Privacy policy
Last updated: 8 October 2026
Preliminary version: this text is still being reviewed by a lawyer before launch.
This is a translation for convenience. The Portuguese version is the reference text.
Who looks after your data
Cerveja Barata (cervejabarata.com.br) is the controller of the personal data processed on this site. For any privacy matter, including contacting our data protection officer, write to privacidade@cervejabarata.com.br.
In short
- You don't need an account to use the site.
- We use no advertising or tracking cookies, and we don't sell data.
- Nickname and email are optional. The email is deleted once it has been used.
- To stop spam we keep codes derived from your IP address, not the address itself, for up to 30 days.
What we process and why
When you visit the site
- Data: IP address and technical browser data, processed by Cloudflare.
- Why: to deliver the pages, protect the site from attacks and measure traffic in aggregate, without cookies.
- Legal basis: legitimate interest.
- How long: technical logs for Cloudflare's retention period; statistics are aggregate only.
When you send a price or a venue
- Data: what you sent (venue, beer, price and details), and your nickname and email if you give them.
- Why: to review and publish the price, credit you by nickname and email you when the price goes live.
- Legal basis: consent for nickname and email; legitimate interest for the content you sent.
- How long: the email is deleted after the notice is sent or when the submission is declined; the nickname stays while the price is published.
When you send photos of a menu
Menu photos are read by artificial intelligence (Cloudflare's Workers AI) only to extract the beer prices, and are not kept. Your contact, if you give one, is kept encrypted and deleted after 90 days.
Abuse protection
- Data: a code generated from your IP address with a secret key, which cannot be turned back into the address without that key, plus Cloudflare's anti-bot check (Turnstile).
- Why: to stop spam and allow one vote per person per day on “still this price?”.
- Legal basis: legitimate interest.
- How long: up to 30 days.
Log of submissions and votes
- Data: encrypted IP address, the action and the time.
- Why: site security and compliance with Brazil's Internet Civil Framework (Marco Civil).
- Legal basis: legitimate interest and legal obligation.
- How long: 6 months, then deleted automatically.
When you contact us
- Data: your email or phone, your message and what you tell us in it (for example, as a bar owner, through the For bars form).
- Why: to reply and handle your request.
- Legal basis: consent (on the For bars form), legitimate interest or steps taken at your request.
- How long: as long as needed to handle the request; the contact left on the For bars form is deleted after 90 days.
When we contact your bar
- Data: the bar's name and bairro, the business contact the bar published or gave us (Instagram, WhatsApp or email), where it came from and the history of the contact (when we wrote and whether the bar replied).
- Why: to invite the bar to send its menu and to offer sponsorship spots.
- Legal basis: legitimate interest, business to business. Every email has a link to stop further contact; once asked, we never write again on any channel.
- How long: the contact is deleted 90 days after the last interaction, unless the bar is a sponsor; the history stays, without the contact.
Who processes data for us
- Cloudflare: hosting, network, database, anti-bot check, cookieless statistics, email forwarding and automatic reading of menu photos sent to our team.
- Telegram: notifies our moderators of new submissions (content and nickname, never the email) and, from the For bars form, the contact left for our reply.
- Resend: sends the notification email when you give an email address.
- Google (Gemini): helps read public content such as menus, news and bars' public posts; it never receives personal data about people using the site.
- Meta (Instagram): through Instagram's official API, we read the public posts of bars' business profiles (prices and promotions); we don't read personal profiles or send any visitor data.
- GitHub: runs the jobs that collect public data; it receives no visitor data.
Some of these services process data outside Brazil, for example in the United States, with the safeguards required by Brazil's General Data Protection Law (LGPD).
Cookies
We use no advertising or tracking cookies, and Cloudflare's statistics work without cookies. The anti-bot check may look at technical browser signals only to tell people from bots.
Two preference cookies keep the colour scheme and the light or dark mode when you pick one (cb-tema and cb-modo, for a year). They stay in your browser, don't identify you and aren't sent to anyone.
Open data
We publish prices and venue data as open data under the ODbL licence. Those files never include the email, IP address, nickname or any other personal data of whoever sent a price.
Your rights
Under the LGPD you can ask us to confirm whether we process your data, and for access, correction, anonymisation, blocking or deletion, portability, information about sharing and withdrawal of consent. You can also object to processing based on legitimate interest, and complain to Brazil's data protection authority (ANPD).
How to ask for access or deletion
- Write to privacidade@cervejabarata.com.br saying what you would like.
- To help us find your data, tell us the email you used (if any), your nickname or roughly when you sent it.
- We reply within 15 days and confirm once the data has been deleted or corrected.
Some records are short-lived anyway: anti-abuse codes disappear within 30 days and the log of submissions and votes after 6 months.
Minors
Cerveja Barata is for adults aged 18 or over and is not aimed at children or teenagers. If you know of data from a minor sent by mistake, tell us and we will delete it.
Changes to this policy
We may update this policy. The date at the top of the page shows the version in force.