Last updated: October 22, 2026
The party responsible for processing your personal data (the data controller) is:
This is also the contact of the person in charge of data protection. When you write to it, you are talking to the person who makes the decisions. Because our business is based in Brazil, we follow Brazil’s General Data Protection Law (LGPD), and we also respect the privacy laws that apply to you where you live.
It covers the personal data processed on the website flavioduarte.com, on its sales pages, in the members area and in the emails we send.
It does not cover what happens on third-party sites and services — even when you reach them through one of our links. The checkout page and YouTube have their own policies, and theirs apply there. The main ones are listed in section 6.
In some functions — the limits that stop someone from opening a thousand accounts or sending a thousand emails, for example — the IP address is stored only in scrambled form (a “hash”), which is used to count how many times the same visitor repeated an action and cannot be used to reconstruct the address.
The payment platform notifies us when a purchase is approved, declined, canceled or refunded, and gives us the buyer’s name and email so that we can release access. Without that notification, there is no way to deliver what you bought.
This is the complete list, with the reason that allows us to use each piece of data:
| Purpose | Data | Legal basis |
|---|---|---|
| Create and maintain your account and release what you bought | Name, email, purchase record | Performance of our contract with you |
| Keep your confirmation that you are 18 or older | Date and time of the confirmation | Exercise of our legal rights |
| Send the service’s own notifications, by email and, if you allow it, on your phone: access released, password creation, password reset, reply notifications and the group’s weekly summary | Name, email, device time zone and, if you allow phone notifications, the identifier your browser creates for them | Performance of our contract with you |
| Provide support and answer your questions | Name, email, conversation history | Performance of our contract with you |
| Send content, news and offers | Name, email | Your consent (you may withdraw it at any time) |
| Keep access logs | IP, date and time | Legal obligation |
| Prevent fraud, abuse and automated use; protect accounts | IP (usually scrambled), time and frequency of attempts | Legitimate interest |
| Understand where visits come from and what works in our marketing | UTMs, referring page, aggregated browsing data | Legitimate interest |
| Measure the site’s audience, understand what works in our marketing and show ads to people who have visited the site | Cookie identifier, pages visited, actions on the site (opening the sales page, completing a purchase), IP address | Legitimate interest, with your right to opt out at any time (see section 9.4) |
| Exercise our rights in legal, administrative or arbitration proceedings | The data relevant to the case | Exercise of our legal rights |
Where the basis is legitimate interest, we have assessed that the use is the minimum necessary, that you would reasonably expect it in this context and that it does not override your rights. If you disagree, you can object — section 10 explains how.
Where the basis is consent, you can withdraw it at any time, without giving a reason and without losing access to what you bought. Withdrawing consent does not undo what was done while it was valid.
But we do advertise, and this needs to be said plainly. The tools in section 9.2 allow us to show ads to people who have visited the site and to know how many people bought after seeing an ad. The audiences are built by Meta and Google, from what their cookies record in your browser.
We share the minimum necessary, and only with those who need it for the service to work. Each of them acts as a service provider (processor), handling the data according to our instructions:
| Who | Purpose | Where the data is stored |
|---|---|---|
| Hotmart | Process the payment, issue the purchase receipt, handle applicable taxes and process refunds | Brazil, the United States and other countries |
| Brevo (Sendinblue) | Deliver the emails we send | European Union |
| Hostinger | Host the site and deliver its files | Brazil and other countries |
| Bunny.net | Store and deliver the course audio and video files | European Union and other countries |
| Google / YouTube | Display videos embedded in the pages and provide the text fonts | United States and other countries |
| Meta Platforms (Facebook and Instagram Pixel) | Measure ad results and show ads to people who have visited the site | United States and other countries |
| Google (Analytics and Ads) | Measure the site’s audience and ad results | United States and other countries |
In addition, we may share data:
Our business is based in Brazil, and some of the services above are located in other countries. This means your data is transferred to and processed in Brazil, the United States, the European Union and other countries. These transfers rely on standard contractual clauses and on the data protection commitments these providers make in their contracts with us. If you would like to know which safeguards apply to a specific case, write to the contact in section 1.
| What | For how long | Why |
|---|---|---|
| Account, access and purchase history | While the account exists, and for 5 years after that | Time limit for billing claims and complaints |
| Tax and accounting records | 5 years | Tax law |
| Access logs (IP, date and time) | 6 months | Legal obligation |
| Data of people who signed up but did not buy | Until you ask to leave, or up to 2 years without any interaction | Consent / legitimate interest |
| Comments and messages in the members area | While the account exists | Performance of the contract |
| History of emails sent | 2 years | Proof of delivery and investigation of problems |
After that period, the data is deleted or anonymized — unless there is still a legal obligation, an ongoing proceeding or a legitimate exercise of rights that justifies keeping it.
