Privacy Policy
this is a courtesy translation. in case of any conflict, the Portuguese version prevails as the legally binding text under Brazilian law.
1. Who we are
Madalena is a marketplace that connects local videomakers and photographers with anyone who wants to record a moment in Rio de Janeiro, with an editorial proposition of authorial recording made by residents of the city. We serve tourists visiting the city, personal occasions, and also companies and brands at their events.
This Privacy Policy describes how we handle the personal data collected through the forms and navigation of the site, in compliance with the General Data Protection Law (Lei nº 13.709/2018, "LGPD").
Data controller (legal entity responsible for the processing, per art. 5, VI of the LGPD):
- Legal name: MADALENA PRODUÇÕES CRIATIVAS LTDA
- CNPJ: 66.676.716/0001-11
- Address: R. Cardeal Dom Sebastião Leme, 93, Apt 302, Santa Teresa, Rio de Janeiro/RJ, CEP 20.240-012
- Channel for data subjects: contato@somosmadalena.com.br
2. What data we collect
2.1 When you request a session (the "search your session" panel)
We collect the data you voluntarily give us:
- Name.
- E-mail.
- Phone, with the country code.
- Whether the session is for a personal moment or an event, and which professional you are looking for: photographer, storymaker or videomaker.
- The dates you have in mind for the session, when you pick them on the calendar.
- Anything you want to tell us about your idea, in an optional free-text field.
In addition, we automatically collect at the moment of submission:
- Marketing campaign parameters present in the entry URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid) and the referrer, which is the site the click came from.
- IP address truncated to /24 for IPv4 and /48 for IPv6, retained in the server logs for temporal auditing and incident detection. Truncation aggregates your address into a subnet and does not allow individual identification.
2.2 When you apply as a referral partner (the /ser-parceiro page)
We collect:
- Name.
- WhatsApp number, with the country code.
- E-mail, optional.
- Instagram handle.
- Anything you want to tell us about your business, in an optional free-text field.
The same campaign parameters and the same truncated IP address described in 2.1.
2.3 When you sign up as a creator (the /ser-criador page)
In this first stage, we collect:
- Name.
- E-mail.
- WhatsApp number, with the country code.
- The city where you live.
- What you do, among the options offered in the form.
- A link to your portfolio.
- Instagram handle.
If your work speaks to ours, a second stage arrives on WhatsApp, through a personal, time-limited link, with open questions about you and about how you work. What you answer there is processed for the same purpose and for the same period as the application.
The same campaign parameters and the same truncated IP address described in 2.1.
2.4 Automatic collection for abuse prevention
When any form is submitted, and also when the personal link to stage 2 of the creator application is opened, the full IP address of your connection is checked against a temporary cache for up to 1 minute, to verify whether the number of consecutive requests exceeds the defined technical limits. After that period the record expires automatically from the cache and cannot be recovered. This measure protects the forms against automated abuse, spam and denial-of-service attacks.
The creator application also carries a Cloudflare anti-robot check, which you clear by ticking a box. To work, it receives the IP address of your connection and a temporary identifier of the challenge, and returns to madalena only the answer that the submission came from a person. No form data passes through it.
2.5 What we do not collect
- We do not load analytics or marketing cookies without your explicit consent, given in the cookie banner. Before your choice, none of those cookies is written and no data is sent to Google or Meta.
- We do not sell or rent your personal data. We do not share it with any third party beyond the processors listed in this Policy, and any sharing happens only under the applicable legal basis, which in the case of marketing cookies is your consent.
- We do not carry out automated profiling to make decisions with legal effect or that materially affect the data subject.
- We do not collect sensitive personal data (racial or ethnic origin, religious belief, political opinion, union membership, health data, sex life, genetic or biometric data), under art. 5, II of the LGPD, in any of the site's forms.
