Privacy Policy

Last updated: October 30, 2026.

What changed in this version: we now use Google Ads to measure results (only with your consent) and we opened the email list through Kit.

This policy explains which personal data Outlets Abroad (outletsabroad.com) processes, why, and what your rights are, under the Lei Geral de Proteção de Dados (Brazilian General Data Protection Law; Lei nº 13.709/2018, LGPD).

1. Who is responsible

The data controller is Outlets Abroad. For any privacy matter, including exercising your rights (section 10), write to hello@outletsabroad.com. This email address is our communication channel with data subjects.

2. What data we process

• Browsing: we use Cloudflare Web Analytics to count visits in aggregate form (pages viewed, country, device type). It does not use cookies and does not create an individual profile of visitors. According to Cloudflare, Web Analytics stores nothing in the browser (cookies, localStorage), does not do "fingerprinting" and discards the IP address at the nearest data center.
• Technical security data: our hosting provider (Cloudflare) processes the IP address and request data to deliver the site and protect it against abuse.
• Email and city of interest: only if you sign up, tick the consent box and confirm your subscription in the email we will send you (double opt-in). The data goes straight to Kit, our email tool (section 5).
• Clicks on partner links: when you click a partner link, it first goes through a short redirect on our site (outletsabroad.com/go/…). We record only the date and time, the partner, the page on our site the click came from, the country and a label for the source of the visit: the channel (google_ads, organic, social, direct or other) and, when the page address contains them, the utm_source and utm_content fields, stored only as short labels from a fixed list (anything not on the list becomes "other"). We do not store your IP address, browser data, cookies or ad click identifiers (such as the gclid). The records are deleted after 90 days. Legal basis: legitimate interest (art. 7º, IX, of the LGPD).
• Google ads (only with your consent): when the ad is active and you accept the "Measurement and ads" category in the cookie notice, we load the Google tag (gtag.js) for Google Ads. It is used to find out whether someone who arrived through an ad signed up for the list or clicked a partner link (conversions). In that case, Google may collect and process: cookies and ad identifiers (such as the "_gcl_" cookies, which last 90 days according to Google); the ad click identifier (gclid), which comes in the page address; the address of the page visited; device and browser data; and your IP address, which Google uses, for example, to estimate approximate location and measure ad effectiveness. We do not store the gclid or these identifiers in our systems. If you decline, the ad tag is not loaded.

3. What we use it for and on what legal basis

• Sending the checklist, the guides and the deal alerts you asked for: legal basis of consent (art. 7º, I, of the LGPD). You can withdraw your consent at any time, through the unsubscribe link in every email or by writing to us.
• Measuring audience in aggregate form and keeping the site secure: legal basis of legitimate interest (art. 7º, IX, of the LGPD).
• Measuring the results of our Google ads (conversions) and allowing Google to show and evaluate the ads: legal basis of consent (art. 7º, I), given in the cookie notice. You can decline without losing access to anything on the site, and you can change your mind whenever you want in "Cookie preferences", in the footer (art. 18, VIII and IX).
• Strictly necessary cookies (for example, the one that stores your choice in the cookie notice): legal basis of legitimate interest (art. 7º, IX, and art. 10), because the site needs them to work and to respect your choice.

4. Who we share it with

We do not sell or rent your data. We work with:

• Cloudflare (hosting, security and visit statistics), which processes the data on our behalf (processor);
• Kit (Kit.com, formerly ConvertKit), the email sending tool, which processes the list data on our behalf (processor);
• Google (Google Ads), only if you accept "Measurement and ads". For Google Ads conversion measurement, Google acts as an independent controller: it decides how it uses this data, under its own privacy policy (https://policies.google.com/privacy) and the page "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites).

See section 6 (international transfer).

5. Email list (Kit)

When the list is open, you sign up through a form on our site, and the data goes directly to Kit. We collect: your email address, your city of interest (optional) and the record of your consent (date, time and the text you accepted). Kit also records technical data about the sign-up and, in emails, uses identifiers and pixels to know whether the message was opened and whether the links were clicked, according to Kit itself. Double opt-in: the sign-up only becomes valid after you click the confirmation link that Kit sends. If you do not confirm, you will not receive our emails. Unsubscribe: every email includes a one-click unsubscribe link, and you can also write to hello@outletsabroad.com. Legal basis: consent (art. 7º, I).

6. International transfer (United States)

Some providers process data outside Brazil, mainly in the United States: Kit says that it and its service providers process and store data on servers in the United States and in other countries; Google, when you accept ad cookies, may process data in the US and in other countries where it has facilities; and Cloudflare runs a global network. These transfers rely on the grounds in art. 33 of the LGPD: the ANPD's standard contractual clauses (Resolução CD/ANPD nº 19/2024; LGPD art. 33, II, b). You can ask for more information at hello@outletsabroad.com.

7. Affiliate links

Some links may be affiliate links. When you click, you go to the partner's site, which has its own privacy policy and may use cookies to record that the visit came from here. Learn more at How we make money (page in Portuguese). The addresses of our links may carry UTM parameters (for example, utm_source=instagram), which only say the channel and the post the click came from, and do not identify you.

8. How long we keep it

• Email (Kit): while you are subscribed. If you unsubscribe, we stop sending and remove the active record; we may keep only the minimum record of the unsubscription and of the consent given, so as not to send again and to prove the consent (art. 16, I, and art. 8º, §2º). Unconfirmed subscription: deleted after 30 days.
• /go clicks: deleted after 90 days.
• Your cookie choice: stored in your browser for 6 months. After that, we ask again.
• Google Ads cookies: according to Google, the "_gcl_" cookies last 90 days. How long Google keeps the data it receives is defined by Google itself (https://policies.google.com/technologies/retention).
• Cloudflare Web Analytics: according to Cloudflare, raw data is kept for 7 days and then aggregated; the dashboard shows the last 6 months.

9. How to decline or withdraw consent for cookies

You choose in the cookie notice, which appears on your first visit. You can change your choice whenever you want in "Cookie preferences", in the footer of every page: turning off "Measurement and ads" takes effect from that moment. You can also:

• adjust the ads you see on Google at https://adssettings.google.com;
• block or delete cookies in your browser settings. This is a complement: the main control is our preferences panel.

10. Your rights

Under art. 18 of the LGPD, you can request, at any time: (I) confirmation that we process your data; (II) access to it; (III) correction of incomplete, inaccurate or out-of-date data; (IV) anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; (V) portability; (VI) deletion of the data processed with your consent; (VII) information about who we share it with; (VIII) information about the possibility of not consenting and the consequences (here, declining cookies or not signing up does not prevent you from using the site); and (IX) withdrawal of consent. You can also object to processing carried out without consent, if it breaches the law (art. 18, §2º). Write to hello@outletsabroad.com; the request is free of charge (art. 18, §5º). For what Google processes as an independent controller, you can also contact Google directly. You can also file a petition with the ANPD and with consumer protection bodies (art. 18, §§ 1º and 8º).

11. Changes

If this policy changes, the date at the top will be updated. Relevant changes, such as opening the email list or starting to use ads, will be indicated here before they take effect. If the change affects something you consented to, we will notify you by email and you will be able to withdraw your consent (art. 8º, §6º).