Privacy Policy

The controller of the personal data described here is DADO NECESSÁRIO: razão social completa, registered under CNPJ DADO NECESSÁRIO: CNPJ, at DADO NECESSÁRIO: endereço completo.

Under Article 41 of the LGPD the controller must name a data protection officer. Ours is Willian Magalhães Marchi, co-founder and co-CEO of Nebuloz, appointed on a provisional basis and reachable at privacy@nebuloz.ai.

You may have answered an assessment through a link you received, or taken part in a recorded and transcribed meeting at an organization that uses our products. In those cases it was that organization, not Nebuloz, that decided to collect your data, for what purpose and for how long. It is the controller; we process the data on its behalf, as processor, under Law 13.709/2018 (LGPD).

In practice: to ask for confirmation, access, correction, deletion or portability of your data, contact the organization that invited you or ran the meeting. It decides the request.

If you prefer to write to us, write to privacy@nebuloz.ai. Within 5 business days we forward your request to the responsible organization and tell you that we forwarded it, and to whom. We do not decide the merits, because that decision is not ours to make.

There are processing activities where Nebuloz is the controller — the operation of our website, the platform's security records and our sales contact. For those, the request comes straight to us, and we answer.

Right now, one thing: a first-party cookie named Next-Locale, which remembers the language you were served. It carries no identifier and is not used for analytics. Measured on a running build: no other cookie and no local storage entry. One request does leave for a third party — the Vercel Web Analytics script, described below.

Aggregate page views, through Vercel Web Analytics. It is cookieless: nothing is written to your browser and you are not given an identifier. Vercel derives a short-lived, non-reversible hash from the request to tell one visit from another within a day, and that is the whole of it. Product analytics that would identify you — PostHog, Google Analytics — is not loaded on this site, and cannot be: see packages/analytics/marketing-provider.tsx.

Requesting the assessment, through the form on the /book page: your name, your work email address, your company and, if you choose one, the product you are interested in, from a closed list. We do not ask for a tax ID, job title, phone number or a free-text message. A collection notice is shown above the submit button; there is no consent checkbox, because this processing does not rest on consent (see the next section).

To keep automated submissions out, the form has a hidden field — a request that arrives with it filled in is discarded without anything being recorded — and a limit on submissions per IP address. Your IP address is not stored for that limit: we keep only a keyed code derived from it (HMAC), which does not allow the address to be recovered and is deleted within 48 hours.

After you submit, the request enters Nebuloz's sales pipeline, in our internal system. No automatic email is sent to the address you typed, and no email carrying your details is sent to our sales team. Your details are not added to any marketing list. Our audit trail records that a request arrived, the version of the collection notice that was on screen and the language, without your name, email address or company.

Server logs kept by our hosting provider, which include IP address, user agent and requested path.

• We do not run advertising or cross-site tracking.
• We do not buy or sell personal data.
• We do not ask for, and you should not send, sensitive personal data as defined in Article 5 II of the LGPD.

Replying to you when you request the assessment, and conducting the sales conversation that follows: legitimate interest — LGPD Article 7 IX and Article 10 I — together with preliminary steps toward a contract at your request — LGPD Article 7 V; GDPR Article 6(1)(f) and 6(1)(b). It is not consent: you asked to be contacted, and that is why the form has no checkbox.

Keeping the site secure and available, including logs and the per-IP submission limit: legitimate interest — LGPD Article 7 IX, GDPR Article 6(1)(f).

Counting visits, through cookieless analytics: legitimate interest — LGPD Article 7 IX. No processing on this site rests on consent, which is why you are not asked for any and why there is no cookie banner. If that changes, consent will be collected before the script loads, not after.

We use third parties to run the site. Each one processes data only on our instructions.

Vercel Inc. — hosting of the site and of the API that receives the /book form, delivery, server logs and cookieless Web Analytics. Processes in the United States. Active.

Database provider — stores the request you submit through /book and the per-IP submission counter. DADO NECESSÁRIO: nome do provedor do banco em produção (Supabase ou Neon) e onde processa

Sentry — error monitoring. Not active on this site: no DSN is configured, so the SDK does not start and no error report leaves your browser. It is listed because the code is present and a DSN would activate it. DADO NECESSÁRIO: confirmar se o Sentry está ativo na API que recebe o formulário e, se estiver, que não envia nome, e-mail nem empresa

The /book form sends no email, so no email delivery provider receives what you submit.

The providers above process data outside Brazil and outside the European Economic Area. Transfers rely on Standard Contractual Clauses and on the safeguards each provider publishes, as permitted by Article 33 of the LGPD and Chapter V of the GDPR.

DADO NECESSÁRIO: confirmar qual mecanismo cada fornecedor oferece no contrato assinado, e anexar

Requests made through /book: your name and email address are anonymised 12 months after the last activity on the request, or 6 months after it is closed without a contract, whichever comes first. The company and the history of the sales conversation remain, without you.

The code derived from your IP address for the submission limit: no more than 48 hours.

Analytics: only aggregate counts are kept; the hash that tells visits apart is valid within a single day.

DADO NECESSÁRIO: prazo de retenção dos logs de servidor no plano da Vercel; prazo para apagar pedido identificado como spam (proposta de 30 dias, aguardando decisão)

Article 18 of the LGPD gives you the right to confirm that we process your data, to access it, to correct it, to anonymise, block or delete unnecessary or excessive data, to port it, to delete data processed under consent, to know who we share it with, to be told the consequences of refusing consent, and to withdraw consent.

Under the GDPR you also have the right to restrict processing, to object, and to lodge a complaint with your supervisory authority.

To exercise any of these, write to privacy@nebuloz.ai. We answer within the period the law sets. In Brazil you may also complain to the ANPD.

Today the site sets one thing in your browser: the Next-Locale cookie described above. There is no analytics identifier, no advertising cookie and no third-party script.

That is a decision, not an accident. Analytics that needs a cookie was removed from this site so that visiting it would not require agreeing to anything. Should we ever want it back, this section and the consent flow change first, and this page will say so before the script runs.

The site is served only over HTTPS. Access to the systems behind it is restricted to people who need it.

Requests sent through /book are kept in Nebuloz's internal system. Only Nebuloz staff with an account there can see them, and signing in requires a second authentication factor.

DADO NECESSÁRIO: descrever medidas reais — não afirmar certificação, controle ou auditoria que a empresa não tenha. Afirmação de segurança não comprovada é o tipo de coisa que vira responsabilidade em incidente.

When this policy changes we update the date at the top. Material changes will be announced on this page before they take effect.

This policy is governed by Brazilian law, in particular Law 13.709/2018 (LGPD). DADO NECESSÁRIO: foro eleito — normalmente a comarca da sede