Privacy notice

Last updated: 8 October 2026

This notice explains how personal data is handled when you access and read our private proposals.

Who is responsible

The controller is EPIC DREAMS RACING LTDA, Brazilian company registration (CNPJ) 20.149.161/0001-59, operating as Epic Dreams. For privacy questions and requests about your personal data, contact we@epicdreams.racing. This is our designated privacy contact channel.

Information used by this platform

• A proposal identifier, an access-code label, a session identifier and dates associated with access and activity. Labels and sessions do not prove the reader's identity, and a shared code may be used by more than one person.
• Reading events, including sections viewed and active reading time, plus video interactions, contact-link clicks and PDF downloads where available. We do not record the contents of messages sent through external contact links.
• Browser information and, when supplied by the hosting provider, a country code. The analytics system does not perform additional IP geolocation.
• A network identifier generated from the IP address using a keyed cryptographic process. The application does not send the original IP address to its analytics service. This identifier is pseudonymised, not anonymous.

The hosting provider processes connection information, including IP addresses, to serve and protect the site. Hosting logs and analytics data are separate systems. After access, session replay records the proposal page and interactions, including scrolling, clicks and opening daily itineraries. The access screen is not recorded. Input fields are masked; console logs, network headers and request bodies are not recorded. Proposal content visible in the recording is processed by PostHog.

Why information is used

To control access to private proposals, operate and protect the platform, understand how a proposal is read and support relevant commercial follow-up. Access control, security and proportionate proposal reading analytics are based on our legitimate interests in protecting private content and understanding engagement with a proposal shared with you, balanced against your rights and reasonable expectations. When you request a proposal or services, necessary correspondence may also involve preliminary steps related to a contract at your request. Legal obligations may require specific records to be preserved. Entering an access code does not constitute blanket consent to data processing. You may contact us to object to reading analytics or ask about these purposes. No solely automated decisions with legal or similarly significant effects are made by this proposal platform.

Cookies

The platform uses a proposal-specific authentication cookie that lasts up to seven days. It is removed when you end your private session, and access can also be revoked by changes to the proposal's access configuration. It is not an advertising cookie. Reading events are sent by the application to its server; an analytics SDK records authenticated proposal navigation using in-memory identity persistence and temporary tab session storage, without adding an analytics identity cookie. Recordings are used to understand engagement and improve the proposal experience.

Service providers and sharing

The platform uses Vercel for hosting and PostHog for reading analytics and session replay. Providers may process connection or activity information as needed to provide their services. External contact or video services, when used, have their own privacy practices.

Proposal activity is used internally and may be shared with partners directly involved in the particular proposal, only to the extent necessary for its follow-up, preparation or delivery. It is not shared with unrelated clients or partners for their own marketing, and we do not sell these records. Information about the partners receiving your data is available through our privacy contact channel.

Hosting and analytics providers may process data outside Brazil. These operations are subject to the LGPD requirements for international transfers. You may ask us about the providers, processing locations and applicable transfer safeguards at we@epicdreams.racing.

How long information is kept

Session recordings are retained for up to 30 days under the current PostHog project configuration. Reading-event records have a separate retention period.

The authentication cookie lasts up to seven days. This does not determine how long server logs or analytics are retained. Our retention policy for identifiable or pseudonymised proposal reading records is up to 12 months from collection, followed by deletion or irreversible anonymisation. Reviews and deletion requests are handled through our privacy contact channel; automatic age-based deletion in the analytics provider is not currently enabled. The provider's query window is not a guarantee that underlying records have been deleted.

Hosting operational logs follow the hosting provider's applicable retention rules. Records necessary to comply with a legal obligation, a valid authority request or the exercise of rights may be preserved for the required period with restricted use. Irreversibly anonymised statistics may be kept longer because they no longer identify a person. You can request deletion before the standard period expires, subject to applicable legal exceptions.

Your rights under the LGPD

As applicable, you may request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, and portability subject to applicable rules. You may ask about organisations with which data is shared, the consequences of refusing consent where it is requested, and revoke consent or request deletion of data processed on that basis, subject to lawful retention exceptions.

You may also object to processing that does not comply with the law and request review and information about solely automated decisions affecting your interests. Requests to exercise these rights are free of charge. We may need proportionate information to locate the relevant records and verify that they relate to you.

Send requests to we@epicdreams.racing. You can also contact the Brazilian Data Protection Authority (ANPD).

Protection and updates

Private proposal pages and assets require proposal-scoped authorisation. Session cookies are signed and HttpOnly. These measures reduce risk but do not make personal data anonymous or eliminate all security risks. This notice will be updated when relevant practices change.