Privacy Policy
Last updated: October 23, 2026
This policy explains what personal data AI Rankings (oquark.io/ai-rankings) handles, why, on which legal basis, who we share it with and how long we keep it. It covers the whole site and each of its forms. It follows Brazil's data protection law (LGPD).
1. Who the controller is
AI Rankings is an OQuark product. The controller of the personal data handled on this site (LGPD, art. 5, VI) is GUSTAVO AUGUSTO HANUM SARDINHA, an individual, operating under the OQuark brand.
- Business address: Av. 136, 761, Goiânia - GO, Brasil, CEP 74093-250
- Privacy contact: contato@oquark.io
- Data protection officer (DPO): none appointed. As a small-scale processing agent, the controller is exempt from appointing a DPO (ANPD Resolution CD/ANPD No. 2/2022, art. 11). Data subjects' requests and questions are handled through contato@oquark.io
2. General rules
- Each form asks only for what it needs for the purpose described below
- We don't handle sensitive personal data and we don't make automated decisions about you based on your data
- We never sell personal data or use it for third-party advertising
- The editorial ranking uses no visitor's personal data
3. What we handle in each form
For each form or flow on the site: the data, the purpose, the legal basis under the LGPD, who handles the data on our behalf (processors) and how long we keep it.
Newsletter
- Data
- E-mail, language, the page you signed up from, date and version of your consent and the status of your subscription (pending, confirmed or unsubscribed), with the confirmation and unsubscribe dates. The confirmation link code is stored only as a hash.
- Purpose
- Confirm your subscription (double opt-in), send the weekly newsletter and prove your consent.
- Legal basis
- Consent (art. 7, I), given in the form's checkbox and revocable at any time through the unsubscribe link in every e-mail.
- Processors
- Supabase (subscription and consent record); Resend (confirmation and welcome e-mails); Kit, when it sends the newsletter in your language (it receives only your e-mail and language and sends the confirmation and the issues); Vercel (hosting).
- Retention
- While your subscription is active. After you unsubscribe, we stop sending and keep only the e-mail, dates and version of your consent and of your unsubscribe request, for as long as needed to prove both. The confirmation link expires in 7 days.
Tool submission (/submit)
- Data
- Tool name and website, suggested use case, short description, contact e-mail, form language and the version of the consent you accepted.
- Purpose
- Review the submission in our editorial triage. We don't use the e-mail for marketing.
- Legal basis
- Consent (art. 7, I), given in the form's checkbox.
- Processors
- GitLab (each submission becomes a confidential issue in the AI Rankings project; the e-mail is masked in the body and shown in full only in an internal comment, visible to project members); Vercel (hosting).
- Retention
- While the submission is under review. Once review is done, the editor deletes the issue on GitLab, and the submission data is deleted with it.
Advertising checkout (/advertise)
No paid format is on sale today, so this form does not appear on the site. Checkout only works in Stripe test mode, with no real charge.
- Data
- E-mail, tool name and website, chosen package and language. On the payment page, Stripe itself collects the payment details; we never receive or store card data.
- Purpose
- Open the payment, record the order and reach you at the e-mail you gave to get the ad's logo, copy and category.
- Legal basis
- Performance of a contract and pre-contractual steps at your request (art. 7, V); compliance with a legal obligation, for keeping the order's tax records (art. 7, II); exercise of legal rights, for defense in any legal proceeding (art. 7, VI).
- Processors
- Stripe (payment and a customer record with your e-mail); Vercel (hosting; the completed-order notice goes to the server logs with the e-mail masked).
- Retention
- Order and payment data: 5 years after purchase (Brazilian Consumer Code, art. 27; Civil Code, art. 206, § 5, I; tax law). Server logs: for Vercel's log retention period.
Template checkout (/templates)
No template is on sale today, so this form does not appear on the site. Checkout only works in Stripe test mode, with no real charge.
- Data
- E-mail, chosen template and language. On the payment page, Stripe itself collects the payment details; we never receive or store card data.
- Purpose
- Open the payment, record the order and send the template package to the e-mail used at checkout, from contato@oquark.io.