3. Why we collect, purpose and legal basis
Each category of data is processed with a specific purpose and declared legal basis, per art. 7 of the LGPD:
| Category | Purpose | LGPD legal basis |
|---|---|---|
| Session request (client) | Establish commercial contact in order to close a photography or videography service | Art. 7, V, LGPD, preliminary procedures related to a contract |
| Referral partner application | Assess the business's application and formalise the referral partnership with those selected | Art. 7, V, LGPD, preliminary procedures related to a contract |
| Creator application | Assess the videomaker's or photographer's work and formalise a contractual relationship with those selected | Art. 7, V, LGPD, preliminary procedures related to a contract |
| UTM, gclid, fbclid parameters and referrer | Measure aggregate effectiveness of marketing campaigns | Art. 7, IX, LGPD, legitimate interest, processed in aggregate form and without individual identification |
| Where you came from, when you arrive through a referral partner's link | Recognise which partner brought you to Madalena, so we can pay them the agreed bonus if you go on to book a service. Unlike the line above, here the origin stays tied to your session request individually, not in aggregate | Art. 7, IX, LGPD, legitimate interest of Madalena and of the referral partner in establishing the origin of the contact in order to pay for the referral. You may object at any time at contato@somosmadalena.com.br, with no effect whatsoever on how you are served |
| Truncated IP address in the logs | Temporal auditing of requests and detection of security incidents | Art. 7, IX, LGPD, legitimate interest, for information security purposes only |
| Full IP address in rate limiting (TTL 1 minute) | Prevention of abuse, spam and automated attacks | Art. 7, IX, LGPD, legitimate interest, for information security purposes only |
| IP address in the anti-robot check of the creator application | Tell a person from automation before accepting the form submission | Art. 7, IX, LGPD, legitimate interest, for information security purposes only |
| Analytics cookies (Google Analytics 4) | Measure aggregate traffic and browsing patterns in order to improve the site's content | Art. 7, I, LGPD, consent, collected through the cookie banner before the cookies are loaded |
| Marketing cookies (Meta Pixel) | Measure conversions and optimise madalena's advertising campaigns on Meta's platforms (Facebook and Instagram), including remarketing | Art. 7, I, LGPD, consent, collected through the cookie banner before the cookies are loaded |
The impact assessment for processing based on legitimate interest considered: (a) the legitimate and specific purpose of each processing operation, (b) the necessity of the processing to achieve the purpose, (c) the minimum impact on the data subject, and (d) the absence of less invasive means for the same objective. Processing respects the legitimate expectations of the data subject and the principles of art. 6 of the LGPD.
4. With whom we share, operators
To operate the site and forms, we contract infrastructure providers (operators, per art. 5, VII of the LGPD) who receive data strictly to the extent necessary for service provision.
| Operator | Purpose | Processing location | Contractual basis |
|---|---|---|---|
| Vercel Inc. | Site hosting and API endpoints | United States | Contractual clauses per Vercel's Terms of Service, including the Data Processing Addendum published by the provider |
| Supabase Inc. | PostgreSQL database where forms are stored | São Paulo, Brazil (sa-east-1 region) | Contractual clauses per Supabase's Terms of Service, including the Data Processing Addendum published by the provider |
| Resend Inc. | Sending email notifications to partners about new registrations received | United States | Contractual clauses per Resend's Terms of Service, including the Data Processing Addendum published by the provider |
| Upstash Inc. | Temporary cache of IP addresses (TTL 1 minute) for abuse prevention via rate limiting | São Paulo, Brazil (sa-east-1 region) | Contractual clauses per Upstash's Terms of Service, including the Data Processing Addendum published by the provider |
| Cloudflare, Inc. | Anti-robot check (Turnstile) on the creator application, receiving the connection's IP address and a temporary identifier of the challenge | United States | Contractual clauses applicable under Cloudflare's Terms of Service, including the Data Processing Addendum published by the provider |
| Google LLC | Collection of aggregate traffic metrics via Google Analytics 4, exclusively after your explicit consent in the cookie banner | United States | Contractual clauses per Google Analytics' Terms of Service, including the Data Processing Terms published by the provider |
| Meta Platforms, Inc. | Collection of conversion events via the Meta Pixel for measurement and optimization of Madalena's advertising campaigns, exclusively after your explicit consent in the cookie banner | United States | Contractual clauses applicable per the Terms of Service and the Data Processing Terms published by Meta for the Meta Pixel product |
None of these operators is authorized to process data for their own purposes beyond what is strictly necessary for the execution of the service contracted by Madalena, with the exception of Meta, which, upon your consent, receives Meta Pixel conversion events also for its own purposes of advertising measurement and optimization. We do not sell your data nor share it with data brokers or any third party not listed above.
