Last updated: October 20, 2026
This Privacy Policy explains how EspiaAqui (espiaqui.com.br) collects, uses, shares and protects personal data, and how you can exercise your rights. It covers the Brazilian General Data Protection Law (LGPD, Law nº 13.709/2018), the EU and UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar US state privacy laws.
1. Who is responsible for your data
The data controller is BUZZA DIGITAL LTDA, a company registered in Brazil under CNPJ 68.416.750/0001-82, which operates EspiaAqui.
- Privacy contact and Data Protection Officer (Encarregado): [email protected]
- General contact: [email protected] or our contact form
2. Personal data we collect
Data collected automatically when you visit the site:
- IP address, browser and device type, operating system, language, and the date and time of access;
- pages visited, the page that referred you, campaign parameters in the link you followed (such as
utm_campaign), and how you interact with pages and ads; - approximate location (country), derived from your IP address;
- identifiers stored in cookies and similar technologies (see section 4 and our Cookie Policy).
Data you give us: your name, email address and message when you use our contact form or write to us by email.
We do not ask for sensitive personal data, we do not offer user accounts, and we do not knowingly collect data from children.
3. Why we use your data, and our legal bases
| Purpose | Data | Legal basis (LGPD / GDPR) |
|---|---|---|
| Delivering the site, keeping it secure and preventing abuse | Technical and access data | Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)) |
| Keeping access logs for 6 months | IP address, date and time | Legal obligation – Brazilian Internet Civil Framework, Law nº 12.965/2014, art. 15 (LGPD art. 7, II; GDPR art. 6(1)(c)) |
| Replying to your messages and requests | Name, email, message | Your request and our legitimate interest (LGPD art. 7, V and IX; GDPR art. 6(1)(b) and (f)) |
| Audience measurement with Google Analytics | Access data, cookie identifiers | Legitimate interest in understanding and improving our content (LGPD art. 7, IX; GDPR art. 6(1)(f)) |
| Showing ads, including personalized ads, through Google Ad Manager and its partners, which fund our free content | Access data, cookie identifiers, approximate location | Legitimate interest in funding the site (LGPD art. 7, IX; GDPR art. 6(1)(f)) |
| Measuring the results of our ad campaigns on Meta platforms (Meta pixel) | Cookie identifiers, pages visited on this site | Legitimate interest in measuring our marketing (LGPD art. 7, IX; GDPR art. 6(1)(f)) |
| Complying with legal requests and defending our rights | Any of the above, as needed | Legal obligation and regular exercise of rights (LGPD art. 7, II and VI; GDPR art. 6(1)(c) and (f)) |
Where we rely on legitimate interest, you have the right to object at any time (see section 9). We do not use your data for automated decisions that produce legal or similarly significant effects on you.
4. Cookies
We use cookies for the site to work, for audience measurement, for advertising and to measure our ad campaigns. When you first visit, a banner tells you about them. Each cookie, its purpose and its duration are listed in our Cookie Policy, together with how to block or delete cookies in your browser and how to opt out of personalized ads from Google and Meta.
5. Who we share data with
We do not sell personal data for money. We share data only with:
- Infrastructure providers: our hosting provider and Cloudflare, Inc. (content delivery and security), which process data on our behalf;
- Google LLC / Google Ireland Ltd. – Google Analytics and Google Ad Manager, including its advertising partners, to measure our audience and to serve and measure ads. See how Google uses data from partner sites;
- Meta Platforms, Inc. / Meta Platforms Ireland Ltd. – the Meta (Facebook/Instagram) pixel, to measure the results of our ad campaigns. Events are sent through our own campaign measurement service at t.espiaqui.com.br;
- Our ad operations tools, which receive the campaign parameters of the link you followed (such as
utm_campaign) and the page visited, without names, emails or other direct identifiers; - Authorities, when required by law or court order, and a buyer or successor in case of a merger or sale of the business.
Under California law, sharing cookie identifiers and browsing data with advertising partners for cross-context behavioral advertising may be considered “selling” or “sharing” personal information (see section 9.3).
6. International transfers
Our providers may process data outside your country, including in the United States. When this happens, we rely on the safeguards allowed by law, such as standard contractual clauses, the EU-US Data Privacy Framework for certified providers, and the mechanisms of LGPD art. 33.
7. How long we keep data
- Contact messages: up to 12 months after the last exchange, then deleted;
- Access logs: 6 months, as required by Law nº 12.965/2014;
- Cookies: for the periods listed in our Cookie Policy;
- Analytics and advertising data held by Google and Meta: for the periods set by those companies in their own policies.
We may keep data for longer only when required by law or to defend our rights.
8. Security
The site uses HTTPS (TLS) encryption, and we adopt technical and organizational measures to protect data against unauthorized access, loss or misuse. No system is completely secure, and we will notify affected users and the authorities of any security incident as required by law.
9. Your rights
9.1 Brazil (LGPD)
Under LGPD art. 18 you have the right to: confirm whether we process your data; access it; correct incomplete, inaccurate or outdated data; anonymize, block or delete unnecessary or excessive data or data processed in breach of the law; data portability; information about who we share it with; and to object to processing based on legitimate interest. You may also file a complaint with the National Data Protection Authority (ANPD).
9.2 European Economic Area, United Kingdom and Switzerland (GDPR)
You have the right to access your data, to rectification, to erasure (“right to be forgotten”), to restriction of processing, to data portability, and to object to processing based on legitimate interest, including any processing for direct marketing. You also have the right to lodge a complaint with the data protection authority of your country of residence or work.
9.3 California and other US states (CCPA/CPRA)
Notice at collection. In the last 12 months we collected the following categories of personal information: identifiers (IP address, cookie and device identifiers); internet or other electronic network activity (pages visited, interactions with ads); approximate geolocation; and inferences that advertising partners may draw about your interests. We collect it from you and your browser, for the purposes described in section 3, and we disclose it to the categories of recipients in section 5. We do not collect sensitive personal information, and we do not knowingly sell or share personal information of consumers under 16.
Your rights. You have the right to know what personal information we collect, use and disclose; to access it; to delete it; to correct it; and to opt out of its sale or sharing. We will not discriminate against you for exercising these rights.
Opting out of personalized advertising. You can turn off ad personalization by Google at Google Ads Settings and by Meta in Meta Ad Preferences, and you can block or delete cookies in your browser, as explained in our Cookie Policy.
You may use an authorized agent to make a request on your behalf. We will need to verify your identity, and we respond within 45 days.
9.4 How to exercise your rights
Send your request to [email protected] or use our contact form (subject “Privacy or data request”). We may ask for information to confirm your identity. We reply within 15 days (LGPD), one month (GDPR) or 45 days (CCPA), as applicable.
10. Children
EspiaAqui is intended for adults (18+). We do not knowingly collect personal data from children under 13 (COPPA) or from minors under 16. If you believe a child has sent us personal data, contact us and we will delete it.
11. Links to other websites
Our articles may link to third-party websites. We are not responsible for their privacy practices, and we recommend reading their policies.
12. Changes to this policy
We may update this policy to reflect legal, technical or business changes. The date at the top of the page shows the latest revision.
13. Contact
BUZZA DIGITAL LTDA – CNPJ 68.416.750/0001-82
Privacy: [email protected] · General: [email protected]