Privacy policy

Who handles your data

The data controller is Kuma Tech, a Brazilian technology company, represented by its founder, Emanuel Rocha. The company works remotely, with no office open to the public.

The channel for any privacy matter is the email kumatechbr@gmail.com or WhatsApp +55 51 98972-4112. As a small processing agent, Kuma Tech keeps this channel in place of a formal data protection officer, as allowed by ANPD Resolution CD/ANPD No. 2/2022.

What data and why

Each situation below says what is collected, what it is for and which legal basis of Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) the use relies on.

• Browsing the website

  Data

  IP address, browser, page visited, date and time (technical logs recorded by the hosting server).

  Purpose

  Keeping the website online, fast and protected against attacks and abuse.

  Legal basis

  Legitimate interest (art. 7, IX) and compliance with a legal obligation (art. 7, II).

• Website audience measurement

  Data

  A random identifier created in your browser, the pages visited, the time on each one, how far the page was scrolled, the buttons and links clicked, the site you came from, the campaign details when the link comes from an ad, the type of device, the language, the loading speed and the approximate city. The IP address is used only to estimate the city and is not stored. This measurement has no name, e-mail or phone number.

  Purpose

  Knowing which pages and content work, where visits come from and where the website needs to improve. The measurement is done with Kuma Tech's own tool, without cookies and without passing data to ad networks.

  Legal basis

  Legitimate interest (art. 7, IX). You can turn the measurement off with the button right below this list, or by enabling "Do Not Track" or Global Privacy Control in your browser.

• Preferences on your device

  Data

  Demo sound on or off, the chosen language, the random identifier of the audience measurement and, if you turned the measurement off, that choice. On the blog, after signing up: an access key, your name, profile and likes.

  Purpose

  Remembering your choices and keeping you signed in on the blog. It stays only in your browser's local storage, is not a cookie and disappears when you tap "Sign out" or clear your browser data.

  Legal basis

  Legitimate interest (art. 7, IX), to provide the feature you used.

• Blog likes with sign-up

  Data

  Name, WhatsApp, email, profile (business owner, entrepreneur, freelancer or none of these), articles you liked or not, the article where you signed up, clicks on Kuma Tech's Instagram link and the sign-up and last access dates.

  Purpose

  Recording your opinion, recognizing you on another device by your WhatsApp and email and understanding which topics interest you, to choose the next articles.

  Legal basis

  Legitimate interest (art. 7, IX).

• News by email and WhatsApp

  Data

  Name, email and WhatsApp of people who ticked the consent box when signing up, with the date they consented.

  Purpose

  Sending Kuma Tech content, news and offers.

  Legal basis

  Consent (art. 7, I), which can be withdrawn at any time.

• Direct contact

  Data

  Whatever you send by WhatsApp or email: name, company, phone, email and the message.

  Purpose

  Replying, understanding your case, sending a proposal and providing the contracted service.

  Legal basis

  Pre-contractual steps and performance of a contract (art. 7, V) and legitimate interest (art. 7, IX).

• Bot check

  Data

  Technical signals from the device and browser at the time of sign-up, analyzed by Cloudflare Turnstile.

  Purpose

  Preventing automated sign-ups and abuse of the form.

  Legal basis

  Legitimate interest (art. 7, IX).

Audience measurement in this browser:Turn off measurement in this browser

What Kuma Tech does not do

• It does not sell, rent or hand over personal data.
• It does not use advertising cookies, ad pixels or third-party analytics tools on the website.
• It does not link the audience measurement to your sign-up: the measurement does not know who you are.
• It does not send news to people who did not opt in.
• It does not make automated decisions that affect you based on your data.

Who the data is shared with

Only with the providers that make the website work, which process the data on Kuma Tech's behalf and for the purposes of this policy:

• Vercel: hosts the website, records the technical access logs and receives the audience measurement events, estimating the city from the IP address, which is not stored.
• Supabase: stores the database of the blog sign-up and of the audience measurement, closed to the public.
• Cloudflare: runs the bot check on sign-up (Turnstile).
• Google: delivers the website's fonts; your browser downloads the fonts from Google's servers, which receive your IP.

Some of these services store data outside Brazil, mainly in the United States. This transfer follows article 33 of the LGPD, with providers that adopt contractual clauses and security measures to protect the data.

Links to WhatsApp and Instagram lead to Meta services. When you open these links, you leave the website and Meta's privacy policy applies.

Data may also be provided to authorities when required by law or a court order.

How long the data is kept

• Technical access logs: for as long as needed for the website's security and to meet legal obligations.
• Audience measurement: events are deleted after 14 months.
• Blog sign-up: while it is useful for the purposes of this policy, or until you ask for deletion.
• Consent to news: valid until you withdraw it. After that, sending stops and the record of consent is kept only as proof of what was done.
• Preferences on your device: stay in your browser until you tap "Sign out" on the blog or clear your browser data.

Your rights and how to exercise them

Under article 18 of the LGPD, you can:

• confirm whether Kuma Tech processes your data and access that data;
• correct incomplete, inaccurate or outdated data;
• request the anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• request the portability of your data to another provider;
• find out who your data has been shared with;
• withdraw consent and request deletion of the data processed on that basis;
• object to processing based on legitimate interest, if it does not comply with the law;
• know that you can refuse consent and what happens if you do.

To make a request, write to kumatechbr@gmail.com with the subject "Privacy". To protect you, Kuma Tech confirms the request through the WhatsApp or email used to sign up before showing, changing or deleting any data. You will get a reply within 15 days.

To stop receiving news, reply "STOP" to any message or ask by email. The blog's "Sign out" button only disconnects your device: it does not delete your sign-up.

If the reply does not solve it, you can file a complaint with Brazil's National Data Protection Authority, at gov.br/anpd.

How the data is protected

• The whole website only works over a secure connection (HTTPS).
• The blog sign-up is stored in a database closed to the public: no page can read this data, and only a server function writes to it.
• The audience measurement is kept in the same database: the website can only write events, and reading is restricted to the internal dashboard.
• Sign-up goes through a bot check, and internal access to the data is restricted.

No system is completely immune to failure. If a security incident occurs that may pose a relevant risk or harm, Kuma Tech will notify the affected people and the ANPD, as required by article 48 of the LGPD.

Minors

The website and blog are made for businesses and professionals and are not intended for people under 18. If Kuma Tech notices a minor has signed up, it deletes the data.

Changes to this policy

This policy changes when the website changes. The date of the latest version is at the top of the page. Important changes are also announced on the website.