Legal
Privacy Policy
Effective October 11, 2026
This policy explains what personal data The Copy Noir collects on thecopynoir.com, in our emails and when you buy from us: why we collect it, who receives it, how long we keep it, and what you can do about it.
The short version
- If you request Module 1 by email, we collect your email address and, if you give it, your first name, and add you to our email list. You can unsubscribe at any time.
- We use the Meta Pixel and Meta's Conversions API to measure our ads and decide who sees them. That involves cookies, your IP address, your browser details and, after you sign up, a hashed version of your email address (a one-way code, not the readable address).
- Visitors in the EU, EEA, UK and Switzerland: nothing advertising-related runs on our site until you click Accept.
- If your browser sends a Global Privacy Control signal, the Meta Pixel stays off.
- Payments happen on Hotmart's checkout. We never see your card number.
- We don't sell your personal data for money.
- You can ask for a copy of your data, or ask us to correct or delete it, at support@thecopynoir.com.
Who is responsible for your data
The controller of your personal data is Cunha e Mariano Cursos para Concursos Ltda, CNPJ 65.376.101/0001-07, Rua Pais Leme, 215, Conj. 1713, Pinheiros, São Paulo – SP, 05424-150, Brazil, which runs The Copy Noir ("we", "us", "our").
Privacy contact and LGPD channel: support@thecopynoir.com. This is our channel for data-subject requests under Brazil's General Data Protection Law (LGPD), as provided for small processing agents by ANPD Resolution CD/ANPD No. 2/2022. Anyone can use it, wherever they live.
What we collect
Information you give us
- Module 1 email form: your email address and, if you give it, your first name. We also record the date, time and IP address of your sign-up as proof of your consent, and the campaign that brought you (for example, which ad you clicked).
- Emails to us: your name, your email address and whatever you write. Please don't send card numbers or sensitive information by email.
- Refund and withdrawal requests: your name, the email address you used at checkout, your transaction number and anything you choose to tell us.
Information we receive from Hotmart when you buy
- Your name, email address, country and, if you gave it at checkout, your phone number.
- Order details: transaction number, product, price, currency, date, payment method type and status (paid, pending, refunded or disputed).
- The campaign information and visitor ID attached to the checkout link (see below).
We don't receive your full card number, security code or other payment credentials. Hotmart handles those.
Information collected automatically
- Device and connection data: IP address, browser and device type (the "user agent"), language, the pages you visit, the page that sent you here, and the date and time. Our host, Cloudflare, works out your approximate location (country) from your IP address. We use your country to decide whether to show the consent banner.
- Campaign information: if you arrive from an ad or a tagged link, we save the campaign tags in that link (utm_source, utm_medium, utm_campaign, utm_content, utm_term and src) and Meta's click ID (fbclid). We add them, with your visitor ID, to the checkout link so we can tell which ad led to a sale. We never put your name or email address in a link.
- Visitor ID: a random code stored in the noir_vid cookie. It isn't based on your name or email. It lets us connect a visit to a later checkout and avoid counting the same event twice.
- Meta Pixel: a small piece of Meta code on our pages. It sets the _fbp and _fbc cookies and sends Meta three standard events (a page view, a view of the offer and a sign-up, called Lead) and a few custom events about how you use the page: clicking a buy button, turning the X-Ray on or off, opening an X-Ray note or the "Ruin it" demo, choosing a module stop and answering the headline quiz. These custom events are sent from your browser only. Each event carries the page address, the referring page and your browser details. We have switched off the Pixel's automatic collection of button clicks and page details. If you are logged in to Facebook or Instagram in the same browser, Meta may connect these events to your account.
- Meta Conversions API: our server sends Meta a copy of the same events, so they still count when the Pixel is blocked. Each copy includes the event name and ID, the time, the page address (with any personal data removed), your IP address, your user agent, the _fbp and _fbc values and, for sign-ups, your email address hashed with SHA-256 before it leaves our server. Meta uses the shared event ID to count each event only once.
- Email activity: our emails, sent through MailerLite, contain a small image and tracked links that tell us whether an email was opened and which links were clicked. We use this to stop writing to people who aren't reading and to learn which emails are useful. Most email apps let you block images, which turns open tracking off.
What hashing means. Hashing turns your email address into a fixed string of characters that can't be turned back into the address. Meta compares it with hashes it makes from addresses it already holds, to match an event to an account. Hashed data is still personal data under laws such as the GDPR and the LGPD, and we treat it that way.
The checkout. Checkout and purchase events are measured on Hotmart's checkout by Hotmart's own Meta Pixel and Conversions API integration, which we set up in Hotmart. That runs on Hotmart's pages, under Hotmart's privacy policy and cookie settings. Your choices on thecopynoir.com don't carry over to it.
