Contact
Identification
Document 02
Last updated
August 11, 2026

Privacy Policy

This Policy describes data processing related to the Brasil Terras Raras public website and authenticated area, based on the features available in this version.

This Policy applies to public browsing on the website and to the authenticated area available on the app subdomain. It does not cover third-party pages or services accessed through external references.

When personal data is processed, such processing must comply with Brazilian Federal Law No. 13,709/2018, the General Data Protection Law (LGPD), and other applicable rules.

The contact form prepares the message in the user's browser. When continuing, the user chooses a device sharing option or copies the message. The website does not transmit or store the completed content.

After the user chooses an external application or channel, the message is handled under that service's terms and privacy policy. Separately, the authenticated area offers registration and login for viewing a hexagon portfolio. This version does not include payments, checkout, newsletter subscription, or document submission.

Depending on the feature used, the following limited categories of information may be processed:

  • Technical access data: IP address, date and time, browser, device, requested page, approximate source of the visit, and diagnostic or security records may be processed by the infrastructure required to deliver and protect the website.
  • Language preference: when you choose a language, the website saves the key btr-locale in your browser's local storage. This information remains on the device until you change it or remove it in the browser settings.
  • Account and session data: name, email address, internal user identifier, and essential authentication records are processed to create the account, confirm access, and maintain the session securely.
  • Portfolio data: hexagon codes and ownership periods, acquisition requests, linked benefits, and parameters used to calculate projections may be associated with the authenticated account.

The information described above may be used only when necessary to:

  • Deliver the pages and files requested by the browser.
  • Maintain technical stability, availability, and security.
  • Diagnose failures, prevent abuse, and investigate incidents.
  • Remember the language preference selected on the device itself.
  • Create and authenticate the account, maintain the session, and recover access when requested.
  • Display only the hexagons and benefits linked to the authenticated user, record acquisition interest, and calculate the projections made available for that portfolio.
  • Comply with legal obligations or valid requests from competent authorities.

Depending on the purpose, processing may rely on preliminary procedures requested by the data subject, performance of a contract, legitimate interests, the regular exercise of rights, or compliance with a legal obligation, subject to the conditions established by the LGPD.

Only data that is adequate, relevant, and necessary for each purpose should be processed. The language preference is recorded when the user selects an option, and the portfolio is retrieved only after authentication.

Vercel and Cloudflare may process technical data required for hosting, content delivery, DNS, and security. Supabase processes the data required for authentication and the user-area database, always within the purposes described in this Policy.

Account and portfolio data is not sold or used for behavioral advertising in this version of the service.

Information may also be provided when required by law, a valid order, or the need to protect rights. Any international transfers must comply with the safeguards established by applicable law.

Technical records should be retained for the period necessary for operational, security, and compliance purposes, in accordance with the settings and policies of the providers involved.

Account and portfolio data is retained for as long as necessary to provide the service and meet legal obligations or the regular exercise of rights. Ownership and request records may be retained for the applicable period even after access is closed.

The language preference remains in the browser until the user replaces or deletes it. No internet-connected environment is entirely risk-free, although proportionate measures, including authentication and per-user access control, are adopted to reduce unauthorized access, loss, and improper use.

Where provided by the LGPD, data subjects may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, and review of automated decisions, subject to applicable conditions and exceptions.

Requests must allow secure verification of the requester's identity and be directed to the controller through its official privacy channel. This Policy will identify that channel once it has been formally established for the project.

This Policy may be updated when features, providers, processing practices, or applicable law change. The date shown at the beginning of the page identifies the current version.