Privacy policy

Data we collect

When you use the contact form we receive:

• name, email address, subject and message, which you type;
• your IP address and technical signals (such as browser and connection details) used by the Cloudflare Turnstile spam check and by the abuse limit on the form endpoint;
• a record of your consent to the international transfer (see "International transfers"): the time in UTC, the version of this policy and the language of the page, added to the message we receive.

We do not ask for sensitive data. Please do not include it in your message. Like any web host, Cloudflare also sees your IP address when you load any page. We run no analytics, advertising or tracking.

Why we use it and on what basis

We use your data to read and answer your message, to handle any inquiry, proposal or commercial conversation you ask for, and to protect the form against spam and abuse.

• Answering your message and handling the proposal or conversation you request: steps preliminary to a contract or at your request (LGPD, art. 7, V) and our legitimate interest in replying (art. 7, IX).
• Spam and abuse protection: our legitimate interest in the security of the service (art. 7, IX).
• Sending your message abroad through our email providers: your specific consent (art. 33, VIII), described below.

We do not sell your data and do not use it for marketing without your consent.

Who processes it with us

To deliver the form we use these providers:

• Cloudflare, Inc.: hosts the site and the form endpoint, and provides the Turnstile spam check and the abuse limit. For Turnstile, Cloudflare acts on our behalf and, separately, as controller of the signals it uses to improve its bot detection (see its Turnstile Privacy Addendum). The Turnstile check starts when you begin filling in the form, not when the page loads, and your browser contacts Cloudflare directly for it.
• Resend: sends the message by email to our mailbox. Its infrastructure is in the United States.
• Mailbox provider, which receives and stores the message: Google (Gmail), under that provider's own terms.

Nothing is stored in a database on this site.

International transfers

Resend (email delivery) and Google (our receiving mailbox) process data outside Brazil, mainly in the United States; Google chooses where its infrastructure runs. When you send the form, your data therefore leaves Brazil as part of delivering your message to us.

What is sent abroad: the name, email address, subject and message you type, only to deliver and store your message, for the period described below. The controller and the contact channel are listed at the top of this page.

Legal basis: your specific consent (LGPD, art. 33, VIII). The form has a separate checkbox, unticked by default, that names the transfer, its purpose and both providers and links to this page. Ticking it is the only way to give consent, and it is required to send a message: without it the form does not send, and our server rejects any submission that lacks it. It is not combined with any other agreement, and we ask for no marketing consent.

Evidence: each message we receive states that consent was given, the time in UTC, the version of this policy and the language of the page. We keep no separate database; the record lives and is deleted with the message.

Withdrawing consent: write to us through the contact channel above with "Privacy request" as the subject, free of charge. We then stop sending your data abroad for future processing and delete your messages as described under "How long we keep it". Withdrawal does not undo transfers already completed, which remain valid (LGPD, art. 8, §5), and it does not erase copies that Resend still holds within its 30-day period, which we cannot remove sooner.

If you do not consent, you cannot use the form. We are not asking you to waive any right by this.

Cloudflare is separate from this consent. Its Turnstile spam check receives technical signals directly from your browser, and our server then asks Cloudflare to verify the result; this is not part of the email transfer. We rely on our legitimate interest in security for it (art. 7, IX) and do not claim a separate art. 33 mechanism for it.

You can ask us for details about these transfers through the contact channel, and you may petition the ANPD.

How long we keep it

• Resend keeps delivery records and message data for 30 days on the plan we use.
• Cloudflare keeps technical logs and Turnstile signals for the periods in its own policies, which we do not control.
• Messages in our mailbox: up to 12 months after the conversation closes, unless a contract or legal obligation requires longer.

We review and delete old conversations by hand, periodically. We do not promise deletion at a specific moment. You can ask us to delete your messages earlier (see below), and we will do so unless we must keep them by law or contract.

Your rights and how to use them

Under LGPD, art. 18, you may ask us to confirm that we process your data, give access to it, correct it, anonymize, block or delete it, give portability, tell you with whom it was shared, and revoke consent where it applies. To make a request, use the contact channel above. We confirm that we process your data immediately and answer the full request within 15 days (art. 19). You may also complain to the Brazilian data protection authority (ANPD).

Security

The site is served over HTTPS and messages travel to the email provider over encrypted connections (TLS). The form is protected by spam checks and a per-IP rate limit, accepts only plain text, and is validated on the server. Access keys are kept as secrets outside the code. If a security incident could cause relevant risk to you, we will notify you and the ANPD as LGPD, art. 48 requires.

Cookies and local storage

This site sets no cookies of its own. It stores your language and light/dark theme choices in your browser (local storage); they never leave your device. The Turnstile widget, loaded only when you start filling in the contact form, is run by Cloudflare and may use browser storage as Cloudflare documents.

Changes to this policy

We will update this page when the way we handle data changes. The date above shows the latest revision.