Privacy

Who is responsible

Bebidário (bebidario.com.br) is the controller responsible for processing the data described here. For any privacy matter, including the requests provided for in the Lei Geral de Proteção de Dados (LGPD), write to [email protected].

What data the site keeps

• Account: name, email and password. The password is stored hashed (PBKDF2-SHA-256, one hundred thousand iterations); the password itself is never stored anywhere. Photo and bio, if you add them. If you sign in with Google, we receive from Google only your name, email and Google account ID — no password, contacts or any other data. People who arrive through a Bebidário ad may see Google's suggestion to continue with their Google account; it appears on your device, and nothing reaches Bebidário unless you tap it.
• What you post: ratings, reviews, comments on comparisons, votes on flavors, on the profile and in polls, and your shelf. This is public, along with your member name. Your vote in the comparisons' “Which do you prefer?” only shows up in the count, without your name — and, if you comment, next to your comment.
• Newsletter: your email, if you subscribe to the weekly letter.
• Technical logs: Cloudflare, which hosts the site, logs IP address, browser and requested page, so the site can work and defend itself against attacks.
• Analytics: Google Analytics counts visits in aggregate.
• Ads: Google AdSense, which serves the site's ads, uses its own cookies in your browser (see the cookies page).

What it's used for, and on what legal basis

• Maintaining your account and publishing what you write — performance of a contract.
• Sending account confirmation and password change emails — performance of a contract.
• Site security and prevention of fraud and abuse — legitimate interest.
• Measuring audience to know what gets read — legitimate interest.
• Showing ads, which keep the site free — legitimate interest.
• Sending the newsletter — consent, which you can withdraw at any time.

Ads are chosen by Google, not by Bebidário. Google and other vendors use cookies to show ads based on your visits to this and other sites; you can turn off personalized ads in Google's ad settings. Your account data (name, email, what you post) is not used for advertising, and the site makes no automated decisions about you.

Who the data is shared with

• Cloudflare: hosting for the site, the database and the images.
• Google Analytics: audience measurement.
• Google AdSense: ad serving. Google receives the page address and its own cookies from your browser, as on any site with Google ads; Bebidário does not send it any of your account data.
• Resend: sending account emails.
• Amazon: only if you click “Where to buy”. You then move to Amazon's site, which follows its own privacy policy; Bebidário does not send it any of your account data.
• Public authorities: only under a legal order.

Bebidário does not sell personal data and does not pass it on to advertisers.

Data outside Brazil

These providers keep servers abroad, so data may be processed outside Brazil. The LGPD allows the transfer, which relies on the providers' own contractual clauses.

How long it's kept

• Account: for as long as it exists.
• Session: the cookie lasts 30 days and is removed when you sign out.
• What you've posted: kept while it's on the site; once deleted, it comes off the pages, and cached and backup copies take a few more days.
• Newsletter: until you ask to unsubscribe.
• Access logs: six months, as required by the Marco Civil da Internet.

Your rights

The LGPD guarantees you: confirmation that processing takes place, access to the data, correction, anonymization or deletion, portability, information about who it has been shared with, and withdrawal of consent.

Send your request to [email protected]. We reply within 15 days. To protect your account, we may ask for something that confirms it's you.

Deleting your account

There is currently no delete-account button on the site: the request is made by email, and we delete the account and the data linked to it. Also tell us what you'd prefer for your reviews — delete them too, or keep them without your name.

Security

The site runs on HTTPS only, the password is stored hashed, the session cookie can't be read by the page's JavaScript, and the admin panel only responds to those with permission. Even so, no system is completely immune: if you notice anything strange, write to [email protected].

Under 18s

The site is for adults and is not directed at children or teenagers. If we learn of an account belonging to someone under 18, it is deleted.

Changes to this notice

When this notice changes, the date at the top of the page changes with it. Significant changes are announced on the site.