Privacy policy
Last updated 19 August 2026
What personal data Emberline collects, why, on what legal basis, how long it is kept, and the rights available under Brazilian and European law.
1. Controller
Emberline is an independent editorial project operated from Brazil and acts as controller of personal data processed through this site. Privacy correspondence goes to support@emberline.site.
2. Data collected
2.1 Provided voluntarily
Email address, name where supplied, and the contents of any message sent to the support address. Where a paid publication is purchased: order reference, purchase date and the email address associated with the order.
2.2 Collected automatically
Standard server and analytics data: IP address, approximate region derived from it, browser and device type, operating system, referring address, pages requested and timestamps. This data is used in aggregate.
2.3 Not collected
Emberline does not request, collect or infer health data, biometric data, racial or ethnic origin, religious or philosophical belief, political opinion, trade union membership, sexual orientation, criminal record or financial account details. No page on this site asks a visitor to disclose a personal circumstance, and no profile of any individual reader is constructed.
3. Payment data
Where a paid publication is offered, payment is processed by third-party providers. Card numbers and equivalent credentials are entered on the provider's systems and are never transmitted to or stored by Emberline. Emberline receives the transaction reference, its status, and the email address associated with the order. Each provider processes data under its own privacy policy.
4. Purposes and legal bases
- Answering correspondence — legitimate interest (GDPR Art. 6(1)(f)); legitimate interest of the controller (LGPD Art. 7, X).
- Delivering and supporting a purchased publication — performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V).
- Security, fraud prevention and abuse detection — legitimate interest (GDPR Art. 6(1)(f); LGPD Art. 7, IX).
- Aggregate audience measurement — consent where applicable law requires it, otherwise legitimate interest.
- Tax, accounting and legal record-keeping — legal obligation (GDPR Art. 6(1)(c); LGPD Art. 7, II).
Where processing rests on legitimate interest, a balancing assessment has been carried out and its outcome may be requested at the support address. Where it rests on consent, that consent may be withdrawn at any time, without affecting processing already carried out.
5. Retention
- Support correspondence: 24 months from the last message in the thread.
- Order and transaction records: 5 years, to meet Brazilian tax and commercial record-keeping requirements.
- Server logs: 12 months.
- Aggregate analytics containing no identifier: retained indefinitely.
Data is deleted or irreversibly anonymised at the end of the applicable period unless a legal obligation requires longer retention.
6. Sharing
Personal data is shared only with service providers acting on documented instructions: hosting and content delivery, email delivery, payment processing and audience measurement. Disclosure is also made where required by a competent authority under applicable law. Personal data is never sold, rented or traded, and is not shared with advertisers for their own purposes.
7. International transfers
Providers may process data outside Brazil, including in the United States and the European Union. Transfers from the European Economic Area or the United Kingdom rely on Standard Contractual Clauses or an applicable adequacy decision. Transfers from Brazil are made under Articles 33 to 36 of the LGPD, using contractual safeguards where no adequacy decision applies.
8. Cookies
This site sets no advertising cookie of its own. Cookies in use are limited to those strictly necessary for the site to function and, where consent has been given, aggregate audience measurement. Third-party measurement or advertising technologies may set their own cookies subject to that consent. Any modern browser allows cookies to be blocked or deleted, though blocking necessary cookies may affect how the site behaves.
9. Rights
Under the LGPD (Law 13.709/2018), Article 18, a data subject may request confirmation of processing, access, correction of incomplete or outdated data, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, and withdrawal of consent.
Under the GDPR, a data subject may request access, rectification, erasure, restriction of processing and portability, and may object to processing based on legitimate interest.
Requests go to support@emberline.site and are answered within 15 days under the LGPD and within one month under the GDPR. Verification of identity may be requested where necessary to protect the data.
10. Complaints
A complaint may be lodged with the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, with the supervisory authority of the relevant Member State in the European Union, or with the Information Commissioner's Office in the United Kingdom.
11. Minors
This site is not directed at anyone under 18 and does not knowingly collect data from minors. Where such data is identified it is deleted. A parent or guardian who believes a minor has supplied data may write to the support address.
12. Security
Transport encryption is applied site-wide, access to stored data is restricted, and providers are selected on the basis of their published security practices. No transmission over the internet can be made entirely secure against interception, and no absolute assurance of security is offered.
13. Changes
Material changes are reflected in the date at the head of this page. Continued use of the site after a change constitutes acceptance of the revised policy.