Newsletter privacy

Controller and scope

Polaryeti is an independent software studio run by João Pedro M. A., an individual, in Uberlândia, Minas Gerais, Brazil. Polaryeti decides how and why the data described here is processed — the controller, in the terms of Brazil's General Data Protection Law (Lei 13.709/2018, the LGPD), which is the law this newsletter operates under.

This policy covers the news.polaryeti.com subdomain and both editions of the newsletter, Portuguese and English. It does not cover the third-party sites an edition links to: each has its own policy, and that policy governs what happens once you click.

Questions, requests or complaints about privacy: aspuma13@gmail.com. That is also the data protection officer's channel.

Data, one item at a time

At signup

• Email address — required. Without it there is nowhere to send the edition.
• Name — optional. It is only used for the greeting. Leaving it blank changes nothing about what you receive.
• Chosen language — PT or EN, which decides which of the two lists you join.
• Date and time of consent — stored with the record. It is the proof that the signup came from you, required by art. 8 § 2 of the LGPD.

Signup is double opt-in: after you submit the form, a confirmation email arrives. Until you click it, no edition is sent. If someone else typed your address, just ignore it — an unconfirmed record is discarded.

On this site

• Traffic measurement — the site uses Umami, self-hosted by us at analytics.polaryeti.com, to count page visits. No cookie and no user profile. A session is identified by a code derived from your IP and browser that is discarded and rotated every day. If your browser sends the Do Not Track signal, the visit simply is not counted.
• Fonts, icons and images — all served from this subdomain. Apart from the measurement above, which is also ours, this site makes no request to any third-party server.
• Hosting — the server keeps technical access logs (IP, timestamp, page) for a short period, for security and operations.

What is never collected

• Sensitive data as the LGPD defines it (racial origin, religious belief, political opinion, health, sex life, biometrics). The form has no field for it, and it does not belong in the name box either.
• Card details. The newsletter charges nothing.
• Phone, address, job title, company or any commercial profile field. They are not asked for because they are not used.
• Your contacts, your calendar or your location.

Opens and clicks, no euphemism

Editions are delivered by Brevo, and its default tracking is on. In practice that means two concrete things:

• An open pixel. Every edition carries a 1×1 pixel image hosted by Brevo. When your mail client downloads images, it is recorded that this address opened this edition, with date, time and an approximate IP address.
• Rewritten links. Links in the edition pass through a Brevo redirector before reaching their destination. Which address clicked which link, and when, is recorded.

What it is for, honestly: knowing which sections are read and which are skipped, and cutting the ones nobody opens. It is not used to score readers, build commercial profiles, target ads or feed anything outside the newsletter itself. These records are never sold or transferred.

This is a real difference from the studio's website, which tracks nobody individually. The newsletter does track, and it is written here instead of buried in a footer paragraph.

How to switch it off from your side

• Block images in your mail client. The pixel never loads and the open is not recorded. Editions are written to be read in full with no images at all — nothing essential lives inside a picture.
• Don't click the links and go to the source directly by title. No click, no record.
• Ask by email. Write to aspuma13@gmail.com asking for tracking to be disabled on your subscription, and it is disabled individually, without you losing the newsletter.

What it's for and where it goes

Purposes

• Sending the daily edition to whoever asked for it;
• Keeping proof of consent, as the law requires;
• Measuring opens and clicks in aggregate, to decide what stays in the edition and what goes;
• Replying to what you write to us;
• Meeting a legal obligation, where one exists.

The list is not used for anything else. No promotional email, no pitch from the studio, no third-party product blast. If the newsletter ever takes sponsorship, the sponsor does not get the list — it gets space in the edition, labelled as such.

Processors

• Brevo (Sendinblue SAS, France) — stores the contact list, sends the editions and records opens and clicks. Besides us, it is who has your address.
• Google — the Gemini API drafts each edition from the day's public news. No subscriber data goes into that call: the model sees the sources, never the list.
• Hosting provider — serves this site and runs the automation that assembles the editions, on our own server.

Outside those cases, data is shared only with your explicit consent or to comply with a legal, judicial or regulatory order.

International transfer

Brevo processes data in the European Union, and Google in the United States. Your data may therefore be processed outside Brazil, by providers offering contractual protection guarantees compatible with art. 33 of the LGPD.

Legal basis

• Consent (art. 7, I) — joining the list, and the open and click measurement. You give it by ticking the box and confirming the email, and you can withdraw it at any time by unsubscribing;
• Legal obligation (art. 7, II) — keeping the consent record;
• Legitimate interest (art. 7, IX) — the server's technical logs, used for security and abuse prevention.

How long it is kept

• Email and name — for as long as you are subscribed. After you unsubscribe, the contact is removed from the active list within 30 days.
• Consent and unsubscribe record — kept for up to 5 years after you leave, purely to prove the subscription existed and that the exit was honoured. Nothing else fits in that record.
• Open and click history — up to 12 months, then discarded. On unsubscribe it is deleted along with the contact.
• Unconfirmed signup — discarded within 7 days if you never click the confirmation email.
• Server technical logs — up to 12 months.

On security: all traffic is HTTPS, the Brevo API key stays on the server and never reaches a visitor's browser, and administrative access is limited to the studio's founder. No system is perfectly secure and we will not claim otherwise — but in the event of an incident with material risk, you and the Brazilian data protection authority (ANPD) will be notified, under art. 48 of the LGPD.

Minors. The newsletter is not aimed at anyone under 13 and we do not knowingly collect data in that range. If such a record is identified, it is removed.

How to leave the list

Two routes, both effective immediately.

1. The link in every edition

In each email's footer, reading “Unsubscribe”, at the same size as the rest of the footer. One click does it. There is no are-you-sure screen, no reason form, and no offer to “get fewer emails” instead of leaving.

2. By email

Write to aspuma13@gmail.com from the subscribed address, with the subject “Unsubscribe”. Removal happens within 2 business days and you get a confirmation.

What you can demand

Under the LGPD (art. 18), at any time and at no cost, you may request confirmation and access to your data, correction of inaccurate data, deletion, portability in a machine-readable format, information about who we share it with, and withdrawal of consent.

Write to aspuma13@gmail.com from the subscribed address. The reply comes within 15 days. If something takes longer, you are told why inside that window. If the reply does not settle it, you can complain to the ANPD (gov.br/anpd).

When this policy changes

Every revision changes the effective date at the top of this page. When a change is material — a new data category, a new purpose, a new processor — everyone on the list is told in the edition itself, before the change takes effect. This page is the current version; there is no parallel copy anywhere else.