Privacy and Cookie Policy
How we take care of your data, in plain English. It includes our cookie policy.
Last updated: November 15, 2026 · Version 1.5
1. Who we are
SobreVivendo Adulto is a Brazilian digital content brand that publishes manuals, e-books and materials for people who are learning how adult life works. The person responsible for the brand and for the processing of data (the controller, in the language of the LGPD) is Áquila Ferraz.
This policy applies to sobrevivendoadulto.com.br (and the address sobrevivendoadulto.com), to the e-mails we send, to the forms on the site and to the members area with its tools. It follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018).
2. Data Protection Officer (DPO)
The DPO is the person who answers for everything involving your data here:
- Name: Áquila Ferraz
- Form (recommended): /legal/dpo (in Portuguese). No account needed, and it generates a protocol number
- E-mail: nina@sobrevivendoadulto.com.br
- Response time: up to 15 days
3. What data we collect, what for and for how long
| What we collect | What for | Legal basis | How long we keep it |
|---|---|---|---|
| E-mail and sign-up source (Kit SOS, newsletter, waitlist) | Send the material you asked for and e-mails from the brand | Consent (art. 7, I). After you unsubscribe, the record is kept under legitimate interest (art. 7, IX), to prove that you asked to leave | As long as you are subscribed. If you unsubscribe, we stop sending e-mail and the record is marked as unsubscribed, with the visit source (section 3.4), so we do not send you anything else. If you ask for deletion (section 8), we delete everything |
| Name, e-mail and marketing opt-in on offer pages | Let you know about the launch or the offer and learn which campaign brought you | Consent (art. 7, I) | Same as the sign-up above. The visit source follows the "Visit source" row (section 3.4) |
| Account: name, e-mail, password (hash only), login sessions with IP and browser | Members area and library of your products | Performance of a contract (art. 7, V) | As long as the account exists. If you ask for deletion, the account stays deactivated for 30 days (you can change your mind) and is then deleted |
| Purchase: name, e-mail, product, amount and payment status | Deliver the PDF, prove the purchase and comply with tax law | Performance of a contract (art. 7, V) and legal obligation (art. 7, II) | 5 years (period set by tax law). If you ask for deletion before then, the order is kept without your name and e-mail (art. 16, I) |
| Members area tools (Minhas Contas, Faxina Sem Surto and the Salário com Destino spreadsheet): what you type into them, such as bills and due dates, income, expenses, savings, debts, the 30-day plan and the cleaning routine. Details in section 3.3 | Keep what you filled in on your account, so the tool opens the way you left it, on any device | Performance of a contract (art. 7, V) | As long as the account exists. If you ask for account deletion, this data is deleted along with it at the end of the 30 days |
| Visit source on every sign-up, offer page lead, account and purchase: campaign (UTM), ad click identifiers, the site you came from (domain only), entry page, first and last visit, number of visits and type of device, browser and system (only the category, such as "mobile · Instagram · iOS"). Details in section 3.4 | Learn which content and ads bring the people who sign up, create an account and buy | Legitimate interest (art. 7, IX) for the visit in which you sign up, create an account or buy; analytics consent (art. 7, I) to link one visit to another; marketing consent for the Meta cookies | No set date to be removed: it stays with the sign-up, the account or the purchase while it is useful to measure campaigns and keep the history of your record. We review this need once a year. Removed when you ask for deletion or object to this use (section 8) |
| Contact message: name, e-mail, subject, text, IP and browser | Reply to you; IP and browser are used only to filter spam | Procedure carried out at your request (art. 7, V) | The message is kept while it is useful for support; IP and browser are removed after 90 days. You can ask for deletion at any time |
| Request to the DPO: name, e-mail, request type, text, hashed IP, browser | Honor your right and prove that we did | Legal obligation (art. 7, II) | 5 years after the request is handled |
| Security logs: hashed IP, browser, time (downloads, access) | Security, fraud prevention and attempt limits | Legitimate interest (art. 7, IX) | 90 days |
| Record of what you chose in the cookie banner | Prove that we asked for and respected your consent | Legal obligation (art. 7, II, and art. 8, §2) | No set date to be removed, to prove what you chose while we hold data about you. Those linked to your account are removed when you ask for deletion |
| Site usage events (only if you accept analytics) | Learn which pages help and where sign-ups get stuck | Consent (art. 7, I) | No set date to be removed (we review it once a year). Those linked to your account are removed when you ask for deletion; visit events without login have no name or e-mail (section 3.1) |
| Microsoft Clarity (only if you accept analytics): clicks, scrolling and movement on the page, recorded with the text of forms, the members area and checkout hidden | See where the page confuses or gets stuck and fix it | Consent (art. 7, I) | Clarity cookies for up to 1 year in your browser; at Microsoft, recordings for up to 30 days and reports for up to 13 months |
| Google Analytics 4 (only if you accept analytics): pages viewed, sign-up, checkout start and purchase (with value), campaign and type of device. No name or e-mail | Measure the site and the result of each campaign | Consent (art. 7, I) | Google Analytics cookies for up to 2 years; at Google, up to 14 months |
| Google Ads and TikTok Pixel (only if you accept marketing) | Measure Google and TikTok ads and show ads to people who already visited the site | Consent (art. 7, I) | Google Ads cookies for up to 90 days and TikTok cookies for up to 13 months in your browser; at the companies, each one's policy applies |
| Meta Pixel (only if you accept marketing) | Measure the ads that bring visits, sign-ups and purchases | Consent (art. 7, I) | Meta cookies for up to 90 days in your browser; at Meta, its own policy applies |
3.1. Usage events (our own analytics)
If you accept analytics in the banner, we record usage events in our own database. This is separate from Clarity and Google Analytics, which appear in the table above:
- One session per tab. The anonymous ID stays in
sessionStorageand disappears when you close the tab. One visit cannot be linked to another. - IP never in clear text. We keep only a daily hash (SHA-256 with a secret), which groups events from the same browser on the same day and changes the next day.