- Legal basis
- Performance of a contract and pre-contractual steps at your request (art. 7, V); compliance with a legal obligation, for keeping the order's tax records (art. 7, II); exercise of legal rights, for defense in any legal proceeding (art. 7, VI).
- Processors
- Stripe (payment and a customer record with your e-mail); Vercel (hosting; the completed-order notice goes to the server logs with the e-mail masked).
- Retention
- Order and payment data: 5 years after purchase (Brazilian Consumer Code, art. 27; Civil Code, art. 206, § 5, I; tax law). Server logs: for Vercel's log retention period.
E-mail contact and interest lists
- Data
- Your e-mail and whatever you write in your message to contato@oquark.io, including requests to join the interest list for paid formats or templates.
- Purpose
- Reply to your message and, for interest lists, let you know when the format or template opens.
- Legal basis
- Pre-contractual steps at your request (art. 7, V); legitimate interest in replying to people who write to us (art. 7, IX).
- Processors
- The provider that hosts the contato@oquark.io mailbox, which handles messages only to deliver and store them.
- Retention
- Messages: 5 years. Interest lists: until the format or template opens plus 12 months, or until you ask to leave.
Browsing the site
- Data
- Technical data about each request, such as IP address, browser, page visited and time, in the hosting logs. Aggregate audience measurement by Vercel Web Analytics, without cookies: page views and the tool-click, newsletter sign-up and checkout-start events, which never carry your e-mail. Your IP is also kept in memory to limit excessive sign-ups and submissions.
- Purpose
- Keep the site running, prevent abuse and measure audience in aggregate.
- Legal basis
- Legitimate interest (art. 7, IX).
- Processors
- Vercel (hosting and access logs); Vercel Web Analytics (audience measurement).
- Retention
- Access logs: for Vercel's log retention period. IP used for the sign-up limit: in memory only, for up to 1 hour. Audience measurement: aggregate data only, in the Vercel dashboard.
4. Cookies
- The site uses no advertising or analytics cookies. Vercel's audience measurement works without cookies
- The site's only cookie is NEXT_LOCALE, which remembers the language (Portuguese or English) when it differs from your browser's language or when you switch languages. It is a session cookie and does not identify you
- The payment page belongs to Stripe, runs on Stripe's domain and uses Stripe's own cookies, governed by Stripe's privacy policy
5. Processors: who we share data with
We only share data with the providers below, which handle it on our behalf and only for the purposes in this policy:
- Vercel (US): site hosting, access logs and Vercel Web Analytics
- Supabase (US): database of newsletter subscriptions
- Resend (US): newsletter confirmation and welcome e-mails
- Kit (ConvertKit, US): newsletter delivery, when enabled for the language
- GitLab (US): confidential queue of tool submissions
- Stripe (US): checkout payments, currently in test mode only
Apart from these processors, we only hand data over to public authorities, under a court order or a legal obligation.
6. International transfer
The processors listed above (Vercel, Supabase, Resend, Kit, GitLab and Stripe) are headquartered in the United States and may handle your data outside Brazil. These international transfers rely on LGPD art. 33, under the contractual data protection clauses and safeguards each provider offers in its terms of service and data processing terms.
7. Security
- All site traffic is encrypted (HTTPS)
- Access keys to the processors stay on the server and never appear in logs
- The newsletter confirmation link code is stored only as a hash
- E-mails appear masked in server logs (for example, jo***@example.com)
- Tool submissions are kept in confidential issues, with the full e-mail only in an internal comment
- No system is completely secure. If an incident may bring you relevant risk or harm, we will notify you and the ANPD (LGPD, art. 48)
8. Your rights
At any time and free of charge, you can ask for: confirmation that we handle your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data handled based on consent; information on who we share it with; and withdrawal of consent (LGPD, art. 18). You can also object to processing based on legitimate interest and file a complaint with the ANPD, Brazil's data protection authority.
To exercise your rights, write to contato@oquark.io. We reply within 15 days. To leave the newsletter, use the unsubscribe link in any e-mail.
9. Changes
This policy may be updated. The current version is always on this page, with the date of the last update.