In force since October 28, 2026.
This is a translation provided for convenience. If it differs from the Portuguese version, the Portuguese version prevails.
Summary in five lines. The only cookie is the session cookie for people who sign in to an account — people who just read the site get none, and we use no measurement or advertising cookies. There is no third-party resource on this page: no external font, no CDN library, no social media button, no analytics tool. Nothing you do here is sent to another company. We keep the standard web server access log for 14 days, processed only inside our server. We do not sell, rent or give personal data to anyone.
What we collect
Like any web server, ours records each request: IP address, date and time, requested address, response code, bytes transferred, referring page and browser identification. The IP address is personal data and we treat it as such.
If you choose the light or dark theme, that preference is stored in your browser's localStorage. It is not a cookie, it does not reach our server, it identifies no one and it does not leave your device. The language you read in is part of the page address (/en/) and is not stored anywhere.
Each time you change screens, the page tells our server which screen was opened, the domain you came from and whether the screen is a phone, tablet or computer. That notice writes nothing to the database: it only appears in the access log above, with the same 14-day retention.
Session cookie, only for people who sign in. There is no open sign-up; accounts are created by the editor. Whoever signs in receives the fdd_sessao cookie, with a random session code (not the username, not the password). It is strictly necessary for the account to work, so it does not ask for consent, and it expires in 30 days or on sign-out.
We collect nothing else. There is no public form, and people who do not sign in receive no persistent identifier, nor is there any attempt to recognize the same visitor from one day to the next.
What we use it for
To keep the service running and diagnose failures and abuse; to know, in aggregate numbers, how many people read and which pages; and to comply with legal record-keeping obligations. The legal basis for the first two is legitimate interest (art. 7, IX, of Brazil's LGPD) — no profiling, no cross-referencing with other databases, no automated decisions about anyone.
Reports come from programs running inside our server that read the same log file. Every fifteen minutes the day is summed up — visitors, screens opened, origin, country and state, device — and only that sum, without IP, is kept. Country and state come from a database of IP ranges kept on the server itself; no lookup leaves it. No log and no report is sent to third parties; IP addresses are used only to count distinct visitors on the same day.
How long
The access log is automatically deleted after 14 days. Aggregate reports, without IP, may last longer. We note a future change so it comes as no surprise: once the project has a company registration (CNPJ) and economic activity, art. 15 of Brazil's Marco Civil da Internet will require six months of retention, and this page will say so.
Who we share with
No one, for commercial or advertising purposes. Necessarily involved in delivering the site are Vultr (infrastructure, São Paulo region) and Let's Encrypt (HTTPS certificate). Data may be provided to public authorities upon a valid legal request.
Your rights
You can confirm processing, access, correct, request deletion and portability, know with whom data was shared and object to processing based on legitimate interest. Write to andre.z.araujo98@gmail.com; we reply within 15 days. You can also complain to the ANPD (Brazil's data protection authority).
An honest note: since we collect no identifier, in practice we cannot locate "your data" from your name or e-mail — only from an IP address and a time window you provide, and only within the 14 days. This is not evasion: it is a consequence of collecting the minimum.
Third-party data we publish
We publish corporate information from public, official documents, and some of them name individuals — relevant shareholders and controlling shareholders —, as required by corporate law, which exists to make that public. Processing for exclusively journalistic purposes is outside the scope of the LGPD (art. 4, II, "a"), but we adopt three limits stricter than the law would require:
CPF numbers are never published. CVM releases the full CPF (Brazilian taxpayer number) of each individual shareholder in its open data; we keep it only as source data and display it masked, with an opaque key for navigation. Company CNPJ numbers are shown in full, as they are public business identifiers.
We never attribute to an individual what the source reports by corporate body. Transactions by officers are disclosed consolidated by corporate body, and that is how we publish them.
We point to the original. Each document links to CVM's system. Found incorrect information about you? Write to us — we correct factual errors and record the correction.
Security
The site is served only over HTTPS, the server has a firewall with the minimum ports, the technical documentation of the data interface is not public and the database is not reachable from the internet. If an incident poses a relevant risk, we will notify the ANPD and the data subjects, under art. 48 of the LGPD.
Changes
Changes appear on this page with a new date. A change that expands what we collect takes effect before the collection begins, never after. When we start offering sign-up or e-mail briefings, this policy will be updated before any new data is collected.
Contact: andre.z.araujo98@gmail.com