Privacy notice
This text describes, in plain language, what personal data risosa collects when you write in, what it is used for, how it is processed, and what rights the law gives you. risosa is an authored project — there is no team and no marketing department.
Who is responsible
risosa is a notebook of field notes about how AI systems describe brands. For data-protection law (LGPD in Brazil, GDPR in the European Union), the controller of the personal data described below is the operator of the risosa.com site. For privacy questions or to exercise a right, write to hello@risosa.com.
What is collected
When you submit the form on the "Write" page, risosa receives:
- Your name and email — so the reply can address you by name.
- Optionally, another contact channel (LinkedIn, Telegram, Signal), if you would rather not write by email.
- The text you put into the "situation" field: a description of the company, the market, the visibility problem — only what you choose to share. Nothing is required beyond name and email.
These details are used only to reply to what you asked. You are not added to any mailing list, your data is not shared with third parties (except for the payment processor described just below, when applicable), and nothing is aggregated or analysed outside your specific exchange. risosa also stores the form submission timestamp together with a salted SHA-256 hash of your IP — that protects the form from automated abuse. The IP address itself is never stored, and neither are browser fingerprints or device metadata.
What is not collected
- Tracking cookies are not used. The analytics tool runs without cookies and stores no per-visitor identifiers.
- Retargeting pixels, marketing-automation tags, and ad-network trackers are not connected.
- There is no automated profiling, and no automated decision-making with legal effects on you.
- Personal data is not sold or transferred to commercial partners. That is not the revenue model.
Legal basis for processing
Form submissions are processed under LGPD art. 7, V (steps preliminary to a possible service contract, at the data subject's request) and, for subjects in the EEA, under GDPR art. 6(1)(b). The IP-hash for form-abuse protection rests on LGPD art. 7, IX (legitimate interest) and GDPR art. 6(1)(f). Payment-status data, when present, is processed on the contractual basis.
How long data is kept
- Form submissions: kept for the duration of the engagement plus 24 months, to preserve conversation context; then deleted. Submissions that do not lead to an engagement are kept for 12 months and then deleted.
- Payment records: kept for as long as applicable tax and accounting law requires (typically 5–6 years), then deleted.
- IP hashes: kept for 90 days — long enough for abuse protection — then deleted.
- Email correspondence: kept while the relationship is active, or for 24 months after the last contact, whichever is longer.
Your rights
Under LGPD, GDPR, and equivalent laws, you may request access to your data, correction, deletion, portability, restriction of processing, or object to processing. To exercise any of these rights, write to hello@risosa.com. The reply arrives within 30 days. If you believe the processing breached the law, you may file a complaint with the competent authority — in Brazil this is the ANPD; in other jurisdictions, the local equivalent.
International transfers
The infrastructure that serves this site is in European Union (Germany). For visitors in Brazil this means data is transferred outside the country, to a jurisdiction that the ANPD recognises as offering an adequate level of protection. Where additional processors (email provider) operate outside the European Union, those transfers rely on standard contractual clauses and the recipient's published safeguards.
Changes to this notice
This notice is updated when data-handling processes change in a meaningful way. The "Updated" date at the top of the page marks the current version. Substantive changes are highlighted on the homepage for 30 days so they remain visible to returning readers.