What we collect, and what we do not
No cookies, no third-party tracker, no form. This page describes what actually happens. If the practice changes, the page changes with it.
Three situations
What we process depends entirely on how you reach us. Start with the situation that is yours.
1. You only visited the site
We collect nothing that identifies you. No cookie is written, no tracking pixel loads, no cross-site identifier is created. We measure audience in aggregate, with the IP address turned into a hash using a salt that rotates daily, which makes it impossible to recognise the same person from one day to the next. There is no individual record of you to access, correct or delete: none is created.
Sub-processors in this situation: Supabase (European Union) and GitHub Pages (United States).
2. You wrote to us
We receive what you sent, at the address you used. There is no form on the site precisely so that no third-party service sits between you and us. We keep the message for as long as the matter lasts and the corresponding legal period.
3. You took part in a workshop
This is the situation involving the most data, and therefore the one we describe most carefully, including what is not yet formalised.
A workshop produces material: collages, scenes, notes and, where authorised, photographs and recordings. That material records people: their bodies, their voices, their stories.
The workshops are run by (in)PULSO — Comunicação Viva, which holds the relationship with the participating groups, in partnership with Regen Studio, responsible for production and methodological documentation. Authorisation is collected before the session by the organisation hosting the group, and it is always possible to take part without being photographed or recorded. Anyone who changes their mind afterwards can ask for the material to be withdrawn.
For participants under 18, photography, recording and use of image require a guardian's authorisation. That is our own decision, stricter than the legal minimum. See the section on children and adolescents.
For publication (site, report, presentation) material is anonymised by default. Appearing identified, or being quoted by name, requires a separate and explicit authorisation, distinct from the authorisation to take part.
What is not yet formalised. The written agreement between (in)PULSO and Regen Studio on the handling of this material is being drafted and has not been signed. In the meantime, this page speaks for what Regen Studio processes: this site and its audience measurement. On workshop material we describe above the practice we follow, and we handle everything restrictively: anonymised by default, no identified publication. Once the agreement is signed, this page will name who answers for what.
How we measure audience
The site uses our own measurement script, hosted here, which sends events to our own function on Supabase (European Union). It is not Google Analytics or any third-party product, and nothing is shared for advertising.
Your browser sends page path + event type → the server turns your IP into a hash with a salt that rotates every day → the raw events are deleted after 48 hours; only the aggregate totals remain.
Exactly what each event records
Page path; event type (page view, scroll depth at 25/50/75/100%, a click on a marked element, or page exit); the originating domain, when you came from outside the site; the previous page, when the navigation was internal; the browser timezone, used to derive an approximate country code; and a bot flag, when the visit looks like a crawler.
On clicks we record only the label of the element clicked and the section it sits in. On page exit, the time spent in milliseconds. Your IP address is never stored as such, and neither is the browser identification string.
Storage in your browser
No cookies. No localStorage. Two keys in
sessionStorage, both limited to the open tab and erased when
you close it: _rt_prev_page, which holds the path of the
previous page, and _ponte_lang_bar, which remembers that you
dismissed the language notice so it is not shown again.
Legal basis
Legitimate interest: LGPD art. 7, IX together with art. 10, and GDPR art. 6(1)(f). Since we write no cookies and store no raw IP, this measurement does not depend on prior consent, which is why the site shows no cookie banner: there would be nothing to consent to.
Sub-processors and transfers
Supabase · European Union
The database and server function that receive the audience events. Data hosted in the European Union (Stockholm, Sweden).
GitHub Pages (Microsoft) · United States
Static hosting for the site. GitHub stores no personal data on our behalf; like any web server, it processes the request your browser makes to receive the page.
Brazil ⇄ European Union
Sending data from Brazil to a European server is an international transfer. Since 26 January 2026 the ANPD recognises the European Union as a jurisdiction with an adequate level of protection (Resolução CD/ANPD nº 32/2026), with a reciprocal decision by the European Commission. Transfers between Brazil and the European Union are therefore unrestricted: they require no standard contractual clauses and no additional safeguards.
Children and adolescents
Some workshops run with groups of young people. It is worth being precise about what the law says, because this subject is usually summarised wrongly.
Article 14 of the LGPD requires specific and prominent consent from at least one parent or legal guardian for processing the data of children, which the law defines as under 12. Adolescents, from 12 to 18, have graduated rights, and the ANPD's regulation on capacity to consent in that band has not yet been published. The LGPD does not fix a digital age of consent the way the GDPR does.
In practice we do not rely on that boundary. For any participant under 18, photography, recording and use of image require a guardian's authorisation, collected by the organisation hosting the group before the session. That is our own decision, stricter than the legal minimum, and it stays that way whatever the regulation eventually says.
At any age, processing follows the participant's best interest, and the information about what happens in the session is given in plain, accessible language.
Your rights
You can ask for confirmation of processing, access, correction of incomplete or outdated data, anonymisation or deletion, portability, information about who we share with, and withdrawal of consent. Under the GDPR the equivalent rights apply, including objection and restriction of processing.
Write to contato@ponte-em-cena.com.br saying what you are asking for. We reply within 15 days, the deadline in art. 19 of the LGPD. Brazilian law allows no extension, so we apply the same deadline to requests made under the GDPR, which would be more generous.
Requests about workshop material are passed to (in)PULSO, which holds the relationship with the participating groups. You do not need to know that in order to ask: write to the same address and we will pass it on.
If you are not satisfied, you can complain to the ANPD (Autoridade Nacional de Proteção de Dados, Brazil) or to the Autoriteit Persoonsgegevens (Netherlands).
Changes
This page is updated at the same moment the practice changes, never after. The date of the last update is in the footer. The project runs to December 2026; when it ends, we will publish here what happens to the material produced.
Responsibility for this page sits with Regen Studio, which operates the site. Questions, requests and complaints arrive at the address above and are passed to whoever is responsible in each case.