- What is recorded: event name (e.g. page_view, newsletter_submit), page path, the domain you came from (not the full address), campaign parameters (UTM) and a summarized browser (e.g. "Chrome/120 · Windows").
- No set date to be removed. Up to version 1.4 they were deleted after 90 days; now they stay for analysis over time, and we review this once a year. Those linked to your account are removed when you ask for deletion.
3.2. Instagram on the site
When the site shows public posts from our Instagram (@sobrevivendoadulto), we only display what is already public there and we do not collect anything from you. If you click "view on Instagram", you leave our site and Meta's policy applies.
3.3. Members area tools
If you buy Minhas Contas, Faxina Sem Surto or the Salário com Destino kit, you get tools on the site that save what you type. This is how they work:
- What is stored. Only what you fill in. In Minhas Contas: name, amount and due day of each bill, and which ones you marked as paid. In the Salário com Destino spreadsheet: income, expenses by category, subscriptions, delivery and transport spending, savings, yearly bills, debts with amount and interest, and the 30-day plan checklist. In Faxina Sem Surto: rooms and cleaning tasks. The tools do not ask for your CPF, bank details or bank password.
- Where it is kept. In our database, linked to your account. The tool saves on its own while you use it, and the browser keeps no copy. It only opens when you are logged in and own the product.
- What we do not do with it. The content of the tools is not sent to Meta, is not part of the usage events (analytics) and is not used in ads or marketing e-mails. The site's admin panel has no screen that shows what you typed.
- Who else has access. This data lives on the same server as the rest of the site, with no new provider. Leal Ferraz, which manages the server, has technical access to the database to keep everything running. Database backups, which include this data, are also kept at Cloudflare for up to 7 days (sections 5 and 6).
- Sensitive data. Income and debts are not on the LGPD list of sensitive data (art. 5, II), but we treat them as confidential. The tools do not ask for health, religion or any other sensitive data. In free-text fields, prefer generic names: "pharmacy" instead of the name of the medicine, "family loan" instead of the person's name.
- Change, export and delete. You can change or delete anything directly in the tool. The export file of your data (section 8) includes everything saved in the tools. If you ask for account deletion, this data is deleted along with the account at the end of the 30 days and leaves the backups within 7 days after that.
- If your access to the product ends (after a refund, for example), what you typed stays on your account until you ask for deletion. To delete only the tool data without closing the account, contact the DPO (section 2).
3.4. Visit source (attribution)
When you sign up, leave your details on an offer page, create an account or place an order, we keep where the visit came from, to know which content and ads work. This is how it works:
- What is included. Campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id), ad click identifiers (fbclid, gclid, gbraid, wbraid, ttclid, msclkid, li_fat_id, twclid), the domain of the site you came from (not the full address), the entry page and the category of device, browser and system. The full text that identifies the browser (user agent) is not stored.
- Without analytics consent, only the visit in which you sign up or buy counts. The data stays in the tab (
sessionStorage) and leaves your browser only along with the form you submit. - With analytics consent, the browser also remembers the first campaign that brought you and counts visits until the sign-up or purchase. This lets us tell the first contact from the last one. If you withdraw your consent, this information leaves your browser right away.
- With marketing consent, the Meta cookies (
_fbpand_fbc) are also included, which link the purchase to the ad. - Why without asking for consent. Knowing where people who sign up or buy came from is the minimum needed to decide where to invest in content and ads (legitimate interest, art. 7, IX). That is why the form visit is stored only with campaign data, never with the full address of where you came from or with what you did on the site. If you do not want this, ask through the DPO form: we delete the source and keep the rest of the record (art. 18, §2).
