Braziltopia ("we", "our") operates the news platform available at braziltopia.org. This privacy policy has been prepared in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018) and the European Union General Data Protection Regulation (GDPR — Regulation EU 2016/679), aiming to transparently inform how we handle data while providing our services — including the cookies and first-party analytics system described below.

Braziltopia is a publicly accessible news platform: you can read all content without registering, logging in, or providing a name, email address, or documents. We collect two groups of data, depending on your consent choice: Server technical data (always collected, regardless of your cookie choice): IP address, browser User-Agent (browser type and operating system), and language preference selected via URL (pt, en, or es), recorded automatically in web server logs for security and abuse-prevention purposes. Analytics data (only with consent): if you accept cookies — via the banner shown on your first visit, or at any time through the "Cookie Settings" section of this page (section 13) — we begin collecting browsing data associated with a visitor identifier generated in your browser. See sections 3 through 6 for full details on what is collected and why.

Braziltopia uses first-party cookies for analytics purposes, subject to your explicit consent: • bz_consent: records your choice (accepted/declined) made in the consent banner or in the "Cookie Settings" section. Valid for 1 year. It is set regardless of your choice, since we need it to remember your decision on future visits. • bz_vid: a unique visitor identifier (UUID), created only when you accept tracking. Valid for 1 year. It is immediately deleted from your browser if you decline consent, or if you later revoke it (section 13). No analytics cookie is set before you give consent — only bz_consent (the record of your choice itself) is always written. We do not use third-party tracking services such as Google Analytics or Facebook Pixel for analytics purposes — only the first-party analytics system described in section 4 and, optionally, a self-hosted Matomo instance described in section 5. This does not include the advertising cookies set by Google AdSense, which are loaded on all public pages of the site regardless of your analytics consent choice — see section 20 for details.

Once you give consent, our site sends two types of events to our own backend (POST api.braziltopia.org/events) — never to a third-party service: • pageview: sent when you open a page. Contains the visitor identifier (bz_vid), the path visited, the article slug (when applicable), the page's language, and the referrer — the page that brought you to us. • engagement: sent when you leave the page or switch tabs. Contains the approximate time spent viewing (in milliseconds) and the maximum scroll depth (as a percentage), used to measure how much an article holds a reader's attention. In both cases we also automatically record your browser's User-Agent and the request's source IP address. Purpose: we use this data to understand which articles are most read, where our traffic comes from, and how long readers spend on each page — information that informs editorial decisions, such as which topics to prioritize. We do not sell or share this data with third parties.

In addition to our first-party analytics, we may run our own self-hosted instance of Matomo, an open-source web analytics tool hosted on our own infrastructure — data is not sent to any third-party company. Loading the Matomo script follows exactly the same consent rules described in section 3: it is only activated once you have accepted tracking and this feature is enabled in the current deployment (it may be turned off, depending on the environment). If you decline or revoke consent, we also send Matomo a signal to stop tracking (optUserOut) for that session. Matomo collects general browsing metrics (pages visited, visit duration, device/browser type) as a complement to our own event pipeline. Our admin dashboards exclusively read data from our own events database — never Matomo's API.

The visitor identifier (bz_vid) is durable (valid for 1 year) and lets us associate multiple visits and interactions with the same browser over time. This constitutes a form of behavioral visitor profile — which articles you read, how often, and for how long — even though it is not tied to a name, email address, or other directly identifiable data. We are developing reader accounts (email and password sign-up). Once that feature is publicly available, if you create an account or log in on a browser that already has a bz_vid cookie, we will link that visitor identifier to your account (account_links table in our database). This will let us, for example, offer personalized content recommendations based on your reading history. This section will be updated with further detail when the feature ships.

For platform operation, we use the following third-party services, which may process technical data according to their own privacy policies: Google Fonts: We use "Work Sans" and "Material Symbols" fonts loaded from Google's servers (fonts.googleapis.com). When accessing our site, your browser makes requests to Google's servers, which may record your IP address and User-Agent. For more information, see Google's Privacy Policy (policies.google.com/privacy). Open-Meteo: We use the Open-Meteo API to display weather data for Brazilian cities. No user data is sent to this API — we only send fixed, pre-defined geographic coordinates for Brasília, São Paulo, and Rio de Janeiro. Central Bank of Brazil: We use the public API of the Central Bank of Brazil (olinda.bcb.gov.br) to display exchange rates (USD/BRL and EUR/BRL). No user data is sent — only query dates are used as parameters. External Images: Images displayed in articles are hosted on external servers (such as Unsplash and news websites). When viewing a page with images, your browser makes requests directly to these servers, which may record your IP address.

