BlacklistPDR
Sign inJoin

Privacy Policy

Last updated: October 15, 2026 · Version 1.0

This Policy explains what personal data BlacklistPDR collects, why, who we share it with, how long we keep it and what your rights are. It was written taking into account the Brazilian General Data Protection Law (LGPD, Law 13,709/2018), the Brazilian Internet Civil Framework (Law 12,965/2014) and applicable United States privacy laws, such as the California Consumer Privacy Act (CCPA/CPRA).

1. Who is responsible for your data

The data controller is [TO BE DEFINED], [TO BE DEFINED]. Data protection officer: [TO BE DEFINED]. Privacy contact: [TO BE DEFINED].

2. What data we collect

Data you provide:

  • at registration: name, email, WhatsApp, country, state and city, the text about your PDR experience, and your password (stored only in encrypted form, which cannot be read);
  • when using the platform: the ratings, criteria, payment time and comments you post, the companies you suggest, and your choice to post anonymously;
  • on the waiting list (before launch): email, WhatsApp, country, profile and language.

Data collected automatically:

  • access records: IP address, date and time, and browser used, when you sign in, register and post content;
  • essential cookies, described in the Cookie Policy.

We do not collect sensitive data (such as racial origin, religion, health or biometrics) or payment data.

3. How we use your data and on what legal basis

  • To create and maintain your account, approve your registration and publish your content — performance of the contract (our Terms).
  • Security, fraud prevention, moderation and legal defense — legitimate interests and exercise of legal rights.
  • To keep access records — legal obligation (Brazilian Internet Civil Framework, art. 15).
  • To send emails about your account (approval, security, changes to the Terms) — performance of the contract.
  • To notify you about the launch or news (waiting list) — consent, which you can withdraw at any time.

4. What others can see

  • Members can see: your name (or "Verified tech" if you chose anonymous), your state and, if posted with your name, your city; your ratings and comments.
  • The public (not signed in) sees only company names.
  • We never display your email, WhatsApp, IP address or registration text.

5. Who we share data with

We do not sell your data and do not share it for advertising.

  • Service providers that help us run the platform, such as our server hosting company and our email delivery service, who may only use the data to provide their service.
  • Authorities, when there is a court order or valid legal request.
  • The reviewed company does not receive your identity, except by court order.

6. International transfer

The platform's servers are located in the United States. When you use BlacklistPDR from Brazil or another country, your data is transferred there, which is necessary to perform the service you signed up for and is done with appropriate security measures.

7. How long we keep data

  • Account data: while your account is active.
  • Access records: at least 6 months, as required by law, and at most 1 year, unless a court order requires longer.
  • After you delete your account: your personal data is deleted or anonymized, and your ratings and comments are no longer displayed. We may keep the minimum necessary to comply with legal obligations or defend ourselves in legal proceedings.

8. Security

We use encrypted connections (HTTPS), passwords stored with hashing (bcrypt), restricted access to the admin panel and logging of administrator actions. No system is 100% secure; if an incident may pose a relevant risk, we will notify you and the authorities as required by law.

9. Your rights

Under applicable US laws (such as the CCPA/CPRA for California residents), you may ask to know what data we hold about you, correct it or delete it, without being discriminated against for doing so. We do not sell or share personal data for cross-context behavioral advertising.

Under the LGPD (Brazil), you may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; deletion of data processed based on consent; information about who we share data with; withdrawal of consent; and objection to irregular processing.

How to exercise them: many of these rights are available under "My account" (edit your data and delete your account). For anything else, write to [TO BE DEFINED]. We will reply within 45 days (CCPA) or 15 days (LGPD).

10. Minors

The platform is for people aged 18 and over only. We do not knowingly collect data from minors (including children under 13, as provided by COPPA); if we find such a case, the account will be deleted.

11. Cookies

See our Cookie Policy.

12. Changes

We may update this Policy. Material changes will be announced on the site and, when necessary, we will ask for your acceptance again.

13. Contact

[TO BE DEFINED] · [TO BE DEFINED] · Data protection officer: [TO BE DEFINED] · [TO BE DEFINED]