- Click identifiers (fbclid, gclid, ttclid and similar) are codes created by the ad platforms. Without your marketing consent, we do not send these codes to Meta, Google or TikTok.
- For how long. The source has no set date to be removed: it stays with the record while it is useful to measure campaigns, and we review this once a year. It is included in the export file of your data and is removed when you ask for deletion or object (section 8). Withdrawing consent in the banner applies from then on in this browser; what was already stored with your record stays until you ask for deletion (art. 8, §5). Up to version 1.4, click identifiers of offer page leads were deleted after 90 days; now they stay with the record.
- What we do not do. The source is not sent to any company outside section 5 and is not used to decide anything about you.
4. Cookies and browser storage
A cookie is a small file that the site saves in your browser. We use three categories, and only the first one is on without you choosing:
| Name | Category | What for | Duration |
|---|---|---|---|
__Secure-better-auth.* | Necessary | Keep you logged in (only for people with an account) | 30 days, renewed while you use the site |
__Host-consent and sva_consent_v1 (local storage) | Necessary | Remember what you chose in the banner | Cookie: 90 days. Local storage: until you clear your browser |
| Theme preference (local storage) | Necessary | Remember light, dark or black | Until you clear your browser |
Tab data (sessionStorage: attribution_v1, sva_attr_extra and others) | Necessary and analytics | Visit source (campaign and click identifiers), protection against double purchase and, with analytics, the anonymous session ID | Gone when you close the tab |
attribution_persist_v1 (local storage) | Analytics | Remember the campaign that brought you from one visit to the next | 30 days, renewed on every visit |
sva_primeiro_toque_v1 and sva_visitas_v1 (local storage) | Analytics | The first campaign that brought you and how many visits there were until the sign-up or purchase | Until you withdraw analytics consent or clear your browser |
_clck, _clsk (Microsoft Clarity) and CLID, MUID (Microsoft domains) | Analytics | Clarity: group the pages of the same visit and recognize the browser | _clsk: 1 day. The others: up to 1 year |
_ga and _ga_* | Analytics | Google Analytics 4: count visits and conversions | Up to 2 years |
_gcl_au, _gcl_aw, _gcl_gb, _gcl_ls (local storage) and Google cookies on its own domains | Marketing | Google Ads: measure conversions and remarketing | Up to 90 days (Google's own follow its policy) |
_ttp, _tt_enable_cookie, ttcsid and, in local storage, tt_appInfo, tt_sessionId and tt_pixel_session_index | Marketing | TikTok Pixel: measure TikTok ads | Up to 13 months |
_fbp and _fbc | Marketing | Meta Pixel: measure ads | Up to 90 days |
Legal basis: the necessary ones rely on legitimate interest (art. 7, IX), because the site does not work without them. Analytics and marketing only turn on with your consent (art. 7, I).
Changing your mind is easy. Click Manage cookies in the footer of any page. If you withdraw your consent, the Meta Pixel, Clarity, Google Analytics, Google Ads, the TikTok Pixel and the events stop right away, and their cookies on our domain are deleted. What was already sent before that follows each company's policy, and the visit source already stored with your record leaves through the deletion or objection request (section 8).
Pages that never load these tools: password reset and e-mail unsubscribe, which arrive with a code in the address. On the other pages, the address sent to Google carries no parameters other than campaign ones.
Today the site does not use Plausible, Hotjar or Google login. If any of them is turned on, this policy changes first.
5. Who we share your data with
Only with companies that process data on our behalf so the service works (processors). The full list, with the role of each one, is at /legal/operadores (in Portuguese). Summary:
- Leal Ferraz (Brazil): provides and manages the server that hosts the site, the API and the database, and has technical access to them to keep everything running. The server infrastructure belongs to Hostinger, in a data center in Brazil
- Cloudflare (USA): stores the PDFs, the data export files and the database backups; handles DNS
- Resend (USA): sends transactional e-mails
- Google Workspace (USA): the brand's mailbox
- Meta (USA): Pixel, only with your marketing consent
- Microsoft (USA): Clarity, only with your analytics consent
- Google (USA): Google Analytics 4, only with analytics consent, and Google Ads, only with marketing consent
- TikTok (USA, Singapore and other countries): TikTok Pixel, only with marketing consent
- Mercado Pago (Brazil): payment, when sales are active
Meta, Google (in Google Ads) and TikTok also use what they receive through the pixels for their own purposes, such as improving ad delivery. In that part they act as controllers, and each one's policy applies.
We do not sell data. We do not pass your data to anyone outside this list without announcing it here first, and we do not use data to discriminate against anyone.
