Privacy Policy

1. Controller and contact

On The Rock Capital Research determines the purposes of the processing described in this policy. Data-subject requests and privacy questions may be sent to ontherockcapital@gmail.com. Additional registration information will be incorporated when applicable.

2. Data processed and source

When you subscribe to the OTR Research Letter, we process the email address you provide, the date and wording of consent, the version of this policy, subscription status and the minimum technical records needed for security. We do not request sensitive personal data for this purpose.

3. Purposes and legal basis

We use this data to register and administer subscriptions, send requested editorial communications, prevent abuse and comply with legal obligations. Newsletter delivery is based on free, informed and unambiguous consent, which may be withdrawn at any time. We do not sell contact lists or expand the purpose without transparency and an appropriate legal basis.

4. Sharing, processors and international transfers

Newsletter subscriptions are received by a Cloudflare Worker and stored in Cloudflare D1. Data may also be processed by providers strictly necessary for security and, in the future, email delivery. Some providers may process data outside Brazil; applicable international-transfer mechanisms will be documented as necessary.

5. Retention and deletion

The email address is retained while the subscription remains active. After withdrawal, it will be deleted or blocked within a reasonable period, except where retention is strictly necessary to comply with a legal obligation, prevent fraud or exercise legal rights.

6. Data-subject rights

Within the limits of Brazil's LGPD, you may request confirmation and access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability when regulated, information about sharing and the consequences of refusing consent, as well as withdrawal of consent and deletion of data processed on that basis. Send requests to the contact above; we may request minimum information to verify the requester's identity.

7. Automated decisions and audience

We do not make automated decisions that produce significant effects on individuals in this version. The newsletter is not directed to children; if we identify a child's registration without the required authorization, we will take steps to remove it.

8. Security and incidents

We apply data minimization, HTTPS and access controls appropriate to the static service and newsletter database. No system is immune to incidents. Events presenting relevant risk or harm will be assessed, documented and, when required, reported to Brazil's ANPD and affected individuals.

9. Cookies and technical records

The static version does not use advertising cookies, behavioral profiling or sell data. The hosting provider may retain minimum technical security records under its own obligations and policy.

10. Withdrawal and changes

Until automatic unsubscribe links are implemented, consent may be withdrawn by emailing ontherockcapital@gmail.com. This policy may change to reflect operational or legal developments; the current version is shown above.