Privacy Policy

Who is responsible for your data

Legal entity

[TODO] (Vorva)

Company registration (CNPJ)

[TODO]

Address

Nova Lima — Minas Gerais, Brazil

Data Protection Officer

[TODO]

Privacy contact

[TODO]

What we collect

We collect only what you type, plus the minimum technical detail needed for the submission to work. We don't buy lists, and we don't use hidden fields to capture anything beyond what's visible on screen.

• Contact form: your name, company, phone or WhatsApp number, email address and whatever you write in the message field.
• Submission metadata: the page you submitted from, the language you selected and your browser identification (user agent).
• Guided diagnostic: your answers stay in your browser. Nothing reaches VORVA unless you choose to continue the conversation on WhatsApp.
• Audience measurement: aggregated browsing data collected through Google Analytics.

Why we collect it

Every field has a stated purpose. We don't repurpose your information for anything outside this list.

• To reply to you and put together a proposal.
• To understand the request before the call, so we don't ask you the same questions twice.
• To keep a record of the commercial relationship.
• To understand, in aggregate, which parts of the site actually work.

Legal basis

VORVA is established in Brazil, so processing is governed by the Brazilian General Data Protection Law (LGPD, Law 13.709/2018), article 7: your consent when you submit the form (item I) and our legitimate interest in replying and keeping a record of the commercial contact (item IX).

If you are in the European Union or the United Kingdom, the same processing relies on GDPR article 6(1)(a) — consent — and article 6(1)(f) — legitimate interests.

Audience measurement depends on your consent, which you can withhold by blocking cookies in your browser.

Who we share it with

We do not sell, rent or trade personal data. We share it only with the vendors needed to run the site and respond to you, and only to the extent each one requires.

• Google (Sheets and Apps Script): where incoming enquiries are recorded.
• Vercel: hosting for the site and for the function that receives the form.
• Meta (WhatsApp): only if you choose to reach us through that channel.
• Google Analytics: aggregated audience measurement.

International transfers

Some of these vendors process data outside Brazil, including in the United States and the European Union. Transfers rely on each vendor's standard contractual clauses and compliance programmes, in line with LGPD article 33 and GDPR chapter V.

How long we keep it

Commercial enquiries stay on file for the duration of the conversation and for up to 5 (five) years after the last contact, matching the limitation period for commercial claims under Brazilian civil law.

You can ask us to delete your data sooner at any time. We will, unless a legal obligation requires us to retain it — in which case we'll tell you which obligation applies and for how long.

Your rights

Under the LGPD (article 18) and the GDPR (articles 15 to 22), you can:

• Confirm that we process your data and get a copy of it.
• Correct data that is incomplete, inaccurate or out of date.
• Ask for anonymisation, blocking or deletion of unnecessary or excessive data.
• Request portability to another provider.
• Withdraw consent and ask us to delete data processed on that basis.
• Find out which third parties we have shared your data with.
• Object to processing carried out on the basis of legitimate interests.

Cookies and local storage

The site sets no tracking cookies of its own. We use your browser's storage for two functional purposes:

• localStorage (key “vorva-lang”): remembers the language you picked, so the site opens in it next time.
• sessionStorage (key “vorva-diagnostico”): keeps your progress through the guided diagnostic until you close the tab. It holds no personal data.
• Google Analytics: sets its own measurement cookies. Blocking them in your browser does not affect how the site works.

Security

The whole site runs over HTTPS. The contact form exposes no credentials in the browser: submissions go to a server-side function that forwards them using secrets your computer never sees. Access to the records is limited to the people handling enquiries.

No measure removes risk entirely. If an incident occurs that poses a significant risk to you, we will notify you and Brazil's data protection authority (ANPD) within the statutory deadlines.

Changes to this policy

If this policy changes, the date at the top changes with it. Material changes to purpose or legal basis are communicated through whichever contact details you have given us.

Exercising your rights

Write to the data protection officer at the address listed at the top of this page. We respond within 15 (fifteen) days. You may also complain directly to Brazil's ANPD or, in Europe, to your national data protection authority.