What we don't collect
We don't ask for sensitive personal data, such as health, religion, ethnicity, sexual orientation, political views, biometrics, financial account numbers or government ID numbers, and we don't send that kind of data to Meta.
Do you have to give us your data?
No law or contract requires you to. Some data is needed for what you ask us to do: without an email address we can't send you Module 1, and without the details the checkout asks for, Hotmart can't process your order. Saying no to ad cookies, or opting out, changes nothing about how the site works for you.
How we use your data, and our legal bases
| What we do | Data used | Legal basis (GDPR / LGPD) |
|---|---|---|
| Send you Module 1 and the email that delivers it | Name, email | Taking the steps you asked for (GDPR Art. 6(1)(b); LGPD Art. 7, V) |
| Send our emails on persuasion and copywriting, including occasional offers for our paid products | Name, email, sign-up record, campaign information, email activity | Your consent, which you can withdraw at any time (GDPR Art. 6(1)(a); LGPD Art. 7, I) |
| Deliver the Product, answer support requests, honor the guarantee, and handle refund and withdrawal requests | Order details, name, email, your messages | Performing our contract with you (GDPR Art. 6(1)(b); LGPD Art. 7, V) |
| Stamp your copy of the Product so a leaked copy can be traced to its license | Email or other checkout details | Performing our contract and our legitimate interest in protecting our work (GDPR Art. 6(1)(b) and (f); LGPD Art. 7, V and IX) |
| Measure our ads, decide who sees them (including showing our ads to people who visited our site), and improve them | Cookies, IP address, user agent, events, hashed email, visitor ID, campaign information | EU, EEA, UK and Switzerland: your consent (GDPR Art. 6(1)(a) and local cookie laws). Elsewhere: our legitimate interest in measuring and running our advertising, with an opt-out at any time (GDPR Art. 6(1)(f) where it applies; LGPD Art. 7, IX) |
| Keep the site secure and working, and block bots, spam sign-ups and abuse | IP address, user agent, security cookie | Our legitimate interest in security (GDPR Art. 6(1)(f); LGPD Art. 7, IX) |
| Keep tax and accounting records, respond to chargebacks and disputes, and comply with the law | Order details, your messages | Legal obligation and the exercise of legal rights (GDPR Art. 6(1)(c) and (f); LGPD Art. 7, II and VI) |
If you buy. We mark your email address in MailerLite as a buyer, so we stop pitching you what you already own and can send you emails about your purchase, such as access help and corrections. We send buyers marketing emails only where the law allows it, and every marketing email has an unsubscribe link.
Automated decisions. We don't make decisions about you based only on automated processing that have legal or similarly significant effects. Meta's systems decide which ads to show to whom, under Meta's own policies.
Our emails
When you request Module 1, you also join our email list. We use single opt-in: you are added as soon as you send the form. Every marketing email we send:
- says it is from The Copy Noir and gives our legal name and postal address;
- has a working unsubscribe link; and
- stops for you once you unsubscribe. Link unsubscribes take effect right away. Unsubscribe requests sent by email are applied within 10 business days at most, and usually much sooner.
We never add you back after you unsubscribe. These rules follow the US CAN-SPAM Act and Canada's Anti-Spam Legislation (CASL), and we apply them to everyone.
Cookies and similar technologies
Cookies are small text files a website stores in your browser. Session storage is similar, but it is cleared when you close the tab. This is everything we use on thecopynoir.com.
| Name | Set by | What it does | Type | How long |
|---|---|---|---|---|
| noir_consent | Us | Remembers your privacy choice (Accept, Reject or Opt out) | Strictly necessary | 6 months |
| noir_geo | Us | Remembers your country code and whether the consent banner applies to you, so we don't look it up on every page. Session storage | Strictly necessary | Until you close the tab |
| noir_xr | Us | Only on pages with the X-Ray switch: remembers whether you turned it on. Session storage | Strictly necessary | Until you close the tab |
| __cf_bm | Cloudflare | Tells people apart from bots, to protect the site | Strictly necessary | 30 minutes |
| noir_vid | Us | Random visitor ID. Connects a visit to a later checkout and helps avoid double counting. Cookie, with a session-storage copy | Ad measurement | 1 year (cookie); until you close the tab (session storage) |
| noir_utm | Us | Keeps the campaign tags and Meta click ID from the link you arrived on, so they can be passed to the checkout. Session storage, with a cookie as a fallback | Ad measurement | Until you close the tab (session storage); 30 days (cookie) |
| _fbp | Meta Pixel, on our domain | Identifies your browser to Meta for ad measurement and delivery | Advertising | 90 days |
| _fbc | Meta Pixel or our site, on our domain | Stores the click ID when you arrive from a Meta ad, to connect the visit to that ad | Advertising | 90 days |
Strictly necessary items run for everyone, because the site can't work safely without them. Everything marked ad measurement or advertising follows your choice under Your privacy choices.
