Privacy policy
Last updated November 4, 2026
In short: Brazil For Expats is a small education site run by Gabriela Rabachini in Florianópolis, Brazil. We collect only what we need to give you what you ask for: your email address (and first name, if you give it) when you sign up for a download, your name and email when you buy a guide, and your comment when you ask for a link on Instagram. A few outside services do this work for us, and they are listed below. This site sets no cookies, shows no ads and does not sell your information. Every email series has a one-click unsubscribe link, and you can write to hello@brazilforexpats.com to see, correct or delete what we hold about you.
Who we are
The person responsible for your personal data (the "controller") is Gabriela Rabachini, a Brazilian attorney who publishes this site as Brazil For Expats from Florianópolis, Santa Catarina, Brazil.
For any privacy question or request, write to hello@brazilforexpats.com. We read every message. Under the rules of Brazil's data protection authority (ANPD) for small processing agents (Resolution CD/ANPD No. 2/2022), we have not appointed a data protection officer ("encarregado"); that email address is our channel for privacy requests instead.
What we collect and why
When you sign up for a download
You give us your email address and, if you choose, your first name. We also note which download you asked for and, if you arrived through one of our tracked links (a reply on Instagram or a QR code, for example), a short label for that link such as "ig-visa". We use this to:
- email you the download, attached to the email;
- send you a short series of follow-up emails on the topic you chose, where there is one. Each of them has an unsubscribe link, and one click stops them;
- count how many people sign up, for which topics, and from which links.
Your details are kept on our email list at Resend, which also sends the emails. Open and click tracking is turned off in our email sender, so we do not know whether you opened an email or clicked a link in it.
When you buy a guide
Checkout happens on Stripe's own payment page. You give your payment details to Stripe, and we never receive your card number. Stripe tells us your name, your email address, the billing details its checkout asks for and what you bought. We use them to email you your files, to send them again if you ask, to keep accounting and tax records, and to handle refunds or disputes. Buying a guide does not add you to our email list.
If you use the "re-send my purchase" page, we use the email address you enter only to look up your purchases at Stripe and send them to that address. We do not keep it.
When you comment on our Instagram posts
When you comment on one of our posts, Instagram (Meta) sends us the comment, its ID and your Instagram account ID. Our server reads the comment only to look for a keyword (such as "VISA"). If it finds one, it sends you one private message with a link to the matching download. We do not store your comment, your username or your account ID. Our server log records the comment ID, the post and the keyword it matched, and is kept only as long as described under How long we keep it. The message we send stays in our Instagram inbox, like any other conversation. If you then sign up through that link, its label (for example "ig-visa") is saved with your email address.
When you email us
Mail sent to hello@brazilforexpats.com (including replies to our emails) is forwarded by ImprovMX to the inbox we read. We use what you write only to answer you.
When you visit the site
Like every website, our host, Vercel, receives technical details with each request: your IP address, your browser and device, the page you asked for and the time. It keeps them in short-lived logs, which we use to find and fix errors and abuse. When something goes wrong while sending an email or saving a signup, the log line can include the email address involved.
We use Vercel Web Analytics to count visits. It uses no cookies and does not identify you: it records the page, the site that linked to it, your country, browser, operating system and type of device. It tells visits apart with a code made from the request, which is discarded after 24 hours. The site's fonts are served from our own domain, not from a font service.
We use Google Search Console to see which searches lead people to the site. Google gives us totals (searches, clicks and pages); it does not tell us who you are, and we send Google nothing about you.
Cookies
This site sets no cookies. Stripe's checkout page is on Stripe's own website and uses its own cookies, for example to prevent fraud; its privacy policy explains them.
Who handles your data
We use these services to run the site. Each one handles your data to do its job for us, under its own data protection terms. Instagram is different: Meta also decides for itself how it uses data on its platform.
| Service | What it does for us | Your data it handles | Based in |
|---|---|---|---|
| Resend | Keeps our email list. | Email address, first name if you gave one, which download you asked for, the link you came from, where you are in our email series, and whether you are subscribed. | United States |
| Kit | Kept our email list until November 2026; we are closing that account and deleting the copy there. | Email address, first name if you gave one, which download you asked for, and whether you were subscribed. | United States |
| Resend | Sends every email from us (downloads, purchases and our email series). | Email address, first name, and the content of each email we send you. | United States |
| Stripe | Takes payment for guides on its own checkout page. | Name, email address, billing details and card details you enter at checkout (we never receive your card number), and what you bought. | United States |
| Vercel | Hosts the site, runs its server code, keeps short-lived request logs and provides Vercel Web Analytics. | IP address, browser and device details, the pages you visit, and anything you send through a form while it is processed. | United States |
| ImprovMX | Forwards email sent to our address to the inbox we read. | Your email address and the message you send us. | United States |
| Instagram (Meta) | Tells us about comments on our posts and delivers our private reply. It also decides for itself how it uses this data, under its own policy. | Your comment, its ID and your Instagram account ID. | United States and other countries |
Apart from these services, we share your data only when the law requires it (a court order or a tax authority, for example).