5. How long we retain your data
Each category of data has a retention period defined based on the purpose of processing and applicable legal deadlines:
| Category | Retention period |
|---|---|
| Session request that did not become a contract | 24 months from the date the form was submitted |
| Client with a closed contract | 5 years after the end of the service, under the civil limitation period |
| Referral partner application not approved | 12 months from the date the form was submitted |
| Active referral partner | For as long as the partnership lasts, plus 5 years after it ends |
| Creator application not approved | 12 months from the date the form was submitted |
| Active creator | For as long as the contractual relationship lasts, plus 5 years after it ends |
| Full IP address in rate limiting cache | 1 minute (automatic TTL at Upstash provider) |
| Application logs, without identifiable personal data and with truncated IP | Per the hosting provider's retention policy (Vercel, on the contracted plan, retains logs for approximately 1 hour) |
| Own consent cookie (madalena.consent) | 12 months from the choice; after this period, the banner is shown again for new manifestation |
| Creator application stage 2 link cookie (madalena.etapa2) | Up to 48 hours from the issuing of the link; it expires together with the link and is erased as soon as the answers are sent |
| Referral record, in the browser's local storage (madalena.origem) | 30 days from your first arrival through the partner's link. After that the record stops counting and is discarded |
| Google Analytics 4 cookies (_ga, _ga_*) | 2 years from last visit, per Google's policy |
| Meta Pixel cookies (_fbp and _fbc, the latter only when you arrive at the site from a Meta ad) | 90 days from last visit, per Meta's policy |
| Meta advertising cookie (fr) | 90 days, written on the facebook.com domain by Meta |
After the retention period elapses, data is deleted or anonymized, except where there is a legal obligation to maintain it for a longer period, such as fiscal and accounting records required by applicable legislation.
6. Your rights as a data subject
As a data subject, you have the rights provided in art. 18 of the LGPD:
- Confirmation of the existence of processing of your personal data.
- Access to the data we hold about you.
- Correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data.
- Portability of your data to another service provider, in a structured and interoperable format.
- Deletion of personal data processed based on consent.
- Information about the public and private entities with which we share your data.
- Information about the possibility of not providing consent and its consequences.
- Revocation of consent at any time, by express manifestation.
- Review of decisions made solely on the basis of automated data processing that affect your interests, when applicable (we do not perform this type of processing, per item 2.5 of this Policy).
Additionally, you may file a complaint with the National Data Protection Authority (ANPD), the supervisory body of the LGPD, through the official channels published by the authority.
How to exercise your rights: send your request to contato@somosmadalena.com.br. We respond within 15 (fifteen) days, per art. 19, §1 of the LGPD. If additional identity verification is necessary to prevent fraud or unauthorized access by third parties, we will request the minimum relevant elements.
7. Cookies and similar technologies
We use cookies in two categories, as detailed in the consent banner displayed on your first visit to the site. Your choice can be changed at any time via the "Cookie preferences" link in the site footer.
7.1 Essential cookies (always active)
Necessary for the site to function. They do not require prior consent, per consolidated data protection understanding.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
| madalena.consent | Stores your choice regarding analytical cookies, preventing the banner from reappearing on each visit | Madalena (own cookie, written client-side) | 12 months |
| madalena.etapa2 | Keeps the personal link to stage 2 of the creator application valid while you answer the questions, without the page address showing your access code. Written only for those who open that link, and erased when the answers are sent | Madalena (own cookie, written server-side) | Up to 48 hours, and never beyond the validity of the link itself |
7.2 Analytical and marketing cookies (only after your explicit consent)
Loaded only after you choose to accept them in the consent banner. Before your choice, these cookies are not written and no data is sent to Google or Meta.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
| _ga | Distinguish unique users for aggregate traffic measurement | Google Analytics 4 | 2 years |
| _ga_4BJQRQZP99 | Persist user session state in Google Analytics 4 (linked to Measurement ID G-4BJQRQZP99) | Google Analytics 4 | 2 years |
| _fbp | Identify the browser for conversion measurement and remarketing on Meta's platforms | Meta Pixel | 90 days |
| _fbc | Store the ad click identifier (fbclid) when you arrive at the site from a Meta ad | Meta Pixel | 90 days |
| fr | Ad delivery and measurement on Meta's platforms | Meta Platforms (facebook.com domain) | 90 days |
The Google Analytics 4 setup uses Consent Mode v2 with analytics_storage set to denied by default until consent is granted. The IP address is anonymized by Google before any processing, per the product policy declared by the provider. The Meta Pixel follows the same posture: Meta's collection script is loaded only after your consent, and before that the browser has no communication whatsoever with Meta. You can revoke at any time via the "cookie preferences" link in the site footer.