Meta may also read or set cookies on its own domains, such as facebook.com, if you use Facebook or Instagram. Those are covered by Meta's cookie policy. Hotmart's checkout uses its own cookies, covered by Hotmart's policies. We don't load MailerLite scripts or cookies on our site: the email form sends your details to our own server first.
Your privacy choices
The Privacy choices link at the bottom of every page opens a panel where you can make or change your choice at any time.
- EU, EEA, UK and Switzerland: the Meta Pixel, the Conversions API, noir_vid and noir_utm stay off until you click Accept. Reject is as easy as Accept, and the site works the same either way. If we can't tell where you are, we treat you as if you were in one of these countries.
- Everywhere else: these tools run by default. Choose Opt out in the panel and we turn them off for that browser: the Pixel stops loading and our server stops sending your events to Meta.
- Global Privacy Control: if your browser sends a GPC signal, the Pixel doesn't load and our server doesn't send your events to Meta, wherever you are.
- Limited Data Use: for visitors outside the consent countries, we switch on Meta's Limited Data Use setting. Meta applies it to people in the US states where it offers it, and it restricts how Meta may use data from our site.
Your choice is saved in the noir_consent cookie, so it applies to that browser on that device. If you clear your cookies or switch browsers, choose again. It covers thecopynoir.com only: Hotmart's checkout runs its own measurement under its own settings.
Other ways to limit ads based on your activity:
- Meta: Ad preferences in your Facebook or Instagram settings, or facebook.com/adpreferences.
- United States: the Digital Advertising Alliance at aboutads.info/choices.
- EU and UK: youronlinechoices.eu.
- Your browser: block or delete cookies in its settings.
Opting out doesn't mean you'll see fewer ads. It means the ads you see won't use data from our site.
Who we share data with
We share personal data only with the companies that help us run The Copy Noir, and only what each one needs.
- Meta Platforms (Meta Platforms, Inc., USA; for people in the EU, EEA, UK and Switzerland, Meta Platforms Ireland Ltd.). Receives Pixel and Conversions API data to measure our ads, decide who sees them and improve their delivery. For people in the EU, EEA, UK and Switzerland, we and Meta are jointly responsible for collecting this data and sending it to Meta, under Meta's Controller Addendum. What Meta does with it afterwards is Meta's responsibility, under Meta's Privacy Policy.
- Hotmart (for purchases outside Brazil, Hotmart BV, the Netherlands; the Hotmart company is named at checkout). Runs the checkout, takes your payment, applies taxes, delivers your access and processes refunds and disputes. It is an independent controller of the data you give at checkout, under its own privacy policy. We send it the campaign information and visitor ID in the checkout link, and it sends us your order details.
- MailerLite (MailerLite, Inc., USA). Our email service provider. It stores our list and sends our emails on our behalf, under a data processing agreement.
- Cloudflare (Cloudflare, Inc., USA). Hosts the site, delivers it quickly and securely, runs our small server functions (email sign-up and the Conversions API), checks for bots, and routes email sent to our addresses. It acts on our behalf.
- Our email inbox provider, which stores the support and privacy emails that reach us. It acts on our behalf.
- Advisers and authorities: our accountants and lawyers when needed, and public authorities or courts when the law requires it.
- A new owner: if The Copy Noir is sold or merged, personal data may pass to the new owner, who must respect this policy.
We don't sell personal data for money. See United States for how some US laws describe ad pixels.
International transfers
We are based in Brazil. The companies we use process data in the United States, the European Union and other countries, whose data protection laws may differ from yours. When personal data moves between countries, we rely on the safeguards the law provides, such as:
- an adequacy decision, where the destination country is recognized as protecting personal data adequately;
- the provider's certification under a recognized framework, such as the EU-U.S. Data Privacy Framework, where it has one;
- standard contractual clauses approved by the relevant authority, including, for data sent from Brazil, the clauses approved by Brazil's ANPD; and
- for data sent from Brazil, the other grounds Article 33 of the LGPD allows, such as a transfer needed to perform our contract with you.
To ask which safeguard covers a given provider, write to support@thecopynoir.com.
