Privacy Policy

The controller of the personal data described here is DADO NECESSÁRIO: razão social completa, registered under CNPJ DADO NECESSÁRIO: CNPJ, at DADO NECESSÁRIO: endereço completo.

Under Article 41 of the LGPD the controller must name a data protection officer. Ours is DADO NECESSÁRIO: nome do encarregado, reachable at DADO NECESSÁRIO: e-mail do encarregado.

Right now, one thing: a first-party cookie named Next-Locale, which remembers the language you were served. It carries no identifier and is not used for analytics. Verified on the live site — no other cookie, no local storage entry, and no request to any third party.

When product analytics is switched on, the site will use PostHog, which stores an identifier in your browser (a cookie and a local storage entry) and records page views and interactions. PostHog processes that on infrastructure in the United States. DADO NECESSÁRIO: atualizar esta seção no dia em que o analytics for ligado de verdade — hoje está desativado

Contacting us: whatever you type into the contact form, plus your email address, so we can reply.

Server logs kept by our hosting provider, which include IP address, user agent and requested path.

• We do not run advertising or cross-site tracking.
• We do not buy or sell personal data.
• We do not ask for, and you should not send, sensitive personal data as defined in Article 5 II of the LGPD.

Replying to you when you make contact: performance of a contract or preliminary steps at your request — LGPD Article 7 V, GDPR Article 6(1)(b).

Keeping the site secure and available, including logs: legitimate interest — LGPD Article 7 IX, GDPR Article 6(1)(f).

Understanding how the site is used, through analytics: consent — LGPD Article 7 I, GDPR Article 6(1)(a). DADO NECESSÁRIO: decidir se haverá banner de consentimento; sem ele, analytics não pode rodar antes do consentimento para visitantes na UE

We use third parties to run the site. Each one processes data only on our instructions.

Vercel Inc. — hosting, delivery and server logs. Processes in the United States. Active.

PostHog Inc. — product analytics. Processes in the United States. Not active yet; nothing is sent to PostHog and no analytics identifier is written until it is configured.

DADO NECESSÁRIO: confirmar se Resend (envio de e-mail do formulário) e Sentry (monitoramento de erros) estarão ativos em produção — hoje o formulário não envia e o Sentry não tem DSN configurada

The providers above process data outside Brazil and outside the European Economic Area. Transfers rely on Standard Contractual Clauses and on the safeguards each provider publishes, as permitted by Article 33 of the LGPD and Chapter V of the GDPR.

DADO NECESSÁRIO: confirmar qual mecanismo cada fornecedor oferece no contrato assinado, e anexar

DADO NECESSÁRIO: prazo de retenção por finalidade — mensagens de contato, logs de servidor, dados de analytics. A LGPD exige eliminação ao fim da finalidade, então cada um precisa de um prazo declarado.

Article 18 of the LGPD gives you the right to confirm that we process your data, to access it, to correct it, to anonymise, block or delete unnecessary or excessive data, to port it, to delete data processed under consent, to know who we share it with, to be told the consequences of refusing consent, and to withdraw consent.

Under the GDPR you also have the right to restrict processing, to object, and to lodge a complaint with your supervisory authority.

To exercise any of these, write to DADO NECESSÁRIO: e-mail do encarregado. We answer within the period the law sets. In Brazil you may also complain to the ANPD.

Today the site sets one thing in your browser: the Next-Locale cookie described above. There is no analytics identifier, no advertising cookie and no third-party script.

If analytics is switched on later, it will add one identifier. You can clear it from your browser settings, and blocking it does not affect how the site works.

The site is served only over HTTPS. Access to the systems behind it is restricted to people who need it.

DADO NECESSÁRIO: descrever medidas reais — não afirmar certificação, controle ou auditoria que a empresa não tenha. Afirmação de segurança não comprovada é o tipo de coisa que vira responsabilidade em incidente.

When this policy changes we update the date at the top. Material changes will be announced on this page before they take effect.

This policy is governed by Brazilian law, in particular Law 13.709/2018 (LGPD). DADO NECESSÁRIO: foro eleito — normalmente a comarca da sede