Privacy policy

1. Controller and contact

Next Content is run by setstate.info, which is the controller of the personal data processed on this site.

For privacy questions, or to reach our data protection contact (Encarregado), write to terry@setstate.info.

2. Data we collect

• Account data, if you register: your name, email address and an optional username. Your password is stored only as a one-way hash, never in readable form. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password
• Account security data: when your password last changed, whether your email address has been confirmed, and, while a password reset is pending, the reset code sent to you (valid for 10 minutes) and how many times it has been tried
• Your profile: the picture you upload, shown on your author page and next to your posts and comments
• Content you publish: your posts, the images, audio and video you upload for them, your comments, and which posts you like. Posts, comments and your author profile are public; which posts you like is shown as a count on each post, not under your name
• Messages you send: the name, email address and message you enter in the contact form, which goes to our inbox, and a message you send to an author through their profile, which goes to that author with your name and email address so they can reply
• Technical data: your IP address and browser type, used to protect the site from abuse (section 9 explains how they are kept) and, when something goes wrong, the error report our monitoring service receives, which excludes your IP address, cookies and what you typed
• Upload counts: how many images and how much audio and video you upload each day, to enforce the daily limits

You can read Next Content without an account. To register, you need to give us your name and email address; without them we can't create your account.

3. Legal bases for processing (LGPD art. 7, GDPR art. 6)

• Performance of a contract: to create and run your account, publish your content and provide the service
• Legitimate interest: to keep the site secure and prevent abuse (for example by limiting repeated attempts and uploads, and by collecting error reports), and to pass a message you send to an author on to them
• Consent: when you give it, for example by sending a message through the contact form
• Compliance with a legal obligation: where the law requires it

4. How we use your data

• Provide your account, your dashboard and your author profile, and publish your posts, comments and likes
• Send the emails you need about your account: password-reset codes. We send no newsletters or marketing email
• Deliver the messages you send through the contact form and to authors
• Protect the site and your account, for example by limiting repeated sign-in, registration, password-reset and contact attempts, and by enforcing the daily upload limits
• Find and fix errors on the site
• Comply with legal obligations

5. Cookies and similar technologies

We use only what the site needs to work. There are no advertising or analytics cookies, so there is nothing to opt in or out of; this table is here so you know what is stored on your device and why.

6. Data sharing

We do not sell your personal data, and we show no advertising. We share data only with processors that help us run the site, and with the people you choose to contact:

• Hosting and delivery (Vercel)
• Database hosting for accounts, posts, comments and likes (MongoDB Atlas)
• Hosting images, including profile pictures, which your browser loads directly (Cloudinary)
• Hosting uploaded audio and video, which your browser loads directly (Amazon Web Services S3)
• Sending password-reset codes, contact-form messages and messages to authors (SendGrid)
• Error monitoring, without your IP address, cookies or what you typed (Sentry)
• Google, if you sign in with Google
• An author, when you send them a message through their profile: they receive your name, email address and message
• Public authorities, when required by law

7. International data transfer

Our processors handle data outside Brazil, the European Union and the United Kingdom, mainly in the United States. Their data processing agreements include the European Commission's Standard Contractual Clauses, and the UK's equivalent terms for data from the UK, and MongoDB Atlas, SendGrid, Cloudinary, Amazon Web Services, Google and Sentry are also certified under the EU-U.S. Data Privacy Framework and its UK Extension. These safeguards follow LGPD arts. 33 to 36 and Chapter V of the GDPR. To ask for a copy, write to us (section 12).

8. Data security

We protect your data with encrypted connections (HTTPS), one-way hashing of passwords, limits on repeated sign-in, registration, password-reset and contact attempts, password-reset codes that expire after 10 minutes and five tries, and sign-in sessions that end on every device when your password changes.

9. Retention

• Account data and your profile: until you ask us to delete your account
• Posts, comments and likes: until you delete them, or your account is deleted. Deleting a post deletes the comments and likes on it
• Uploaded images, audio and video: until a periodic clean-up after the post, or your account, is deleted. They are not shown anywhere in the meantime
• Password-reset codes: 10 minutes
• Records used to limit repeated attempts: until the limit's window ends, at most 1 hour. They are stored as one-way keyed codes, so neither your IP address nor your email address is kept in readable form
• Upload counts: 2 days
• Error reports (Sentry): 90 days
• Server logs, which can include IP addresses and browser type: 1 day, kept by our hosting provider
• Messages you send through the contact form: in our inbox until we have dealt with them. Messages to authors are theirs once delivered

10. Your rights (LGPD art. 18, GDPR arts. 15 to 22)

You have the right to:

• Confirm whether we process your data
• Access your data
• Correct incomplete or outdated data (you can change your username, profile picture and password yourself in your dashboard's Settings)
• Anonymize, block or delete unnecessary or excessive data
• Restrict how we use your data, for example while we check a correction you asked for
• Object to processing based on our legitimate interest (section 3)
• Request a copy of your data to take elsewhere (portability)
• Delete your account and its data by asking us
• Obtain information about who we share data with
• Not be subject to decisions made solely by automated means. We make no such decisions

To exercise any of these rights, write to terry@setstate.info.

You can also complain to a data protection authority: the ANPD in Brazil, the authority in your country if you live in the European Union, or the Information Commissioner's Office (ICO) in the United Kingdom.

11. Minors

Next Content is not intended for children under 13. We do not knowingly collect children's data without the consent of a parent or guardian.

12. Contact

If you have questions about this Policy or your data, write to terry@setstate.info.

13. Changes to this Policy

We may update this Policy from time to time. We will announce significant changes on the site or by email.