Why we are allowed to use it
Brazil's data protection law (LGPD, Law 13.709/2018) and, for visitors in the European Union or the UK, the GDPR require a legal basis for each use:
- Downloads and our email series: your consent, given when you sign up (LGPD art. 7, I; GDPR art. 6(1)(a)). You can withdraw it at any time by unsubscribing. Without an email address we cannot send you a download, and that is the only consequence of not signing up.
- Purchases: to carry out the sale you asked for (LGPD art. 7, V; GDPR art. 6(1)(b)), and to keep the records tax law requires (LGPD art. 7, II; GDPR art. 6(1)(c)).
- Instagram replies and answering your emails: our legitimate interest in answering people who ask us for something (LGPD art. 7, IX; GDPR art. 6(1)(f)).
- Logs, analytics and search data: our legitimate interest in running a secure, working site and knowing which pages are useful (LGPD art. 7, IX; GDPR art. 6(1)(f)).
Where your data goes
We are in Brazil, and the services listed above are based in the United States, so your data is transferred there. Brazil has not recognized the United States as offering an adequate level of data protection. We transfer your data because it is needed to give you what you asked for (LGPD art. 33, IX, with art. 7, V), and each service handles it under its own data protection terms. If you are in the European Union or the UK, your data is likewise handled in the United States by these services.
How long we keep it
- Email list: while you are subscribed. If you unsubscribe, your address stays on the list marked as unsubscribed, so that we never email you again. Ask us and we will delete it completely.
- Emails we send: Resend keeps a record of each email for a limited time under its own terms.
- Purchases: for five years after the end of the year of the purchase, the period during which Brazilian tax law lets the tax authority review it. Stripe also keeps its own records, as financial rules require it to.
- Instagram: we store nothing from your comment. The conversation with our reply stays in our Instagram inbox until it is deleted; ask us and we will delete it.
- Server logs: Vercel keeps them for a short period set by our hosting plan, between one hour and 30 days.
- Analytics: only totals are kept. The code that tells visits apart is discarded after 24 hours.
- Emails you send us: as long as we need them to answer you and keep track of your request. Ask us and we will delete them, unless we must keep them by law.
Your rights
Wherever you live, you can ask us to:
- confirm whether we hold personal data about you, and give you a copy of it;
- correct data that is wrong or incomplete;
- delete your data, or stop using data we do not need;
- send your data to you or to another service in a common format;
- tell you which services we shared it with;
- stop using it for something you consented to (withdrawing your consent);
- stop using it on the basis of our legitimate interest (objecting).
Write to hello@brazilforexpats.com, preferably from the email address concerned. We reply within 15 days, at no cost to you. We may ask you to confirm that the request comes from you before we act on it.
In Brazil, these are your rights under LGPD article 18, and you can also complain to the national data protection authority, the ANPD.
In the European Union or the UK, you also have the rights to restrict how we use your data and to complain to the data protection authority where you live.
In California, you can review the personal information we hold about you and ask us to change it by writing to the address above. We do not sell your personal information or share it for advertising.
How to delete your data
Unsubscribing stops our emails but keeps your address marked as unsubscribed. To have your data deleted, email hello@brazilforexpats.com with the subject "Delete my data", from the address you signed up or bought with. If it is about Instagram, include your Instagram username. We will delete your record from our email list, any messages from you, and our Instagram conversation with you, and confirm by email within 15 days. We keep purchase records only for as long as tax law requires, as explained above.
Do Not Track
Some browsers send a "Do Not Track" signal. There is no common standard for responding to it, and this site does not change what it does when it receives one. We do not track you across other websites, and no other company collects information about your activity across websites through this site.
Selling and advertising
We do not sell your personal information, and we do not share it for advertising. The site shows no ads and has no advertising pixels.
Children
This site is for adults planning a move to Brazil. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has signed up, write to us and we will delete it.
Security
The site is served only over HTTPS. Downloads and purchases are sent as email attachments, not as public links, and access to the accounts of the services above is limited to the people who run the site. No system is perfectly secure. If a security incident could put you at significant risk, we will tell you and the ANPD, as Brazilian law requires.
Changes to this policy
When we change this policy, we update the date at the top of this page. If a change affects how we use the email address you gave us, we will also tell subscribers by email before it takes effect.
Contact
Gabriela Rabachini, Brazil For Expats, Florianópolis, Santa Catarina, Brazil. Email: hello@brazilforexpats.com.