Braziltopia uses artificial intelligence technologies (Claude, by Anthropic) exclusively in the editorial process of article creation. AI is used to rewrite news in original words and translate them into the three supported languages (Portuguese, English, and Spanish). No personal user data is processed by AI — only publicly available journalistic content.

In addition to editorial content (articles, translations, news sources, and tags/categories), our database stores the analytics events described in section 4 when you consent to tracking: event type, visitor identifier (bz_vid), path visited, article slug, language, referrer, User-Agent, time on page, and scroll depth, with a timestamp. No data is stored for visitors who declined consent — a decline is respected in full, with no exceptions.

In compliance with Art. 7, I, of the LGPD and Art. 6(1)(a) of the GDPR, the data processing described in sections 3 through 6 (analytics cookies, browsing events, Matomo, and visitor profiling) is based on your freely given, informed, and unambiguous consent, obtained through the banner shown on your first visit or through the "Cookie Settings" section (section 13) of this page. You can withdraw this consent at any time, with immediate effect on future tracking, without affecting the lawfulness of processing carried out before withdrawal.

In compliance with Art. 7, IX, of the LGPD and Art. 6(1)(f) of the GDPR, processing of the server technical data mentioned in section 2 (IP address and User-Agent logs, recorded regardless of your cookie choice) is based on the controller's legitimate interest, for: • Ensuring platform security and stability • Preventing abuse and attacks • Maintaining access records as required by the Brazilian Internet Framework (Law No. 12,965/2014) Loading fonts from Google (section 7) also constitutes third-party processing based on legitimate interest, disclosed in this policy for transparency purposes.

Under the LGPD (Art. 18) and the GDPR (Arts. 15-22), you have the right to: • Confirmation of the existence of personal data processing • Access to personal data • Correction of incomplete, inaccurate, or outdated data • Anonymization, blocking, or deletion of unnecessary data • Data portability • Deletion of personal data processed with consent • Information about sharing with third parties • Withdrawal of consent, at any time Since we now process browsing data associated with a visitor identifier on the basis of consent (sections 3 through 6), these rights apply concretely to the analytics data collected. To exercise them, contact us through the channels in section 19. Withdrawing consent, specifically, can be done directly on this page, in the section below — no need to contact us.

Analytics events (pageview and engagement, section 4) are retained for a limited period — currently set to approximately 180 days — after which they are automatically deleted from our database by a periodic cleanup process (run at server startup and every 24 hours). This period is configurable; if the default value changes, this policy will be updated to reflect the change. Server access logs are maintained as required by the Brazilian Internet Framework (Law No. 12,965/2014) and deleted after the mandatory legal period. Editorial content (articles and translations) is kept indefinitely while relevant to the service.

By using Google Fonts, technical data (IP address) may be transferred to Google servers located outside Brazil and the European Union. Google ensures adequate protection through Standard Contractual Clauses (SCCs) and compliance certifications. When enabled, our Matomo instance runs on our own (self-hosted) infrastructure; therefore, no analytics data is transferred outside the environment we operate.

We adopt technical and organizational measures to protect processed data: • Encrypted communication via HTTPS/TLS • Containerized infrastructure with service isolation • Database with restricted access and protected credentials • Reverse proxy with automatic SSL certificates in production • Rate limiting on the public events endpoint, to prevent abuse

Braziltopia is a publicly accessible news portal and does not direct its services to individuals under 18 years of age. We do not intentionally collect personal data from children or adolescents, and the same consent system described in this policy applies to all visitors, regardless of age.

This policy may be updated periodically to reflect changes in our practices or legal requirements — for example, when we launch reader accounts or a defined data-retention policy. The date of the last update will always be indicated at the top of this page. We recommend periodic review.

To exercise your rights, clarify questions, or make requests related to this privacy policy, please contact us: Email: [email protected] Data Protection Officer (DPO): [email protected]

Braziltopia displays ads through Google AdSense, an advertising service provided by Google. The AdSense script is loaded on all public pages of the site, regardless of your choice in the cookie consent banner described in section 3 — unlike our own analytics and Matomo, loading AdSense is not conditioned on your analytics consent choice. Google AdSense may set advertising cookies and use device identifiers to serve ads — including personalized ads based on your browsing activity — in accordance with Google's policies. For more information about how Google uses this data, see policies.google.com/technologies/ads. You can manage or opt out of Google's ad personalization directly at adssettings.google.com. This setting is controlled by Google and is independent of the analytics cookie settings on this page (section 13).