Privacy Policy

1. Data controller

Processing is carried out under the responsibility of the University of Campinas (UNICAMP), through the Interdisciplinary Center for Energy Planning (NIPE) and the São Paulo Center for Studies in Biogas and Bioproducts (CP2B).

Data Protection: contact the UNICAMP Data Protection Officer (DPO). For platform-specific matters: lucasnc@unicamp.br.

2. What data we process

Browsing: the platform is openly accessible. Like any website, the server records the IP address, browser, requested page and date and time of each request, to run and secure the service.

User accounts: accounts are created by an administrator, by invitation, for researchers and collaborators. We process name, e-mail, the password (kept only as a bcrypt hash, never as text), the role and access level, the creation and last sign-in dates, and the number of failed password attempts. When you sign in, a session token is kept in your browser; it expires after a short time and is revoked when you sign out. Access to confidential resources is recorded (who, which resource, when and from which IP address).

Newsletter: when you subscribe (in the footer or in the cookie notice), we keep your e-mail, language, the form you used, the version of this Policy and the date and time you subscribed. We keep no IP address and no browser details.

Anonymous visit counts, for every visitor: the page visited (without URL parameters), the language, the device type (phone, tablet or computer), the site you came from (only on the first page you open) and how long the page stayed visible on screen. We use no cookie and store nothing in your browser, send no identifier and keep no IP address or browser identification: the server keeps only daily totals (for example, “Map page, 15 Oct, phone: 12 views”), which cannot identify anyone.

Usage statistics, only if you choose “Accept all” in the cookie notice: a random identifier kept in the pilar2b_vid cookie, a random session identifier (per browser tab), the page visited (without URL parameters), the language, the device type (phone, tablet or computer) and, on the first page of a visit, the site you came from. We keep no IP address and no browser identification. The data is used only to count visits and see which pages are used.

Viability Calculator (optional): if you send the calculator’s contact form, we keep your name, e-mail, municipality, the calculation data and technical request metadata (IP address, browser and referring page), only with your explicit consent. We do not collect tax IDs (CPF/CNPJ).

3. Legal basis and purpose

Anonymous visit counts: the daily totals are anonymised data, which cannot identify anyone and are therefore not personal data (LGPD art. 12). Purpose: knowing which pages are used and for how long, in order to improve the platform.

Newsletter, usage statistics and calculator: consent (LGPD art. 7, I), given freely, informed and unambiguously, which you can withdraw at any time. Newsletter consent is recorded with the version of this Policy and the date and time. Purposes: sending PILAR-2b news; measuring how the platform is used in order to improve it; responding to your interest and producing aggregate research statistics.

User accounts: legitimate interest and the conduct of research activities (LGPD art. 7, V and IX), to authenticate and authorise researchers and collaborators. Server records and essential browser storage: legitimate interest (art. 7, IX), to run and secure the service.

We do not use the data for automated decisions with legal effects or for advertising.

4. Cookies and browser storage

Essential, needing no consent: your cookie choice, the language, the light or dark theme, the map preferences and, when you sign in, the session token. They are kept in the browser’s local storage and are not used to identify visitors.

Statistics, only with “Accept all”: the pilar2b_vid cookie, valid for 13 months from your first visit and not renewed automatically, and a session identifier that is deleted when the tab is closed.

You can change your choice at any time under “Cookie preferences”, at the foot of every page. Choosing “Essential only” deletes the statistics cookie and stops every statistic that carries an identifier; only the anonymous count described in section 2 continues, which uses no cookie and no browser storage.

5. Sharing and data location

Personal data is processed on UNICAMP-managed infrastructure. We do not send personal data to Supabase, Vercel, Railway or any third-party analytics service, and we do not sell or share your data with third parties.

To draw the map, your browser fetches the background images directly from third-party map services (OpenStreetMap, CARTO, Esri or OpenTopoMap, depending on the base map chosen) and public data from IBGE’s API. As with any website, these services receive your IP address and browser details under their own policies; some are outside Brazil. No platform identifier is sent to them.

6. Retention and erasure

User accounts: while the account is active. When a collaboration ends the account is deactivated and later deleted; the records of access to confidential resources are kept for accountability.

Newsletter: until you unsubscribe. The record of the subscription and of the unsubscription is kept as proof of consent and erased at your request.

Usage statistics: each record is deleted automatically after 13 months.

Anonymous visit counts: the daily totals are kept as a time series, since they hold no personal data.

Calculator and server records: only for as long as the purposes above require, erased at your request or at the end of processing (LGPD art. 15).

7. Data-subject rights (LGPD art. 18)

You may request: confirmation and access; correction; anonymization or erasure; portability; information on sharing; and withdrawal of consent.

To unsubscribe from the newsletter, use the unsubscribe link that comes with it. For the statistics, use “Cookie preferences” in the footer. For other rights, contact lucasnc@unicamp.br or the UNICAMP DPO. If you used the calculator, you can request access to or erasure of your record using the identifier (lead_id) returned on submission.

8. Security

We apply technical and administrative measures to protect data, including encrypted connections (HTTPS), passwords kept as bcrypt hashes, a temporary account lock (15 minutes) after 5 wrong password attempts, revocable session tokens, origin control (CORS), rate limiting, input validation, a record of access to confidential resources, and the removal of e-mail addresses and tax IDs from the application’s logs.

9. Changes and contact

This Policy may be updated; the version in force is indicated by the date above. When the description of the cookies changes, the cookie notice asks for your choice again. Questions: lucasnc@unicamp.br.