Privacy Policy
Last updated: September 29, 2026
In short: we only collect what you type into the forms or write on WhatsApp, use it to reply to you and carry out your project, and don't sell it to anyone. Analytics cookies (Google Analytics, Microsoft Clarity) and advertising cookies (Google Ads, Meta) only run if you accept them, and you can change that choice whenever you want. You can ask for a copy, a correction or deletion of your data at any time.
Who the controller is
Prospectando. Marketing and Sales Agency, registered under CNPJ (Brazilian company registration) no. 52.653.410/0001-35, based in Brochier, RS, Brazil. Prospectando decides why and how your data is processed: under the GDPR it is the controller; under Brazilian law (LGPD), the controlador.
Contact for any privacy matter: WhatsApp +55 11 99333-4654 or email dpo@prospectando.com.br.
Data protection officer (DPO): Giovane Martins de Almeida, email dpo@prospectando.com.br, phone and WhatsApp +55 51 98205-4943. Contact him to exercise your rights, ask questions or complain about how your data is used. He is also the point of contact with the ANPD and with European data protection authorities.
This policy applies to the website in every language, the forms, the chat window before WhatsApp, the briefings and the Client area. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), which applies when you are in the European Union or the European Economic Area, and the LGPD (Brazil's General Data Protection Law) (Law No. 13,709/2018).
What data we collect
Data you give us
- Review request form: name, business, WhatsApp, email, service of interest and, if you like, a message. The page language and the address of the page the request came from are sent along with it.
- Chat window before WhatsApp: when you click a WhatsApp button, a chat opens asking for your name, WhatsApp, email and business. That data, the page you were on and the message about to go to WhatsApp are recorded as a contact request before WhatsApp opens. If you'd rather not fill it in, the shortcut at the bottom of the window takes you straight to WhatsApp.
- WhatsApp conversation: your number, your profile name and whatever you write.
- Briefings (for clients): the answers you give in the interactive form, which may include information about your business, your audience and your commercial goals, and the email address the copy is sent to.
- Client area: login email and password, plus the data for the projects you've hired us for.
Required fields are the ones we need to reply to you. Without them we can't record the request; you can always message us directly on WhatsApp instead.
Data collected automatically
- Technical access logs (IP address, date and time, page visited, browser) kept by the providers that host the website and the dashboard, so the website works and stays protected against abuse.
- The IP address of whoever submits a form is used on the spot, and only in the server's memory, to block bursts of submissions (more than 5 in 10 minutes). It doesn't go into the CRM.
- Preferences stored in your browser, explained under Cookies and browser storage below.
- Only if you accept cookies: browsing data collected by Google Analytics, Microsoft Clarity, Google Ads and the Meta Pixel (pages viewed, where the visit came from, the ad clicked, clicks, scrolling and movement on the page, cookie identifiers, IP address and device and browser data), explained in the same section.
- Only if you accept marketing cookies and submit a form: your email and phone number, turned into an irreversible code (hash), sent to Google and Meta, explained in the same section.
Why we use it and on what legal basis
| Purpose | GDPR (EU) | LGPD (Brazil) |
|---|---|---|
| Reply to your review, quote or contact request, carry out the free review and send you a confirmation email | Consent and steps taken at your request before entering into a contract (Art. 6(1)(a) and (b)) | Consent and preliminary contract procedures (Art. 7, I and V) |
| Follow up with you about the proposal you asked for | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Perform the service you hired and run the Client area | Performance of a contract (Art. 6(1)(b)) | Performance of a contract (Art. 7, V) |
| Protect the website and forms against bots, fraud and abuse; keep technical logs | Legitimate interest in keeping the service secure (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) and legal obligation under the Marco Civil da Internet (Brazil's Internet Civil Rights Framework) (Art. 7, II) |
| Measure website audience (visits, pages viewed, traffic sources) with Google Analytics | Consent, given in the cookie notice (Art. 6(1)(a)) | Consent, given in the cookie notice (Art. 7, I) |
| Measure interactions on the website with Google Analytics: clicks on WhatsApp buttons and the opening and submission of each form (which form, on which page and in which language), without anything you type | Consent, given in the cookie notice (Art. 6(1)(a)) | Consent, given in the cookie notice (Art. 7, I) |
| Understand how pages are used with Microsoft Clarity (heatmaps and anonymized recordings of clicks, scrolling and movement, with form fields masked) | Consent, given in the cookie notice (Art. 6(1)(a)) | Consent, given in the cookie notice (Art. 7, I) |
| Measure which ads bring in inquiries (including with hashed email and phone number when a form is submitted) and show ads to people who have visited the website (Google Ads and Meta) | Consent, given in the cookie notice (Art. 6(1)(a)) | Consent, given in the cookie notice (Art. 7, I) |
| Meet tax, accounting and legal obligations | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 7, II) |
| Defend legal claims in court, administrative or arbitration proceedings | Legitimate interest (Art. 6(1)(f)) | Regular exercise of rights (Art. 7, VI) |
We don't sell or rent personal data and don't make solely automated decisions that affect you. Your name is not sent to Google or Meta. Your email and phone number are only sent, hashed, if you accept marketing cookies and submit a form; we only show ads to past visitors with that same consent. The bot filter and the submission limit only block technical abuse; every reply to your request comes from a person.
