Privacy policy
Last updated 19 August 2026
This policy explains what personal data Cairn Post collects, why, on what legal basis, how long it is kept, and what rights apply under Brazilian and European law.
1. Controller
Cairn Post is an independent editorial project operated from Brazil and acts as the controller of personal data processed through this site. All privacy correspondence goes to support@cairnpost.site.
2. Data collected
2.1 Provided voluntarily
Email address, name where supplied, and the contents of any message sent to the support address. Where a paid publication is purchased, order reference, purchase date and the email address associated with the order.
2.2 Collected automatically
Standard server and analytics data: IP address, approximate region derived from it, browser and device type, operating system, referring address, pages requested, and timestamps. This data is used in aggregate.
2.3 Not collected
Cairn Post does not request, collect or infer health data, biometric data, racial or ethnic origin, religious or philosophical belief, political opinion, trade union membership, sexual orientation, criminal record, or financial account details. Nothing on this site asks a visitor to disclose a personal circumstance, and no profile of any individual reader is constructed.
3. Payment data
Where a paid publication is offered, payment is processed by third-party providers. Card numbers and equivalent payment credentials are entered on the provider's systems and are never transmitted to or stored by Cairn Post. Cairn Post receives only the transaction reference, status, and the email address associated with the order. Each provider processes data under its own privacy policy.
4. Purposes and legal bases
- Answering correspondence — legitimate interest (GDPR Art. 6(1)(f)); legitimate interest of the controller (LGPD Art. 7, X).
- Delivering and supporting a purchased publication — performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V).
- Site security, fraud prevention and abuse detection — legitimate interest (GDPR Art. 6(1)(f); LGPD Art. 7, IX).
- Aggregate audience measurement — consent where required by applicable law, otherwise legitimate interest.
- Tax, accounting and legal record-keeping — legal obligation (GDPR Art. 6(1)(c); LGPD Art. 7, II).
Where processing rests on legitimate interest, a balancing assessment has been carried out and the outcome can be requested at the support address. Where it rests on consent, that consent can be withdrawn at any time without affecting processing already carried out.
5. Retention
- Support correspondence: 24 months from the last message in the thread.
- Order and transaction records: 5 years, to meet Brazilian tax and commercial record-keeping requirements.
- Server logs: 12 months.
- Aggregate analytics containing no identifier: retained indefinitely.
Data is deleted or irreversibly anonymised at the end of the applicable period unless a legal obligation requires it to be kept longer.
6. Sharing
Personal data is shared only with service providers acting on documented instructions: hosting and content delivery, email delivery, payment processing, and audience measurement. Data is also disclosed where required by a competent authority under applicable law. Personal data is never sold, rented or traded, and is not shared with advertisers for their own purposes.
7. International transfers
Service providers may process data outside Brazil, including in the United States and the European Union. Transfers of data from the European Economic Area or the United Kingdom rely on Standard Contractual Clauses or an applicable adequacy decision. Transfers from Brazil are made under Articles 33 to 36 of the LGPD, using contractual guarantees where no adequacy decision applies.
8. Cookies
This site sets no advertising cookie of its own. Cookies in use are limited to those strictly necessary for the site to function and, where consent has been given, aggregate audience measurement. Third-party measurement or advertising technologies may set their own cookies subject to the consent given; the settings of any modern browser allow cookies to be blocked or deleted, though blocking necessary cookies may affect how the site behaves.
9. Rights
Under the LGPD (Law 13.709/2018), Article 18, a data subject may request confirmation of processing, access, correction of incomplete or outdated data, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, and withdrawal of consent.
Under the GDPR, a data subject may request access, rectification, erasure, restriction of processing, portability, and may object to processing based on legitimate interest.
Requests go to support@cairnpost.site and are answered within 15 days under the LGPD and within one month under the GDPR. Verification of identity may be requested where necessary to protect the data.
10. Complaints
A complaint may be lodged with the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, or with the supervisory authority of the relevant Member State or the Information Commissioner's Office in the United Kingdom.
11. Minors
This site is not directed at anyone under 18 and does not knowingly collect data from minors. Where such data is identified, it is deleted. A parent or guardian who believes a minor has supplied data may write to the support address.
12. Security
Transport encryption is applied site-wide, access to stored data is restricted, and providers are selected on the basis of their published security practices. No transmission over the internet can be made entirely secure against interception, and no absolute assurance of security is offered.
13. Changes
Material changes to this policy are reflected in the date at the head of the page. Continued use of the site after a change constitutes acceptance of the revised policy.