Privacy Policy

Last updated: May 13, 2026
Effective: from the date of publication
Version: 1.0

Rico aos Poucos (ricoaospoucos.com.br) respects your privacy and is committed to protecting your personal data. This Privacy Policy describes, clearly and transparently, what data we collect, why we collect it, how we use it, with whom we share it, and what your rights are as the data subject, in compliance with Brazil's General Data Protection Law — LGPD (Law No. 13,709/2018), the Marco Civil da Internet (Law No. 12,965/2014), and other applicable regulations.

By accessing or using the Rico aos Poucos website, you declare that you are aware of and agree to the terms of this Policy. If you do not agree with any provision herein, please do not use the site.

1. Who Is the Data Controller

For the purposes of this Policy, the data controller of personal data collected by the site is the individual responsible for the Rico aos Poucos project, identified through the official channels described at the end of this document. Rico aos Poucos is an independent financial education project maintained by an individual, with no direct commercial profit derived from the site.

2. What Data We Collect

2.1. Data voluntarily provided by you

• Login with Google (OAuth 2.0): when you choose to log in with your Google account to use features such as comments or watchlist, Google shares with us your display name, email address, profile picture, and a unique identifier (Google ID/sub). We never have access to your Google password.
• Comments and interactions: text you write in comment fields, opinions, or polls. This content is public within the site after submission.
• Watchlist and preferences: the list of Brazilian Real Estate Funds (FIIs) and other assets you mark as favorites for tracking, as well as display preferences.
• Direct contact: any data you send us by email or other contact channels (name, email, message content).

2.2. Automatically collected data

• Browsing data: IP address, browser type and version, operating system, screen resolution, language, pages visited, time on site, referrer pages, and access timestamps.
• Cookies and similar technologies: small files stored on your device for authentication, session preferences, usage metrics, and PWA (Progressive Web App) functionality. See Section 6 for details.
• Aggregated and anonymized metrics: collected by Google Analytics to understand site usage (with IP masking where available).

2.3. Data we do NOT collect

• We do not collect sensitive financial data (Brazilian tax ID / CPF, national ID / RG, bank details, card numbers, balances, or net worth).
• We do not collect health data, biometrics, or sensitive data as defined under Art. 5(II) of the LGPD.
• We do not require your precise GPS location.

3. How We Use Your Data (Purposes)

Purpose	Legal basis (LGPD, Art. 7)
Authenticate you on the site via Google login and maintain your session	Performance of contract (use of service) / consent
Save comments, watchlist, and account preferences	Performance of contract / legitimate interest
Display educational content, analyses, and tools (calculators, simulators)	Performance of contract / legitimate interest
Measure audience and improve the site (aggregated analytics)	Legitimate interest
Detect abuse, spam, fraud, and protect service security	Legitimate interest / compliance with legal obligation
Handle data subject requests (LGPD), respond to contact, and comply with legal obligations	Compliance with legal obligation / consent

4. With Whom We Share Data

We do not sell your personal data. Sharing occurs only with service providers strictly necessary for site operation and, when required, with competent authorities:

• Google LLC — OAuth 2.0 login (authentication), Google Analytics (audience), and Google Fonts (typography). Google's policy: policies.google.com/privacy.
• GitHub, Inc. — site hosting via GitHub Pages (static file server). GitHub's policy: GitHub Privacy Statement.
• Cloudflare, Inc. — proxy/CDN and abuse protection, where applicable. Cloudflare's policy: cloudflare.com/privacypolicy.
• YouTube (Google LLC) — embedded videos may collect data per Google's policy.
• Public and judicial authorities, when there is a valid legal request or for the defense of rights in administrative or judicial proceedings.

4.1. International Data Transfers

Some providers listed above (Google, GitHub, Cloudflare) may process data outside Brazil. In such cases, we require that such transfers comply with the requirements of Art. 33 of the LGPD, with adequate contractual and technical safeguards (standard contractual clauses, recognized certifications).

5. How Long We Retain Data

• Account data (Google login): while your account is active and for up to 12 months after deletion, for audit and security purposes.
• Published comments: remain published until you request removal or the content is moderated for a violation.
• Access and security logs: 6 months, per Art. 15 of the Marco Civil da Internet.
• Aggregated/anonymized analytics data: up to 14 months (default configuration of Google Analytics 4).

6. Cookies and Similar Technologies

We use three categories of cookies/local storage:

• Strictly necessary: authentication (OAuth session cookies), language preferences, and PWA Service Worker cache. Without them, the site does not function correctly.
• Functional: store your watchlist, last viewed theme, and user preferences. Saved in your browser's localStorage and can be deleted at any time.
• Analytics: Google Analytics (gtag.js, ID G-6XBNHTHSTW), which measures aggregate site usage with IP masking. You can opt out by installing the official Google opt-out extension (tools.google.com/dlpage/gaoptout) or by blocking cookies in your browser settings.

7. Information Security

We adopt reasonable technical and administrative measures to protect your data, including:

• HTTPS/TLS connections on all pages;
• Authentication delegated to Google (OAuth 2.0), with no passwords stored on our servers;
• Cryptographically signed session cookies;
• Restricted database access following the principle of least privilege;
• Backups and audit logs.

Nevertheless, no system is completely immune to incidents. Should a security incident occur that poses a relevant risk to your rights, we will notify you and the Brazilian National Data Protection Authority (ANPD) as required by the LGPD.

8. Your Rights as a Data Subject (LGPD)

You have the right, at any time and free of charge, to:

• Confirm the existence of processing of your data;
• Access the data we hold about you;
• Correct incomplete, inaccurate, or outdated data;
• Anonymize, block, or delete unnecessary, excessive, or non-compliant data;
• Data portability to another service provider;
• Delete personal data processed based on your consent;
• Obtain information about with whom we share your data;
• Revoke consent at any time;
• Object to processing carried out under other legal bases;
• File a complaint with the ANPD (gov.br/anpd).

To exercise any of these rights, send an email to [email protected] with the subject "LGPD - Data Subject Rights". We will respond within the legal deadline (currently up to 15 days). To verify your identity, we may request additional information.

9. Children and Minors

Rico aos Poucos is not intended for persons under 18 years of age. We do not intentionally collect data from children and minors. If you identify that a minor has provided data without the consent of their legal guardian, please contact us for immediate deletion.

10. Third-Party Content and External Links

The site contains links and embedded content from third parties (YouTube, Google, news sites, and financial data sources). We are not responsible for the privacy practices of those third parties. We recommend reading their respective policies before providing data to them.

11. Important Notices Regarding Financial Content

This Policy covers personal data only. For the terms of use of educational content, tools, and investment analyses, please consult the Terms of Service. We reiterate: the site is educational and does not constitute investment advice, an offer, or investment consulting services.

12. Changes to This Policy

This Policy may be updated to reflect legal, operational, or technological changes. We will always indicate the date of the most recent update at the top of the document. Material changes will be communicated prominently on the site's home page. Continued use of the site after the publication of a new version constitutes acceptance of the updated terms.

13. Contact and Data Protection Officer (DPO)

For questions, complaints, requests to exercise rights, or any matter related to personal data protection, please contact:

• Email: [email protected]
• Website: ricoaospoucos.com.br
• Suggested subject: "LGPD - [your request]"

This Privacy Policy was drafted under Brazilian law and in the Portuguese language, which prevails in the event of any discrepancy with translated versions. The court of the data controller's domicile in Brazil shall have jurisdiction over any disputes arising from its application.