7.3 Partner referral record (local storage, not a cookie)
When you arrive through a referral partner's link, your browser stores that partner's code and the page you landed on. This is not a cookie: it lives in the browser's local storage and never travels with requests to the server. It exists so the referral can still be recognised if you come back days later, from another device or another network, and it is what lets us pay the partner who brought you. You can erase it at any time by clearing this site's data in your browser, and you may object to the processing at contato@somosmadalena.com.br.
| Record | Purpose | Provider | Duration |
|---|---|---|---|
| madalena.origem | Stores which referral partner's link brought you here, and the page you landed on, so the referral can be recognised if you book a service later. It does not identify you on its own: it stores the partner's code, not your data | Madalena (browser local storage, written client-side) | 30 days |
8. How we protect your data
We adopt technical and administrative measures in five layers to protect your data:
- Application layer: rigorous input validation with typed schemas and size limits on all fields, anti-bot honeypot mechanism, rate limiting via Upstash, structured logs without identifiable personal data, IP address truncated in persisted records.
- Transport layer: mandatory communication over HTTPS/TLS, with active Strict-Transport-Security. The browser is instructed to always use an encrypted connection with the site, even on first visit after opt-in.
- Database layer: Row-Level Security activated by default in Supabase on all tables with personal data, separation between read/write server keys (service_role) and public keys with restricted access (anon), encryption at rest provided by the provider.
- Credentials and secrets layer: all API keys and credentials stored in environment variables, outside version control. Periodic key rotation. Two-factor authentication on all administrative accounts (GitHub, Vercel, Supabase, Resend, Upstash, Registro.br, Google).
- Operations layer: continuous monitoring of structured logs, periodic review of administrative access, and documented incident response procedure.
In the event of a security incident affecting your personal data, we will notify the ANPD and affected data subjects within a reasonable time, per art. 48 of the LGPD, with clear indication of the scope, the nature of the data involved, the measures adopted to mitigate the impact, and self-protection recommendations to those affected.
9. International data transfer
Some operators listed in item 4 are located outside Brazil:
- Vercel (United States), responsible for site hosting.
- Resend (United States), responsible for sending email notifications to partners.
- Cloudflare (United States), responsible for the anti-robot check on the creator application.
- Google (United States), responsible for analytical cookies, with processing conditioned on your explicit consent.
- Meta Platforms (United States), responsible for the Meta Pixel marketing cookies, with processing conditioned on your explicit consent.
These transfers comply with art. 33 of the LGPD by means of:
- Contractual clauses applicable per the Terms of Service of each provider, including the Data Processing Addenda published by the operators.
- Adequacy assessment of destination countries, considering contractual protection mechanisms and security certifications published by the providers.
- Minimization principle applied to both the quantity and sensitivity of data transferred.
The Supabase and Upstash operators, which store the actual personal data (forms and rate limiting cache), operate on servers located in São Paulo, Brazil (sa-east-1 region). There is no international transfer of data stored in this infrastructure.
10. Data processing officer
Madalena is classified as a Microenterprise (ME) under Complementary Law nº 123/2006 and is subject to the simplified regime of ANPD Resolution nº 2/2022, which addresses the application of the LGPD to small-scale data processing agents.
Per this Resolution, small-scale processing agents are exempt from the obligation to formally appoint a Data Processing Officer, provided that an open and efficient communication channel with data subjects and the National Data Protection Authority is maintained.
As an additional measure of transparency, we voluntarily designate a person responsible for the communication channel:
Jonathan da Silva Sousa, founding partner of Madalena.
Communication channel: contato@somosmadalena.com.br
Requests related to data subject rights, questions about personal data processing, or any communication regarding this Policy must be directed exclusively to this channel, ensuring an auditable written trail of the interactions.
Madalena does not have an internal legal department in operation. Specific legal demands, when necessary, are forwarded to external legal consultancy contracted for this purpose.
11. Updates to this Policy
This Policy may be updated periodically to reflect changes in the services offered, applicable legislation, or data protection practices.
Material updates, understood as those that substantially change the declared legal bases, processing purposes, retention periods, data subject rights, or international transfers, will be communicated with a minimum of 30 days' notice by:
- Email, to data subjects whose contact we maintain.
- Highlighted notice on the site, throughout the entire notice window.
The current version is always available on the /privacidade page, with indication of the date of last revision.
Last updated: August 12, 2026
12. How to talk to us
For any questions, requests, or communications related to this Privacy Policy or the processing of personal data by Madalena:
Email: contato@somosmadalena.com.br
We maintain this channel as the only formal route for the exercise of rights by data subjects, ensuring an auditable written trail of all interactions. Service occurs within 15 (fifteen) days from the date of receipt, per art. 19, §1 of the LGPD.