Who the controller is
HProjekt is the controller of the personal data collected on this site, under Brazil's General Data Protection Law (Law 13.709/2018).
Address: Av. Paulista, 475 - 6th floor, Bela Vista, São Paulo - SP, 01311-000, Brazil. For any request regarding your data, write to comercial@hprojekt.io.
What we collect
In the contact form, when you identify yourself as a company: name, email, WhatsApp number, company (optional) and the description of your need.
Along with the form we also send where you came from: the page you entered through, the site that referred you and, when present in the URL, the campaign parameters (utm_source and similar) and the ad click identifiers (gclid, fbclid). This stays in your browser for the visit only, disappears when you close the tab and reaches us only if you submit the form. It tells us which channel brings contacts, and the legal basis is the legitimate interest in measuring how well our own channels perform.
When subscribing to the newsletter: only your email, plus the page you subscribed from.
While browsing, if you accept cookies: pages visited, traffic source, time on page and identifiers generated by the measurement tools. If you decline, none of this is collected.
If you are looking for a job
This site does not receive applications. When you indicate in the form that you are looking for an opportunity, you are directed to our job portal and no data of yours is stored here.
The job portal has its own data handling and a separate policy.
Why we process this data
Contact form: to answer your request and conduct commercial discussions. The legal basis is pre-contractual steps and legitimate interest.
Newsletter: to send blog content. The legal basis is your consent, given by ticking the acceptance box. You may withdraw it at any time.
Browsing measurement: to understand how the site is used and improve it. The legal basis is your consent, given in the cookie banner.
Who we share it with
We do not sell or trade your data. It passes through service providers that run the site, each handling only what its function requires:
Vercel (hosting and file storage), Google Firebase (the database where contacts are stored), Resend (email delivery), Google Analytics and HubSpot (browsing measurement), Google reCAPTCHA (protecting the forms against automated submissions) and Google Ads (ad measurement).
About Google Ads specifically: when you submit the form, we send Google your email and phone converted into an irreversible code (SHA-256 hash) so it knows that ad produced a real contact. Google does not receive the readable data and cannot reconstruct it from the code; matching is done by comparing codes. The sole purpose is measuring and improving ad performance, and we pass your cookie choice along with the upload. The legal basis is the legitimate interest in measuring our own channels. If you would rather your data not be used this way, write to comercial@hprojekt.io.
These providers keep servers outside Brazil, which constitutes an international data transfer. The LGPD permits such transfers subject to contractual clauses and the safeguards offered by the providers themselves.
How long we keep it
Commercial contacts are stored for the duration of the relationship and for up to 5 years after the last contact, in line with the civil statute of limitations.
Newsletter emails are kept until you unsubscribe. On unsubscribing, the record is marked as cancelled and stops receiving messages.
Browsing data follows the retention period of the measurement tools.
Cookies
No measurement cookie is written before you accept. While you have not decided, the Google Analytics and HubSpot scripts are not even loaded on the page.
If you accept, Google Analytics writes identifiers to distinguish visits and HubSpot records the pages you visit, so they can be linked to a contact should you later fill in a form.
There is one exception, and it does not depend on your consent: Google reCAPTCHA loads on every page, including before you decide about cookies. It analyses browsing signals to tell people from bots, and it is what stops our forms from being used for automated submissions. The legal basis here is the legitimate interest in keeping the service secure, not consent. That use is governed by Google's privacy policy.
Your choice is stored in your browser. To change it, clear this site's data in your browser settings and the question will appear again.
Your rights
Article 18 of the LGPD entitles you to request: confirmation that we process your data, access to it, correction of incomplete or outdated data, anonymisation or deletion, portability, information on who we share it with, and withdrawal of consent.
To exercise any of these rights, write to comercial@hprojekt.io. We will respond as soon as possible.
You may also petition Brazil's National Data Protection Authority (ANPD) directly.
Security
Access to the admin panel, where contacts are visible, is password protected, with an expiring session and a limit on login attempts.
Data transmitted between your browser and the site is encrypted. No system is immune to incidents; in the event of a relevant breach, we will notify the data subjects and the ANPD as the law requires.
Changes to this policy
If the site starts collecting different data or using new tools, this text will be updated and the revision date at the top will change.