Privacy policy

Terral Surf Club is the controller of the data described here: it decides what data is collected and why. The site is published at https://terralsurfclub.com.br.

• Name, email and phone number, which you provide in the membership form.
• Plan and surf level, chosen in the same form.
• A record of your consent: the date and time you accepted, the version of this policy, and the IP address and browser used. This is the proof that consent was given, which the controller is required to keep under Art. 8, §2 of the LGPD.
• Approximate location — city, state, country and time zone — derived from your IP by our hosting infrastructure when you submit the form. It goes into the internal notice the club receives, to give context to whoever gets back to you, and is not stored in your member record. It really is approximate: on a mobile network it usually points to your carrier's exit city, not yours.
• Date of your last visit to the member area.

We don't ask for any tax ID, address, identity document or payment details, and there is no password — you sign in with a code sent to your email or given to you by the club. The site uses no advertising or cross-site tracking cookies, and the location above is not looked up with any outside service: it already comes in the hosting headers, so your IP is never sent to a third party to be geolocated.

Contacting you about club membership, sending your access code, and keeping you posted on beach conditions.

The legal basis is your consent (Art. 7, I of the LGPD), given when you check the box in the form. You can withdraw it at any time — see “Your rights” below.

No one, for commercial purposes. Your data is never sold or handed over. It passes through three service providers that run the site's infrastructure, each with only what it needs:

• Vercel — website hosting.
• Upstash — the database where your member record is stored.
• Resend — delivery of access-code emails and notifications to the club.

These services may process data outside Brazil. That is an international transfer, permitted under Art. 33, VIII of the LGPD when it follows from the specific consent you gave when joining.

For 24 months from your last interaction with the club — every visit resets the clock. After that period without use, your record is deleted. The exact date is shown in your member area.

Blocking an account does not delete anything: the record is kept and access to the member area stops working. Only deletion erases the data, and deletion is permanent.

One first-party cookie, not for advertising — plus one preference.

The spshore_sessao cookie is set when you sign in with your access code. It holds only your session ID, signed by the server, so the site knows it's you from one page to the next. It is httpOnly (no script on the page can read it) and expires on its own — after 30 days for members and 12 hours for administrators. Signing out deletes it immediately.

When you pick a language with the flag switch, a spshore_idioma cookie remembers that choice for a year. It stores only pt or en.

The site also uses Vercel Web Analytics, which counts visits in aggregate, with no cookie and without identifying who visited.

If you are not signed in, a beach page may show an ad labeled Sponsored. It is built by the site itself: it loads no script, cookie or content from the advertiser, and the advertiser receives none of your data. We only count how many times each ad was shown and clicked, as a daily total. When you click, your IP is used for one hour to limit repeated clicks, and is not stored alongside the count.

Article 18 of the LGPD gives you, among others, the right to confirm that your data is being processed, to access it, to correct it, to request its deletion and to withdraw your consent. In practice:

• Access: sign in to your member area — everything we keep is there, including your consent record.
• Correction and deletion: ask through the contact below. Deletion erases your entire record and ends your access.
• Withdrawing consent: has the same practical effect as deletion, since consent is the only basis for processing.

Requests and questions about this policy: contato@terralsurf.com. We reply within 15 days.

This policy is about personal data, and nothing else. What the club publishes about the ocean — beach ratings, forecasts, tides and the alerts sent by email or notification — is information to help you plan, not clearance to go in the water.

Forecasts can be wrong, ratings are recalculated in real time, and the ocean changes between the moment an alert is sent and the moment you paddle out. Going in the water is each person's own decision and responsibility: whoever goes in assesses the beach on site, their own readiness that day, the posted signs and the lifeguards' guidance. Terral Surf Club does not supervise, monitor or take responsibility for what happens in the water.

Every version has a date, and the version you accepted is recorded in your member record. If we change anything material — new data, a new purpose, a new kind of sharing — the version goes up and we ask for your consent again. The current version is 2026-09-13.