Privacy policy

1. Who is responsible for your data

lagares.ai is the personal site of Fausto Lagares: manifesto, the companies he builds, podcast, writing and speaking. The controller of data processed on lagares.ai is Lagares Ventures Ltda., based in Brazil. For anything related to privacy, including exercising your rights, write to legal@lagares.ai, and a person answers.

This policy covers the site and what happens on it. Third-party services you reach from here have their own policies.

2. What we collect

This site has no accounts and no login area. We collect little, and here is all of it:

• Approximate country, region, city and time zone, derived from your IP address by the site infrastructure.
• How you got here: campaign parameters (UTM) and referring site, when present.
• How you use the page: pages viewed, clicks, scrolling, device type and browser.
• A recording of your session: mouse movement, clicks and what appears on screen, only if you accept cookies.
• Your preferences: language, region, and your own decision about cookies.

We do not ask for or store national ID numbers, home addresses, card details, or any sensitive data: racial or ethnic origin, religious belief, political opinion, health data, sex life, genetic or biometric data.

3. Why we collect it, and on what legal basis

Brazilian law (LGPD) requires a legal basis for each processing activity. Ours:

• To show the page in your language and the offer for your market: legitimate interest (Art. 7, IX), because the site does not work properly without it.
• To understand what works on the page and improve the product: consent (Art. 7, I), asked in the cookie banner.
• To keep the site secure and prevent abuse: legitimate interest (Art. 7, IX).
• To comply with a legal or regulatory obligation, where one exists: Art. 7, II.

If you are in the European Union, the equivalent GDPR bases are Art. 6(1)(a), (b), (c) and (f), in the same order.

4. Cookies and measurement

We use as few as possible, and none for advertising. The full list, what each one does and how to delete them is in the Cookie policy. In short: the essential ones remember language, region and your cookie decision; measurement ones only load after you accept.

The measurement tools are Google Analytics (G-Q1CSZZKGRY) and Microsoft Clarity (xzww4o6utn), orchestrated by Google Tag Manager (GTM-TK6G95WT). Clarity is the more intrusive of the two because it records the session, which is exactly why it only runs with your consent.

5. Who we share it with

We do not sell your data. Ever. We share only with those who must process data for the site to exist:

• Vercel: hosting and delivery of the site, in the United States.
• Google: audience measurement (Google Analytics and Tag Manager) and playback of embedded videos, in cookieless mode until you press play.
• Microsoft: heatmaps and session recording (Clarity).
• Public authorities, only where the law requires it, and we tell you unless we are forbidden to.

Each of these providers processes data under a contract that binds them to act on our instructions and to protect the information.

6. International transfers

Data is processed in the United States, because that is where hosting and the measurement tools live. For transfers from Brazil to the United States we rely on international transfer clauses in the standard of ANPD Resolution 19/2024 (LGPD Art. 33 and following) and, where applicable, your specific consent.

Between Brazil and the European Union that requirement no longer applies: since January 2026 there is mutual adequacy recognition between ANPD and the European Commission, which removes the need for contractual clauses on that flow.

7. How long we keep it

• Measurement data in Google Analytics: 14 months, then deleted automatically.
• Session recordings in Clarity: per the service retention, currently 30 days.
• Preferences stored in your browser: until you clear them, or until each cookie expires (the longest is 1 year).
• Records the law requires us to keep: for the legal period, and not a day longer.

8. Your rights

The LGPD (Art. 18) guarantees these, and we offer them to everyone, wherever you are:

• Confirm whether we process your data, and access that data.
• Correct incomplete, inaccurate or outdated data.
• Request anonymisation, blocking or deletion of unnecessary or unlawfully processed data.
• Request portability of your data to another provider.
• Delete data processed on the basis of your consent.
• Know who we share your data with.
• Be told that you may refuse consent, and what happens if you do.
• Withdraw consent at any time, free of charge and without penalty.
• Request review of a decision made solely by an automated system.

Just write to legal@lagares.ai. We answer simple requests immediately and full reports within 15 days, the timeframe indicated by ANPD. If you are in the European Union, the same rights come from GDPR (Art. 15 to 22); in California, from CCPA/CPRA, including the right not to be discriminated against for exercising them.

You may also complain to ANPD in Brazil, or to the data protection authority in your country.

9. Security

The whole site runs over an encrypted connection. Waitlist data travels through an authenticated channel and internal access is limited to those who need it to work. No system is 100% secure and we will not pretend otherwise: if an incident occurs that poses relevant risk to you, we notify you and ANPD within the deadlines of LGPD Art. 48 and ANPD Resolution 15/2024.

10. Children and teenagers

This site is not directed at anyone under 18 and we do not knowingly collect children's data. If you are a guardian and believe a child sent us data, write to legal@lagares.ai and we will delete it.

11. Changes to this policy

If we change anything material, we give 30 days notice and update the date at the top of this page. The version in force is always this one.

12. How to reach us

Write to legal@lagares.ai. A person answers, not a form.