not subscribe you, and deleting one does not affect the other.
3. Cookies
We use no cookies for advertising or profiling. Google Analytics measurement cookies (_ga and _ga_*, lasting up to 2 years) are set only with your consent; your choice is kept in your browser. Sign-in uses cookies and local storage strictly needed to keep your session secure, and our hosting provider may set cookies needed for network security. Without an account, Reader keeps your preferences only in your browser.
4. Who we share data with
We do not sell, rent or trade personal data.
We use providers for hosting and security, sign-in, payments, newsletter sending, audience measurement, and the feedback form. They process personal data on our behalf, only as needed to provide the feature you use. The payment provider also acts on its own account to prevent fraud and meet its legal duties.
Some features involve companies that act on their own account, under their own privacy policies:
- Google sign-in, if you choose it, passes your Google identity to our sign-in provider.
- Embedded videos and posts in some articles load directly from their platforms (such as YouTube or X), which receive your connection data and may set their own cookies. You can read the rest of the article without playing them.
- Links to stories take you to publishers' websites, which this Policy does not cover.
We will send you the list of providers we use on request to privacy@mediaheat.news.
We may also disclose data when the law, a regulator or a court requires it. If MediaHeat ever passes to someone else, we will tell you on the site, and by email if you have an account or subscribe, before the transfer, so you can delete your account or unsubscribe first.
5. International transfers
Most of our providers are based in the United States or Europe, so your data may be processed outside Brazil. Transfers needed to provide a feature you asked for rely on art. 33, IX of the LGPD; others rely on the safeguards the LGPD and ANPD Resolution No. 19/2024 allow. You can ask us about them through the contact in section 1.
6. How long we keep data
- Newsletter: until you unsubscribe. We keep a record of the unsubscribe so you are not added back. You can also ask for your address to be deleted completely.
- Account and Reader data: while the account exists. Deleting your account removes them from our systems; database backups may hold them for up to 30 days, until they are deleted automatically.
- Payment records: the payment provider keeps them after you cancel or delete your account, as its legal duties require.
- Measurement data: up to 14 months in Google Analytics, then deleted automatically. Clearing your cookies ends the link to earlier visits.
- Waitlist: until the beta ends or you ask us to remove you.
- Feedback: until we delete it or you ask us to.
- Technical records: ours for up to 7 days; our providers' for the periods they set for security and operation.
- Public feeds: the public feeds you subscribe to are shared with other readers. They may stay in our catalogue after you unsubscribe, with no link to you.
7. Security
We use encrypted connections throughout, and every request for private data is checked against your account on our server. No measure is perfect. If an incident creates a relevant risk or harm to you, we will notify you and the ANPD as art. 48 of the LGPD requires.
8. Your rights
You have the rights in art. 18 of the LGPD, including access to, correction and deletion of your data, and withdrawal of consent.
- Deleting your account: in your profile, choose "Delete account". Deletion is immediate, cancels any Premium subscription and removes your Reader data: feeds, reading state, saved items and preferences.
- Other rights, or if you cannot sign in: write to privacy@mediaheat.news from the address on your account or subscription. We reply within 15 days.
You can also complain to the ANPD at gov.br/anpd.
9. Children
The Service is not meant for people under 18, and we do not knowingly collect their data. If we learn that an account or subscription belongs to a minor, we will delete it.
10. Changes
We will update this Policy when the Service or the law changes, and change the date at the top. We will announce material changes to what we collect or share on the site, and by email to account holders and subscribers, before they take effect.
11. Versions
This Policy is published in Portuguese and English. If the versions differ, the Portuguese version prevails.