Privacy Policy

1. Controller

Doxa Labs · CNPJ 69.106.320/0001-27 · Rua Visconde do Rio Branco, 1488, Conj 909 Andar 09, Curitiba/PR · [email protected]. Doxa Labs is the controller of the data processed through this landing page, under Brazil's LGPD (Law 13,709/2018), art. 5, VI.

2. Data collected

• Contact form: name, email, and message — provided by you.
• Direct contact: the content of emails sent to [email protected].
• Language preference: stored only in your browser (localStorage) if you switch languages. Never sent to us.
• Minimum technical data: this page is static and uses no analytics, pixels, or tracking cookies. The hosting provider may log technical records (IP, date/time, user-agent) for security, per the Marco Civil, art. 13.

We do not collect phone numbers, CPF, payment data, or sensitive data (LGPD, art. 11). There is no newsletter — we do not ask for marketing consent because we do not send marketing.

3. Purposes and legal bases

• Replying to your contact request (name, email, message) — basis: procedures preliminary to a contract at the data subject's request (LGPD, art. 7, V).
• Security and abuse prevention (technical logs) — basis: controller's legitimate interest (art. 7, IX) and legal obligation (art. 7, II with Marco Civil).

We use your data only for the purpose stated next to the form. Generic purposes such as "improving your experience" are not used.

4. Sharing

We do not sell data. Strictly necessary operators:

• Static-site hosting (public files, no proprietary database).
• Google Fonts — font delivery; your IP may be visible to Google when fonts load.
• Email provider — to receive and reply to your message.

No CRM, analytics, Meta/Google Ads, or gateway is active in this version. If activated in the future, this policy will be updated and, where required, prior consent will be requested.

5. How sending works (important)

In this version the form is frontend-only: on submit, we open your email app with a ready draft (mailto). Nothing is stored in this site's database. Processing begins when your message reaches our inbox at [email protected].

6. Retention and disposal

Contact emails: kept for up to 24 months for business history and defense of rights, then deleted or anonymized. Hosting logs: per the applicable legal term. You may request early deletion (item 7).

7. Data-subject rights (LGPD, art. 18)

Access, correction, anonymization, blocking, deletion, portability, information about sharing, revocation of consent, and objection. To exercise them, write to [email protected] with subject "LGPD Rights" and include the name + email used in the contact.

Response time: up to 15 days, per Res. CD/ANPD 18/2024.

8. DPO (Data Protection Officer)

[email protected] — same channel as general contact in this version.

9. Incidents

In case of an incident with relevant risk, we will notify the ANPD and affected subjects, with a description of the event, data involved, measures taken, and the officer's contact.

10. Changes

We will update this policy on each relevant change (new form, analytics, CRM), with a new version and date at the top. The applicable version is the one in force on the date of your contact.