Privacy Policy
This policy explains how Top List Creators: Brasil que Cria, 2026–2027 edition, handles the data of website visitors, people making nominations and people submitting their own stories. It applies to the main website, the typographic version and the nominee’s private area.
Campaign contact
leon@raro.cxUse this email for questions about the initiative, requests about your data, withdrawal from participation or withdrawal of permissions.
Contact and services used
The campaign email on this page is the contact for privacy questions and requests to exercise your rights.
The operations and curation teams act under the organization’s instructions. We use Supabase for the database, authentication and private files; Vercel for hosting, website delivery and abuse protection; Resend for transactional emails; and OpenAI for optional transcription and text improvement. These providers act as processors for activities carried out on behalf of the campaign.
What data is collected
The form collects the sender’s name and email; the nominee’s name and email, public profile or other contact information; city and state, when known; the project story; a reference link, when available; nomination type and source; language and visual version of the website. We record the submission and acceptance date and time, together with the accepted versions of the Privacy Policy and Rules.
The private area collects further information about authorship, audience, ChatGPT use, results, contacts and project evidence, including a phone number if provided, uploaded files and their names and characteristics, replies to requests for additional information and permissions. A project draft may be saved while you complete it. We also record participation status, checks, evaluations and staff actions needed for the process.
Public page visits and form submissions may record IP address, browser and technical device information, page visited without private parameters, language, website presentation, date, and approximate country and city when available. Location is estimated from the connection, without accessing GPS. We keep security records, attempt limits, audit records and email records, including recipient, message type, date and sending outcome.
Only submit information needed to explain the work. Do not include identity documents, passwords, bank details, sensitive information or unnecessary third-party data without appropriate permission. The campaign does not need such information for an initial nomination.
Why we use the data and the legal grounds
With your consent, we use participation data to receive and organize the entry, contact you, request additional information, verify the project and allow its evaluation. Acceptance is required to submit the form. You may decline consent or withdraw it later; we will then be unable to start or continue participation activities that depend on that consent. Permission to publish is specific and separate.
We rely on legitimate interests to protect the website and people, prevent fraud and spam, limit access attempts, detect duplicates and investigate incidents. This processing must be limited to what is necessary and respect people’s rights and expectations. You may object where the legal requirements are not met.
When someone nominates another person, the sender’s acceptance is not consent on that person’s behalf. Minimal contact details and professional context are used to check relevance and send an invitation, based on the legitimate interest in discovering potentially eligible projects. The nominee decides directly whether to participate and may decline the invitation or request deletion. A nomination does not authorize publication, evaluation of sensitive information or automatic enrollment.
We may retain and use records strictly necessary to meet legal or regulatory obligations and exercise rights in proceedings, on the corresponding grounds provided by Brazil’s General Data Protection Law (LGPD). People make selection decisions; text assistance tools do not decide who is selected.
Voice and text assistance are optional
If you choose to record your story, the audio is sent to OpenAI for transcription. The application uses audio during that operation and does not persist it on disk, in the database or in file storage. The transcription becomes editable text and may form part of your draft and submitted nomination.
If you request text improvement, the story and interaction instructions are sent to OpenAI. You review the suggestion before using it. When a suggestion is applied, the nomination records the original text, your chosen text and that assistance was used. The application does not retain the improvement conversation and asks the API not to store the response as history. This does not mean zero provider retention: the provider’s processing and security terms may apply. You can participate by writing directly without using these features.
Sharing and international transfers
The operations team accesses the information needed to run the initiative. Jurors receive project dossiers released for evaluation, without general access to nomination records, contact details, private tokens or internal operations notes. Processors receive only the data required for the functions described in this policy. We do not sell participation data. Public disclosure of images, names associated with a story and project materials requires the person’s specific permission.
In the current configuration, Supabase stores campaign data in the United States, and Vercel server functions run in the United States, with website delivery through a global network. Resend stores email service data in the United States. Optional OpenAI features may involve processing outside Brazil. You may contact the campaign for information about providers, destinations and safeguards relating to your data and to exercise your rights. Accepting participation does not replace the safeguards required by the LGPD for international transfers.
We may also share the minimum necessary to meet a legal obligation, comply with a valid order from a competent authority or defend rights, within legal limits.
Deleting data
You may request deletion of your data through the campaign contact. Data that does not need to be kept to meet a legal obligation or exercise rights may be deleted or anonymized in response to your request.
Minimal acceptance, security and audit records may be preserved with restricted access when necessary to demonstrate obligations or exercise rights. This does not permit continued use of a withdrawn entry for other purposes. If data cannot be deleted immediately, we will explain the reason and retention limits. Backups follow their replacement cycle and are not used to resume a deleted participation; a restoration must reapply relevant deletions. Infrastructure logs and processing by providers are also subject to the terms applicable to each service, without a promise of immediate deletion across every system.
How we protect the information
We apply role-based access controls, staff authentication, private evidence files, time-limited access and download links, server-side validation and action records. The complete invitation token is not stored in the database; access depends on validation and expiry. Abuse protection and submission limits reduce attempted fraud.
No system eliminates every risk. If an incident poses a significant risk or harm, the organization will take appropriate measures and make the notifications required by the LGPD and ANPD. Keep your private link secure and notify the campaign if you suspect unauthorized access.
Your rights and how to exercise them
You may request confirmation of processing and access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data; portability under applicable regulations; deletion of data processed with consent, subject to lawful retention; withdrawal of consent; and information about sharing, the option to decline consent and the consequences of doing so.
Send your request to the campaign email on this page, stating the right you wish to exercise and how to locate your participation. Do not send passwords or the complete invitation token. We may ask only for information needed to verify your identity or your authority to represent someone else. Requests are free and handled within legal deadlines. If we cannot act immediately, we will explain why and the next steps. You may also complain to ANPD and other competent authorities without giving up any other legal rights.
Updates to this policy
The version and effective date appear at the top of this page. Significant changes will be highlighted on the website and communicated through available contact details when they affect an ongoing participation. A new purpose incompatible with earlier consent requires prior notice and fresh consent where necessary. The acceptance record preserves the version accepted; an update does not turn an earlier acceptance into permission for a new purpose.