6. International transfer
The database is in Brazil. Cloudflare, Resend, Google, Meta, Microsoft and TikTok store or process part of the data in the United States (in Cloudflare's case, this includes the database backups, kept for 7 days). The transfer relies on each provider's data protection contractual clauses (art. 33, II, of the LGPD) and, where its contract includes them, on the standard clauses approved by the ANPD (Brazil's national data protection authority; Resolution CD/ANPD No. 19/2024). For Clarity, Google Analytics, Google Ads, the Meta Pixel and the TikTok Pixel, the consent you give in the banner also applies, after being told that this data leaves Brazil (art. 33, VIII). Clarity and Google Analytics only load if you accept analytics; the Meta Pixel, Google Ads and the TikTok Pixel, if you accept marketing. TikTok also processes data in Singapore and in other countries where it operates.
7. Other retention periods
| Data | How long |
|---|---|
| Database backups (on the server and at Cloudflare) | 7 days, rotating |
| Visit source (attribution) of sign-ups, leads, accounts and purchases | With the record, no fixed period; removed when you ask for deletion |
| Download logs | 90 days |
| Administration action logs | 5 years (audit) |
| Export file with your data | Delivered through a temporary, signed link |
When we delete your data, it leaves the database right away. In the backups, it disappears when the backup expires, within 7 days.
8. Your rights (LGPD art. 18)
You can, at any time and free of charge:
- Confirm whether we have data about you
- Access the data we have about you (JSON file)
- Correct incomplete or outdated data
- Anonymize, block or delete unnecessary data
- Port your data to another provider
- Delete data processed with consent
- Know who we share your data with (section 5)
- Withdraw consent and know what happens if you do not consent
- Object to processing based on legitimate interest
How to ask:
- Have an account? Exporting or deleting your data is in your members area (in Portuguese).
- No account (you downloaded the Kit SOS, joined a waitlist, subscribe to the newsletter, sent a message or bought without signing up)? Use the DPO form, without logging in. You receive an e-mail with the protocol number; reply to it from the same address so we can confirm the e-mail is yours before handing over or deleting any data.
- You can also write to nina@sobrevivendoadulto.com.br.
- Just want to stop receiving e-mails? Use the link in the footer of any e-mail from us or /cancelar (in Portuguese).
We reply within 15 days. If that does not solve it, you can file a complaint with the ANPD (Brazil's National Data Protection Authority).
9. Security
- Always-encrypted connection (HTTPS)
- Database with no internet access, only through the server's internal network
- Passwords stored only as hashes, never as text
- Mandatory two-step verification for administration access
- IP stored as a hash in usage and security logs
- Files and backups at Cloudflare, encrypted by the provider
- PDF downloads through a signed link that expires
- Members area tools only open when you are logged in and own the product, and each account reads and writes only its own data
- Security updates of dependencies tracked
10. Security incident
If an incident could bring you relevant risk or harm, we notify the ANPD and you, in clear language, saying what happened, which data was affected and what we did, within the deadline set by ANPD regulation (LGPD, art. 48).
11. Children and teenagers
Our products are designed for adults (18+). We do not knowingly process data of people under 18. If you are a legal guardian and found a sign-up for a minor in your care, write to nina@sobrevivendoadulto.com.br and we will remove it.
12. Changes to this policy
We review this policy every 6 months and whenever something changes in the way we process data (new provider, new feature). The current version is always at /en/legal/privacidade, with date and number. If the change is important, we notify you by e-mail (if you are subscribed) or on the site.
What changed in version 1.5: Microsoft Clarity and Google Analytics 4 (only with analytics consent) and Google Ads and the TikTok Pixel (only with marketing consent) were added, with the cookies of each one. The visit source is now stored for every sign-up, lead, account and purchase, with first and last visit (section 3.4), with no fixed period, until you ask for deletion or object. Click identifiers of offer page leads are no longer deleted after 90 days. Usage events (previously 90 days) and records of what you chose in the banner (previously 2 years) also now have no set date, until the deletion request. The cookie banner now names each tool and the transfer of data out of Brazil, and for that reason asks for your choice again.
What changed in version 1.4: data from the members area tools (Minhas Contas, Faxina Sem Surto and the Salário com Destino spreadsheet) was added, with what we store, what for, legal basis, retention, export and deletion (section 3.3). No new provider.
What changed in version 1.3: hosting on a server in Brazil provided and managed by Leal Ferraz (Hostinger infrastructure); files and backups at Cloudflare (USA); departure of Vercel, Railway, Supabase and Upstash; cookies section; rights channel for people without an account; retention periods revised; new DPO e-mail.
13. Governing law
This policy follows Law 13,709/2018 (LGPD) and other Brazilian laws. In case of a dispute, the courts of your place of residence apply, as provided by the Consumer Protection Code.
14. Contact
Questions? Write to nina@sobrevivendoadulto.com.br or use the DPO form.