Draft for review before publication. The responsible person's identity and contact information below must be completed, and provider retention and tracking settings confirmed.
Updated October 15, 2026.
Who is responsible for your data
The controller of Pulso's personal data is Ana Carolina Verna. Privacy contact: suporte@ninho-br.com.
What we collect and why
When you sign up, we use your email and chosen language (Portuguese, English or Spanish) to send confirmation and the corresponding edition. To change language, submit a new request and confirm by email. You join the daily newsletter list only after confirmation. Resend stores your address, subscription status and operational signup and delivery data. Administrative notifications to the owner are disabled by default and sent only when enabled.
The confirmation link contains encoded data and a signature; it is not encrypted, expires after 48 hours and can be used once. Opening it does not confirm your subscription: you must click the button on the page. A new request replaces the previous link. Do not share these links.
Legal basis and your choices
Newsletter delivery is based on your consent (Article 7(I) of Brazil's LGPD), given at signup and confirmed through the link. You may withdraw it free of charge at any time using the unsubscribe link in each edition. Communications needed to address your requests and legal obligations use the legal bases applicable to each purpose.
Providers and international transfers
We use Upstash Redis to store pseudonymized email/IP identifiers, limit attempts, manage pending confirmations and prevent duplicate sends; Resend to confirm subscriptions, manage contacts and preferences and send messages; Vercel to host the site and run functions; and Google Fonts for typography. These services may process data abroad. Contracting and configuration must follow LGPD and ANPD international transfer requirements.
Google Gemini receives public news headlines, links and excerpts to write and check summaries. The code does not send email addresses or the subscriber list to Gemini. On the free API tier, Google may use submitted content to improve its products. We do not sell the list or give it to sponsors; advertisements, if any, are identified in the edition.
Technical data and tracking
We use Vercel Web Analytics to measure visits and page views, including referral, country, device and browser statistics. According to Vercel, measurement uses no cookies and uses identifiers derived from requests that renew daily. Our code removes query parameters and fragments before sending events and does not measure confirmation or cancellation pages under /api/. We do not send form data or subscriber lists to analytics. The site does not implement advertising cookies while ads are disabled. Loading pages and external fonts may share IP, browser and technical logs with providers. Resend may record deliveries, rejections and, depending on account settings, opens and clicks. Before publishing this policy, the owner must confirm and disclose which features are enabled.
How long we keep data
Attempt counters expire within 24 hours and pending confirmation identifiers within 48 hours. Daily send records and administrative notification opt-outs are kept to prevent duplication and respect choices. Locks on interrupted operations remain available for owner review. Your address remains on the list while subscribed. After cancellation, the unsubscribed status may be kept to respect your choice and prevent further sends. Other records must be deleted or anonymized when no longer needed, except for legal obligations or exercising rights. Technical log retention depends on provider settings and must be defined by the owner before publication.
Your rights
You may request confirmation of processing, access, correction, information about sharing, anonymization, blocking or deletion of unnecessary data, portability as regulated, withdrawal of consent and deletion of data processed with consent, subject to legal retention exceptions. Send requests to the contact above; proportionate information may be requested to verify your identity. You may also petition Brazil's ANPD and consumer protection agencies.
Security and changes
We use signed confirmation tokens and server-side access secrets. Access to the list should be restricted to the owner and necessary providers. No system eliminates every risk; incidents will be assessed and reported when required by law. Readers will be informed of significant policy changes.