A cookie is a small file the site stores in your browser. Without some of them the site simply does not work: it is a cookie that keeps you logged in after you type your password.
| Name | Purpose | Duration | Type |
|---|---|---|---|
wordpress_logged_in_…wordpress_sec_… | Keep you logged in after you sign in | Until you close the browser; or 1 year, if you check “stay signed in” or sign in through the email link | Necessary |
lym_visita | Keep what you typed in a form, so you do not lose the text if the page reloads | 15 minutes | Necessary |
_lscache_vary | Make the server deliver the right version of the page to people who are logged in | Session | Necessary |
PHPSESSID | Keep the server session while you browse | Session | Necessary |
wp-settings-… | Remember screen preferences of the site administrators | 1 year | Functional |
comment_author_… | Fill in your name and email automatically when you comment again | About 1 year | Functional |
lym_lead | Recognize you when you come back, so we do not ask for the same information again and know which campaign you came from | 30 days | Functional |
lpt_lead | Earlier version of the cookie above, kept so that people who visited the site before are still recognized | 365 days | Functional |
Cookies marked necessary cannot be turned off: without them, login does not work. Cookies marked functional are not required — they only save you from retyping things — and deleting them in your browser does not take away anything you bought.
These are not necessary for the site to work. They exist so that we can measure our audience and the effectiveness of our ads, and you can refuse or delete them at any time (section 9.4).
| Name | From | Purpose | Duration |
|---|---|---|---|
_ga_ga_… | Google Analytics | Distinguish visitors and keep the measurement session, so we know how many people visit each page | 2 years |
_gcl_au_gcl_aw | Google Ads | Link a click on an ad to a purchase, so we know which ad worked | 90 days |
_fbp | Meta (Pixel) | Identify the browser to measure ads and build remarketing audiences | 3 months |
_fbc | Meta (Pixel) | Keep the identifier of the ad you clicked, when you arrive from a Facebook or Instagram ad | 3 months |
In addition to these, stored by this domain, Google and Meta use cookies stored on their own domains (doubleclick.net, google.com, facebook.com), with durations set by them and described in their policies. Those are the cookies that allow them to recognize you on other sites.
VISITOR_INFO1_LIVE, YSC and PREF, lasting up to 2 years — and use them to measure audience and personalize recommendations. Google controls these cookies, under its Privacy Policy.You control this through your browser. The path is usually under Settings → Privacy:
Two consequences worth knowing first: deleting your cookies logs you out of the members area, and you will need to sign in again; and blocking all cookies prevents login from working — there is no way to keep someone signed in without storing anything in the browser.
Necessary cookies do not depend on your permission and cannot be turned off here: without them, login does not work and basic functions stop. They are the first four in the table in section 9.1.
You can opt out of measurement and advertising cookies (section 9.2) at any time, and changing your mind later is simple. Besides your browser settings, you can opt out directly at the source:
Refusing measurement cookies changes nothing about what you bought: your access, login and support stay the same.
Wherever you live, you can ask us at any time, free of charge, for:
You can also object to processing based on legitimate interest. Depending on where you live — for example, in some U.S. states or in the European Union — local law may give you additional rights, and we will honor them as required. We will never treat you differently for exercising any of these rights.
How to exercise them: write to support@flavioduarte.com telling us what you want. We usually reply within 15 days. We may ask you to confirm your identity before handing over or deleting anything — this protects you; it is not a barrier.
An honest limit: there is some data we cannot delete even if you ask, because the law requires us to keep it — purchase records for tax purposes and access logs are the two most common cases. When that happens, we will tell you which data it is and which obligation applies.
Every content or promotional email we send has a link in the footer to stop receiving them. One click is enough, and you do not need to log in or reply to anything.
Service emails keep being sent: access release, password creation and reset, purchase confirmation and support replies. They are not marketing — they are the delivery of what you bought — and turning them off would leave you with no way to access your account.
What is in use today:
This caveat is required and true: no system connected to the internet is completely secure. We commit to the means, not to a result that no one can guarantee.
If a security incident occurs that could create a relevant risk or harm to you, we will notify you and the competent authorities within a reasonable time, as required by law — describing the data affected, the risks involved and what to do about it.
The site is not intended for anyone under 18, and we do not knowingly collect data from children or teenagers. When creating a password, the person confirms that they are 18 or older. If you are a parent or guardian and believe a minor has created an account here, write to the contact in section 1 and we will delete the account.
This policy may be updated when the service changes or when the law changes. The date of the last update is at the top of the page. Any change that materially affects how we handle your data will be announced here on this page.
Questions, requests or complaints about privacy: support@flavioduarte.com. We read and reply.
See also the Terms of Use.