How long we keep data
| Data | How long |
|---|---|
| Email list: name, email, sign-up record, campaign information, email activity | Until you unsubscribe, or until we remove you for not opening our emails. After you unsubscribe, we keep your email address on a do-not-email list so we never write to you again. |
| Sign-ups that couldn't reach our email service at the moment you sent the form | Held only until they are added to the list, and deleted within 60 days at most |
| Orders, refunds, withdrawal requests and disputes | 5 years after the end of the year of purchase, to meet Brazilian tax and accounting rules and handle possible legal claims |
| Support emails | Up to 2 years after the conversation ends, or longer if needed for a legal claim |
| Events sent to Meta | Our server forwards them and doesn't keep a copy beyond short-lived technical logs. Meta keeps event data under its own terms. |
| Cookies and session storage | See the cookie table |
| Cloudflare security and traffic logs | Short periods set by Cloudflare |
Your rights
Wherever you live, you can ask us to:
- tell you whether we hold personal data about you, and give you a copy;
- correct data that is wrong or incomplete;
- delete your data (we may keep what the law requires, such as tax records, and your email address on our do-not-email list);
- stop sending you marketing emails (use the unsubscribe link or write to us); and
- withdraw any consent you gave us, at any time. This doesn't affect what we did before you withdrew it.
EU, EEA, UK and Switzerland (GDPR)
You also have the right to restrict our processing, to receive your data in a portable format, and to object to processing based on our legitimate interests. You can always object to direct marketing, and we will stop. You can complain to the data protection authority where you live or work, or where you believe an infringement happened. In the UK, that is the Information Commissioner's Office (ico.org.uk).
Brazil (LGPD)
Under Article 18 of the LGPD, you can ask for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD;
- portability of your data to another provider;
- deletion of data processed with your consent;
- information about the public and private entities we share your data with;
- information about your option not to give consent, and what happens if you don't; and
- withdrawal of your consent.
You can also object to processing that doesn't comply with the LGPD, and petition the ANPD, Brazil's national data protection authority (gov.br/anpd). Our channel for these requests is support@thecopynoir.com.
How to make a request
Email support@thecopynoir.com from the address your request is about, with "Privacy request" in the subject line. We may ask you to confirm it's you before we act, and we use any extra information only for that check. Requests are free.
We confirm that we received your request within 2 business days and answer it in full within 15 days. If the law where you live allows more time for a complex request, we will tell you within those 15 days, explain why, and still finish within that legal limit.
United States
This section covers the California Online Privacy Protection Act (CalOPPA) and similar notice rules.
What we collect and who receives it. We collect identifiers (name, email address, IP address, visitor ID, cookie IDs, hashed email), commercial information (what you bought, refunds and disputes), internet activity (pages visited, referring page, ad clicks, campaign tags, email opens and clicks) and approximate location (country, from your IP address). We receive them from you, from your browser and from Hotmart, and we disclose them only to the recipients listed under Who we share data with.
Third-party tracking. Third parties do collect information on our site. Meta collects information about your activity here through the Pixel and may combine it with your activity on other websites and apps over time. Hotmart's checkout runs its own measurement. You can turn this off on our site under Your privacy choices.
Do Not Track. Some browsers send a "Do Not Track" signal. There is no common standard for how websites should respond to it, so we don't change what we do when we receive one. We do respond to Global Privacy Control, as described under Your privacy choices.
State privacy laws. Comprehensive state privacy laws, such as the California Consumer Privacy Act, apply only to businesses above certain size thresholds. Some of them treat the use of ad pixels as "selling" or "sharing" personal data. Whether or not a given law applies to us, you can turn our ad measurement off at any time with the Privacy choices link or a Global Privacy Control signal, and you can ask us for access, correction or deletion as described under Your rights.
Reviewing and changing your information. You can review or update the information we hold about you by writing to support@thecopynoir.com. You can update your email preferences with the link in any of our emails.
Children
The site and the Product are for adults 18 and over. We don't knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, email support@thecopynoir.com and we will delete it.
Security
We use HTTPS across the site, keep our access keys in encrypted storage, limit access to personal data to the people who need it, hash email addresses before sending them to Meta, and never handle card details ourselves. No system is perfectly secure. If a breach affects your personal data in a way that puts you at risk, we will tell you and the authorities when the law requires it.
Changes to this policy
We will post any update on this page with a new effective date. If a change is significant, such as a new use of your data or a new type of recipient, we will also announce it on the site or email our list before it takes effect. Where the law requires your consent to a change, we will ask for it.
Contact us
Privacy questions and requests, including LGPD requests: support@thecopynoir.com
Everything else: support@thecopynoir.com
By post: Cunha e Mariano Cursos para Concursos Ltda, CNPJ 65.376.101/0001-07, Rua Pais Leme, 215, Conj. 1713, Pinheiros, São Paulo – SP, 05424-150, Brazil
We answer within 2 business days. Privacy requests are answered in full within 15 days, as explained in How to make a request.