What this policy covers.
This is the privacy policy for Blue Dragon Digital Marketing, a paid traffic management service based in Brasilia, Brazil.
It applies to visitors of bluedragon.digital and to clients who engage Blue Dragon for services. The policy is written in plain language. If something isn't clear, ask — the email is at the bottom of this page.
Blue Dragon operates under Brazilian data protection law (Lei Geral de Proteção de Dados, Federal Law 13.709/2018, LGPD). If you're located in a jurisdiction with equivalent laws — the European Economic Area under GDPR, the United Kingdom under UK GDPR, or similar — comparable rights apply and are respected.
The data controller.
Blue Dragon Digital Marketing is a sole-operator studio based in Brasilia, DF, Brazil. For the purposes of LGPD, BLUE DRAGON DIGITAL MARKETING LTDA is the data controller — the person who decides what personal data is collected and how it is used.
There is no separate legal entity, no processing team, no third-party data operator involved in the day-to-day. One person handles the work and one person handles the data.
The data.
Through this site
- Information you send through contact forms or email — name, email address, and any details about your business you choose to share.
- Server logs collected automatically for security and analytics — IP address, browser, referrer, pages viewed.
- Cookies and similar tracking, described in section 06.
Through client engagements
- Business information required to deliver services — billing details, tax identification, contact information for authorized representatives.
- Access credentials to advertising platforms (Google Ads, Meta Ads Manager, Google Analytics, tracker platforms). These are used only to manage the account.
- Campaign performance data from your accounts.
Blue Dragon does not collect sensitive personal data — health information, race, religion, sexual orientation, political views — except where a client's business itself operates in a health niche and the account handles that context by nature of the market it serves.
The purposes.
- To respond to inquiries and quote engagements.
- To deliver contracted services — managing your ad accounts, producing audits, sending reports.
- To meet legal and tax obligations under Brazilian law.
- To improve the operating method based on aggregate patterns across accounts — no individual client data is shared with other clients.
Information is not sold to third parties. It is not used for advertising or profiling. It is not shared beyond what is needed to operate the platforms your campaigns run on. There is no arrangement, direct or indirect, that monetizes visitor or client data outside the scope of the service being delivered.
Sub-processors in use.
To deliver services, Blue Dragon uses the following third-party platforms. Each has its own privacy policy — worth reading directly if the details matter to you.
- Google Ads and Google Analytics (Google LLC) — advertising platform, analytics.
- Meta Ads Manager (Meta Platforms, Inc.) — advertising platform for Facebook and Instagram.
- Google Tag Manager (Google LLC) — tag deployment for tracking setup.
- Email hosting — varies by engagement, disclosed on request.
- Communication tools — WhatsApp, email, video-call platforms as needed.
- Site hosting for this site.
When you interact with these platforms — either as a visitor to this site or as a client whose accounts run on them — data may be transferred to servers outside Brazil, primarily in the United States. Those transfers are covered by standard contractual clauses under LGPD and, where applicable, GDPR.
What this site puts on your device.
This site uses:
- Essential cookies for basic site functionality — session, security.
- Analytics cookies to understand how the site is used in aggregate.
The site does not use cross-site advertising trackers, retargeting pixels, or share visitor data with advertising networks. You can disable cookies through your browser settings. Doing so will not affect your ability to contact Blue Dragon.
Retention periods.
- Inquiries that don't lead to engagement: kept for up to 12 months, then deleted.
- Client records: kept for the duration of the engagement, plus five years after termination as required by Brazilian tax and civil law.
- Access credentials to your platforms: revoked within 7 days of the end of engagement, at your request or automatically.
You can request earlier deletion of any information for which no legal retention obligation applies. See section 10 for how.
Security measures.
Reasonable technical and organizational measures are used to protect information:
- Password manager with two-factor authentication for all platform access.
- Encrypted storage for client documents and reports.
- Limited access — only the operator has access to client data.
- Sensitive information exchanged over secure channels only.
No system is perfect. If a data breach occurs that affects your information, you will be notified within a reasonable time and, where required, Brazil's Autoridade Nacional de Proteção de Dados (ANPD) will be informed within the legal window.
What you can ask for.
Under Brazilian data protection law, you have the right to:
- Confirm whether Blue Dragon holds personal data about you.
- Access that data.
- Correct data that is incomplete, inaccurate, or out of date.
- Request anonymization, blocking, or deletion of unnecessary or excessive data.
- Request portability of your data to another provider.
- Be informed about with whom your data has been shared.
- Withdraw consent, where consent is the basis for processing.
- Object to processing that violates LGPD.
If you're located in the European Economic Area, the United Kingdom, or another jurisdiction with equivalent data protection laws, comparable rights apply — access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions. Requests are handled on the same terms regardless of which framework you invoke.
The process, in one email.
Send an email to mpj003ads@gmail.com with the subject line "Data request" and a short description of what you would like — access, correction, deletion, withdrawal of consent, or something else.
Requests are answered within 15 days, in line with LGPD. There is no charge to exercise these rights. Identity verification may be required for requests involving deletion or portability.
If you're not satisfied with the response, you have the right to file a complaint with Brazil's Autoridade Nacional de Proteção de Dados (ANPD), at gov.br/anpd.
When this page changes.
This policy may change as the service, the platforms in use, or the applicable laws change. The effective date at the top of this page indicates when the current version took effect. Material changes will be communicated to active clients directly. Previous versions are kept on file and available on request.
Where to reach us.
For any question about this policy, about the data Blue Dragon holds about you, or to exercise any of the rights listed above — one email address does all of it.