Privacy policy

This policy explains what personal data Delay Review handles, why, for how long, and what rights apply. It is written to meet the Brazilian General Data Protection Law (Lei nº 13.709/2018, the LGPD) and, for readers in the European Economic Area and the United Kingdom, the General Data Protection Regulation.

1. Controller

The controller of the data described here is Delay Review, operating from Brazil. Contact for all privacy matters: support@delayreview.site. Delay Review is not required to appoint a data protection officer and has not appointed one; the mailbox above is the point of contact for the purposes of Article 41 of the LGPD.

2. What is collected

Data provided directly

• Email address and message content, when a message is sent to the support mailbox.
• Name, email address and transaction reference, where material is purchased. Card numbers and banking details are never received or stored by Delay Review — they are handled entirely by the payment processor.

Data collected automatically

• Standard server log data recorded by the hosting provider: IP address, user agent, requested page, referrer and timestamp.
• Aggregate usage measurements, where analytics are in use: pages viewed, approximate region, device category.
• Advertising measurement identifiers, where an advertising platform's measurement tag is present on a page.

Delay Review does not knowingly collect data from anyone under 18 and does not direct material to minors. Sensitive personal data as defined in Article 5(II) of the LGPD — data on health, race, religion, political opinion, union membership, biometrics or sexual life — is not collected, requested or inferred.

3. Why it is processed, and on what legal basis

• Answering messages. Legitimate interest (LGPD Art. 7(IX); GDPR Art. 6(1)(f)) in responding to a request that was addressed to the publication.
• Completing a purchase and providing access to purchased material. Performance of a contract (LGPD Art. 7(V); GDPR Art. 6(1)(b)).
• Meeting accounting and tax obligations. Legal obligation (LGPD Art. 7(II); GDPR Art. 6(1)(c)).
• Keeping the site available and protected against abuse. Legitimate interest (LGPD Art. 7(IX); GDPR Art. 6(1)(f)).
• Analytics and advertising measurement. Consent, where consent is required in the reader's jurisdiction (LGPD Art. 7(I); GDPR Art. 6(1)(a)).

4. Cookies and similar technologies

The pages of this site do not require cookies to be read. Where cookies or similar identifiers are set, they fall into two groups:

• Strictly necessary. Set by the hosting or content delivery provider to serve pages and mitigate abuse. These cannot be switched off without breaking the site.
• Measurement and advertising. Set by analytics or advertising platforms to count visits and attribute advertising. These are optional.

Browser settings can block or delete cookies at any time. Blocking measurement cookies does not restrict access to any article.

5. Sharing

Personal data is disclosed only to the operators needed to run the publication, and only to the extent each needs:

• Hosting and content delivery providers.
• Email service providers used for the support mailbox and for transactional messages.
• The third-party payment processor, for purchases.
• Analytics and advertising platforms, where their measurement tags are present.
• Accountants and legal advisers, where an obligation or a claim requires it.

Delay Review does not sell personal data and does not disclose it to data brokers.

6. International transfers

Delay Review operates from Brazil and uses providers located outside Brazil, including in the United States and the European Union. Transfers out of the EEA or the UK rely on the European Commission's standard contractual clauses or on an adequacy decision, depending on the provider. Transfers out of Brazil are made under Article 33 of the LGPD, relying on contractual clauses offering an equivalent level of protection or on the data subject's consent where applicable.

7. Retention

• Support correspondence: up to 24 months after the exchange closes.
• Purchase and transaction records: 5 years, to meet Brazilian tax and consumer-law record-keeping requirements.
• Server logs: up to 12 months.
• Analytics and advertising measurement data: as configured by the platform, typically no more than 14 months.

At the end of the applicable period, data is deleted or irreversibly anonymised.

8. Rights

Under Article 18 of the LGPD, a data subject may request confirmation that processing exists; access to the data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed on the basis of consent; information about the entities with which data has been shared; information about the consequences of refusing consent; and withdrawal of consent.

Readers covered by the GDPR hold the equivalent rights of access, rectification, erasure, restriction, portability and objection, including objection to processing based on legitimate interest.

Requests go to support@delayreview.site and are answered within 15 days for LGPD requests and within one month for GDPR requests. No fee is charged. Verification of identity may be requested where the account of the requester is not otherwise identifiable.

9. Complaints

A complaint may be filed with the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) at gov.br/anpd. Readers in the EEA or the UK may complain to their national supervisory authority.

10. Protection measures

The site is served over HTTPS. Access to the support mailbox and to administrative tooling is restricted to the editorial account and protected with multi-factor authentication. No method of transmission or storage is perfectly safe, and no absolute guarantee of protection is offered.

11. Changes

This policy may be updated. The date at the head of the page reflects the current version. Material changes are noted on this page rather than announced by email, as Delay Review does not maintain a marketing list.