Privacy Policy

This policy explains how Runa Books ("Runa", "we") handles personal data of visitors to readruna.com, under Brazil’s General Data Protection Law (LGPD — Law 13,709/2018) and applicable US state privacy laws.

1. Who we are

The data controller is Runa Books. Privacy contact: [email protected].

2. What we collect

Information you give us: name, email and — on the business form — company, team size and message.
Browsing data: pages viewed, traffic source (UTMs), device and browser type, collected through cookies and similar tech only if you allow it.
Security data: IP address and access logs kept by our hosting provider to prevent abuse.

We don’t collect sensitive data or payment details. Purchases happen on Amazon, under Amazon’s own privacy policy.

3. Why we use it

Send the free sample, newsletter and launch updates — consent.
Answer business inquiries — pre-contractual steps.
Measure traffic and improve the site — consent.
Measure and personalize ads (Meta, TikTok, Google Ads) — consent.
Security, fraud and spam prevention — legitimate interest.

4. Who we share it with

Only service providers that help us run the site: Railway (hosting and forms), Cloudflare (security, anti-spam and cookieless analytics, when enabled), Resend and FormSubmit (email delivery and forwarding forms to our team), Google, Meta and TikTok (only with your consent — for conversion measurement we send your email SHA-256 hashed, never in plain text), Microsoft Clarity (only with analytics consent). When you click "Buy on Amazon", Amazon handles your data under its own policy.

We do not sell your personal information. You can also opt out of targeted advertising at any time via "Cookie preferences" in the footer; we honor Global Privacy Control signals as an opt-out of marketing cookies.

5. International transfers

Some providers are located outside Brazil (mainly in the US). These transfers follow LGPD art. 33 with contractual and security safeguards.

6. Retention

Leads and subscribers are kept while there is engagement; contacts with no interaction for 24 months are deleted. Access logs are kept for 6 months.

7. Your rights

You may access, correct, delete, port or restrict your data and withdraw consent at any time by emailing [email protected]. We reply within 15 days. Every email has a one-click unsubscribe link.

8. Security

We use HTTPS/HSTS, security headers, anti-spam protection (Cloudflare Turnstile) and restricted data access. No system is 100% secure; if a significant incident occurs we will notify you and the authorities.

9. Children

This site is not directed at anyone under 18 and we don’t knowingly collect their data.

10. Changes

We may update this policy; the date of the latest version appears below. Material changes are emailed to subscribers.