Privacy notice

// version 1.3 · updated on 10/09/2026

This is my personal and professional website. It processes very little data, and this notice explains what it is, what it is used for, who it is shared with and how you exercise your rights under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018).

Privacy contact: bcbruno@hotmail.com

Who is responsible

The controller is me, Bruno Castro, an individual, author and maintainer of brunocastro.dev. There is no company behind the site: I am the one who receives and answers requests about personal data, through the contact shown at the top of this page.

What data I process and why

Purpose	Data	Legal basis (LGPD)	For how long
Replying to the message you send through the contact form	Name, email, subject and, if you fill it in, the description	Steps prior to a contract, at your request (art. 7, V) or, for other contacts, legitimate interest (art. 7, IX)	While the conversation lasts and for up to 12 months after the last contact; the delivery record stays 30 days at Resend
Protecting the form against spam and abuse	IP address, a hidden anti-spam field and the time taken to fill in the form	Legitimate interest (art. 7, IX)	The IP stays only in temporary server memory, for a 10-minute window, and is never written to disk; the other signals are not stored
Measuring site audience in aggregate	Address of the page visited (the term typed in the projects search is removed before sending), referring site, approximate location, device type, operating system and browser	Legitimate interest (art. 7, IX)	The visit identifier is discarded within 24 hours; only aggregate statistics remain, viewable for 1 month
Remembering your preferences	Language, theme, reduced animations and your choice about audience measurement	Legitimate interest (art. 7, IX)	Language cookie for 1 year; the rest stays in your browser until you clear it
Keeping the site online and secure	Access logs from the hosting provider (IP, date, time and page)	Legitimate interest (art. 7, IX)	About 1 hour in the hosting runtime logs

I do not ask for sensitive data or documents. Please avoid including them in your message.

I do not sell data or use it for advertising. It only goes through the services that make the site work:

Who	What for	Where it is processed
Vercel	Site hosting and audience measurement (Vercel Web Analytics)	United States; the site functions run in São Paulo
Resend	Delivering the contact form message to my mailbox	United States
Google (Gmail)	Storing the messages received	United States and other countries where Google keeps servers

International transfer

Vercel, Resend and Google are United States companies and process data there. The message sent through the form is delivered by Resend and stored in my Gmail mailbox, and the access logs and audience measurement data stay with Vercel; in both cases the data leaves Brazil. For the form, the transfer happens so that the message you chose to send can reach me.

Cookies and browser storage

The site does not use advertising or cross-site tracking cookies, and audience measurement works without cookies. If your browser still holds old Google Analytics cookies for this domain, the site deletes them on load. What stays in your browser only remembers your preferences:

Name	Type	What for	Duration
bc_locale	First-party cookie	Remembering the language so the server renders the page in the right one	1 year
theme	Local storage	Remembering the light or dark theme	Until you clear it
brunocastro-settings	Local storage	Remembering language, animations, your choice about audience measurement and whether the measurement notice was dismissed	Until you clear it

Audience measurement

I use Vercel Web Analytics to learn which pages are visited and where visits come from. The measurement is aggregated, uses no cookies, is not used to identify you and does not follow your browsing on other sites. On your first visit, a line at the bottom of the page tells you about the measurement. You can turn it off right there or, at any time, in settings; the choice takes effect immediately and is stored in this browser.

Open privacy settings →

Your rights

Under the LGPD (art. 18), you can request, free of charge:

confirmation that I process your data, and access to it;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
portability;
information about who the data was shared with;
objection to processing carried out without your consent, if you believe it does not comply with the law.

To exercise any of them, write to the privacy contact shown at the top of this page. I reply immediately when possible, or within 15 days. If you believe your request was not addressed, you can file a complaint with the Brazilian data protection agency (ANPD).

Security

The site only works over an encrypted connection (HTTPS). The form message is not stored in a site database: it is validated on the server and delivered by email. If an incident that may cause relevant risk or harm occurs, the people affected and the ANPD will be notified as required by law.

Children and teenagers

This is a professional website, not directed at children or teenagers, and it does not knowingly collect their data.

Changes to this notice

The version and the date of the last update are shown at the top of this page. Changes to purposes, sharing or retention periods will be highlighted here.

Privacy notice

## Who is responsible

## What data I process and why

## Who the data is shared with

## International transfer

## Cookies and browser storage

## Audience measurement

## Your rights

## Security

## Children and teenagers

## Changes to this notice