Who we share it with
Only with companies that provide services to Prospectando (processors, under the GDPR), and only what each one needs to do its part:
| Who | What for | Where |
|---|---|---|
| Vercel Inc. | Hosts the website and receives the forms; keeps technical access logs | United States (global network) |
| Cloudflare, Inc. | Hosts the management dashboard (the CRM where a request becomes a deal, the Client area and backups) and protects the network | United States (global network) |
| Resend | Sends the confirmation email to you and the new-request alert to the team | United States |
| Hostinger | Hosts Prospectando's email inbox, which receives the new-request alert | Outside Brazil |
| Typebot | Runs the briefing forms (clients only) | Outside Brazil |
| jsDelivr | Delivers the Typebot program on briefing pages; receives your IP | Global network |
| Google LLC (Google Analytics and Google Ads) | Only with consent: measures visits, website usage and interactions (analytics); measures which ads bring in inquiries, including by receiving your hashed email and phone number when you submit a form, and shows ads to past visitors (marketing) | United States (global network) |
| Microsoft Corporation (Microsoft Clarity) | Only with analytics consent: heatmaps and anonymized recordings of browsing, with form fields masked | United States |
| Meta Platforms Ireland Ltd. (for people in the EEA) and Meta Platforms, Inc. (everywhere else), through the Meta Pixel | Only with consent: measures which Facebook and Instagram ads bring in inquiries, including by receiving your hashed email and phone number when you submit a form, and shows ads to past visitors (marketing) | Ireland and United States |
Google, Meta and Microsoft also use the data their tools collect for their own purposes, as controllers, under their own privacy policies: Google, Meta and Microsoft. Without your consent, the website sends them nothing.
When you choose to talk on WhatsApp, the conversation takes place on Meta's service (WhatsApp), which processes the data as an independent controller under its own privacy policy. The links to Instagram, Facebook, LinkedIn and YouTube are just links: nothing from those networks loads on the website before you click. The Meta Pixel is a different matter and only loads if you accept marketing cookies.
We may also disclose data to public authorities when required by law or court order.
International transfers
Prospectando is based in Brazil, and the providers above process data in the United States and other countries where they have servers. In practice, your data is processed in Brazil and the United States.
Google (Analytics and Ads), Microsoft (Clarity) and Meta (Pixel) only receive data if you accept analytics or marketing cookies, and they process it in the United States, among other countries.
If you are in the European Union or the European Economic Area: Brazil does not have an adequacy decision from the European Commission. Sending your data to Prospectando relies on it being necessary to handle the request you made yourself (GDPR Art. 49(1)(b)). With our providers, including Google, Microsoft and Meta, transfers to the United States rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the provider's certification under the EU-U.S. Data Privacy Framework. You can ask for a copy of these safeguards through our privacy contact.
Under Brazilian law, these transfers rely on contractual clauses with the providers and on the need to carry out your request or contract (LGPD Art. 33, II and IX).
How long we keep it
- Contact requests that didn't become clients: up to 24 months after the last contact, or sooner if you ask for deletion or withdraw your consent.
- Client data: for the length of the contract and, afterward, for as long as the law requires (tax, accounting) or while a claim could still be brought in court.
- Technical access logs: up to 6 months, the period set by the Marco Civil da Internet (Brazil's Internet Civil Rights Framework).
- Dashboard backups: 30 days. Deleted data disappears from the backups within that period.
- Browser preferences: stay on your device until you clear them. Your cookie choice lasts 12 months; after that, the notice comes back.
- Analytics and marketing cookies: for the periods in the table under Cookies and browser storage (90 days to 2 years), or until you withdraw consent and clear the cookies from your browser.
Your rights
Under the GDPR (Arts. 15 to 22) and the LGPD (Art. 18), you can, at any time and free of charge, exercise your right to:
- access: find out whether we process your data and get a copy;
- rectification: correct incomplete, inaccurate or outdated data;
- erasure: ask us to delete your data, except what the law requires us to keep;
- restriction of processing: ask us to pause using it while an issue is resolved;
- data portability: receive the data you gave us in a structured format, or have it sent to another provider;
- object: object to processing, especially processing based on legitimate interest;
- withdraw your consent whenever you want, as easily as you gave it. This doesn't affect the lawfulness of processing carried out before;
- information: know who we share your data with;
- not be subject to solely automated decisions and ask for a review of any such decision.
To exercise any of these rights, message us on WhatsApp +55 11 99333-4654 or email dpo@prospectando.com.br. If we need to confirm the request is really yours, we'll tell you. We reply within 15 days and never later than one month; for a very complex request, the deadline can be extended by two more months, with notice and an explanation within the first month.
If you feel we haven't resolved your concern, you can file a complaint with a data protection authority: in the EU, the authority of the country where you live or work (in Portugal, the CNPD; in Spain, the AEPD); in Brazil, the ANPD.
Cookies and browser storage
The website sorts what it stores in your browser into three categories. Essential items always run; analytics and marketing only run with your consent. On your first visit, a notice gives you three options: Preferences (choose category by category), Essential only and Accept all. Saying no doesn't change anything about how you use the website.
The website uses Google Consent Mode (v2): everything starts as denied and only changes when you choose. Google, Microsoft and Meta scripts are not loaded before you consent.
Essential (always on)
| Name | Set by | What for | How long |
|---|---|---|---|
| prospectando:via (localStorage) | Prospectando | Remember the light or dark theme, only when you pick one | Until you clear your browser data |
| prospectando:idioma (localStorage) | Prospectando | Remember the website language, only when you pick one (in the selector or in the banner that suggests your device's language) | Until you clear your browser data |
| prospectando:abertura (sessionStorage) | Prospectando | Avoid replaying the opening animation on every page of the same visit | Until you close the tab |
| prospectando:consentimento (localStorage) | Prospectando | Store your cookie choice and its date, so we don't ask again | 12 months |
These preferences don't identify you and never leave your device. Because they are strictly necessary for a feature you use, they don't require consent (Art. 5(3) of Directive 2002/58/EC, the ePrivacy Directive).
Analytics (only with consent)
| Name | Set by | What for | Typical duration |
|---|---|---|---|
| _ga | Google Analytics 4 (Google LLC, U.S.) | Tell visitors apart to measure visits and how the website is used | 2 years |
| _ga_* | Google Analytics 4 (Google LLC, U.S.) | Keep the session state for that same measurement | 2 years |
| _clck | Microsoft Clarity (Microsoft Corporation, U.S.) | Recognize the browser across visits for heatmaps and anonymized recordings | 1 year |
| _clsk | Microsoft Clarity (Microsoft Corporation, U.S.) | Join the pages of a single visit into one recording | 1 day |
Marketing (only with consent)
| Name | Set by | What for | Typical duration |
|---|---|---|---|
| _gcl_au | Google Ads (Google LLC, U.S.) | Link a visit or an inquiry to the Google ad that brought it in (conversion tracking) | 90 days |
| Cookies on doubleclick.net and google.com | Google Ads (Google LLC, U.S.) | Measure conversions and show ads to people who have visited the website (remarketing) | Set by Google; usually up to 13 months |
| _fbp | Meta Pixel (Meta Platforms Ireland / Meta Platforms, Inc.) | Recognize the browser to measure which ads bring in inquiries and show ads to people who have visited the website | 90 days |
| _fbc | Meta Pixel (Meta Platforms Ireland / Meta Platforms, Inc.) | Store the click on the Facebook or Instagram ad that brought the visit | 90 days |
With analytics cookies, Google Analytics also records clicks on WhatsApp buttons and the opening and submission of each form (which form, on which page and in which language), without anything you type. Microsoft Clarity makes anonymized recordings of clicks, scrolling and movement on the page, with form fields masked: what you type is not recorded.
When you submit a form (review request, review window or the chat before WhatsApp) and have accepted marketing cookies, the website records a conversion event (“lead”) in Google Ads, Google Analytics and Meta and also sends your email and phone number, which the tools themselves turn into an irreversible code (SHA-256 hash) before they leave your browser. This is Google's Enhanced Conversions and Meta's Advanced Matching, used to tell which ad brought in the inquiry. Your name is not sent. Without marketing consent, none of this is sent.
The durations above are the typical ones set by Google, Microsoft and Meta and may change on their end. The legal basis for analytics and marketing is consent: GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3); and LGPD Art. 7, I.
How to change or withdraw your consent
At any time, with the shield button in the bottom-left corner of the screen or the Cookie preferences link in the footer. Withdrawing consent applies from then on and doesn't affect processing carried out before. You can also delete cookies in your browser settings. Your choice is stored for 12 months; after that, the notice shows up again.
Two exceptions, outside the public pages: briefing pages load the Typebot form, which belongs to a third party and may store your progress in your browser; and the Client area uses a strictly necessary session cookie to keep you signed in.
Security
The website and the dashboard are served over HTTPS only. The dashboard only accepts requests coming from the website with a secret key. Client area passwords are stored as hashes, never as plain text. Access to client data is limited to the team working on the account, and each client sees only their own data. No system is immune to incidents: if one happens that could put you at risk, we'll notify you and the competent supervisory authority within the legal deadlines.
Children
This website is aimed at businesses and professionals. It is not intended for anyone under 16 in the European Union or under 18 in Brazil, and we don't knowingly collect their data. If that happens by mistake, let us know and we'll delete it.
Changes to this policy
When this policy changes, the date at the top changes with it. If the change matters to existing clients or people who have already sent us a request, we'll let them know through our support channels.