Privacy
Privacy Policy
Effective October 6, 2026. Updated October 23, 2026.
This English version is provided for convenience. If there is any conflict, the Portuguese version prevails.
This policy explains how Pipa Global processes the personal data of people who visit pipa.global and people who contact us, under Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13,709/2018, the “LGPD”).
Who is responsible
Pipa Global is in the process of being incorporated. Until then, the controllers (controladores) of the data processed on this site are the founding partners, Luiz Fialho and Marcos Lopes, who operate under the name Pipa Global. The company’s Brazilian taxpayer ID (CNPJ) and address will be published here as soon as they exist. For any privacy matter, email contact@pipa.global.
Data protection officer. As a small-scale processing agent (agente de tratamento de pequeno porte) under Art. 11 of Resolution CD/ANPD No. 2/2022 (Resolução CD/ANPD nº 2/2022) of Brazil’s National Data Protection Authority (ANPD), Pipa has not appointed a data protection officer (encarregado). Requests sent to contact@pipa.global are handled directly by the partners.
What data we process and why
| Situation | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| You fill out the contact form or email us | Name, company and company email; what you want to solve, from the options you select, and an optional detail picked from a list; your role (with the description you type, if you pick “Other”), revenue range and timing; phone or WhatsApp (optional); if you email us, your message; for a quick contact request, only name, company email and phone (optional); and how you reached the site (the form page, the site you came from and any campaign parameters in the link) | To reply and discuss possible work together; how you reached the site shows us which channel brought the contact | Legitimate interest (legítimo interesse) in replying to someone who contacted us (Art. 7, IX); if the conversation turns into a proposal, preliminary procedures related to a contract (Art. 7, V) |
| You accept analytics cookies | Random identifier in a cookie, pages visited, traffic source, device type and approximate region | To understand, in aggregate reports, how the site is used | Consent (consentimento, Art. 7, I), which you can withdraw at any time |
| Any visit to the site | IP address, browser, and date and time of access, in the hosting provider’s technical logs | To keep the site running and secure | Legitimate interest (Art. 7, IX) |
| Any visit (traffic count) | Page visited and referring page (without the query string), browser and operating system, device type, country and page-load metrics. No cookie and no identifier that recognizes you from one visit to the next. Your IP address reaches Cloudflare with the request, as with any web request, and is used to tell the country | To count visits and measure site performance, in aggregate numbers | Legitimate interest (Art. 7, IX) |
Please don’t include sensitive personal data, or other people’s data, in your message or in the role field.
To catch typos, the form checks public DNS to see whether your email’s domain (the part after the @) can receive mail. This check doesn’t store the address or the domain. The form asks for a company email and doesn’t accept addresses from free providers such as Gmail or Outlook. Once the domain is confirmed, the form suggests the company name based on it; this happens in your browser, and you can edit it.
We don’t use the data for advertising, we don’t sell it, and we don’t make automated decisions about you based on it.
Who we share data with
We use service providers that process data on our behalf, only for the purposes above:
- Vercel, which hosts the site and Pipa’s internal system and runs the form submission.
- Supabase, which stores, in São Paulo, the database for Pipa’s internal system, where the partners log and follow up on contacts received through the form.
- Resend, which delivers the form message to Pipa’s partners and sends you a confirmation of receipt with the options you selected in the form.
- Google, which provides Pipa’s email (Google Workspace) and, only with your consent, cookie-based analytics (Google Analytics).
- Cloudflare, which counts visits with no cookie and without identifying who visits (Cloudflare Web Analytics).
Vercel, Resend, Google and Supabase are US companies and may process data in the United States, even though the site, form submission and database are configured in São Paulo. The transfer relies on these providers’ data protection contractual clauses, in accordance with Art. 33 of the LGPD and ANPD Board Resolution No. 19/2024 (Resolução CD/ANPD nº 19/2024). We will send a copy of these clauses to anyone who asks. Cloudflare, also a US company, receives only the visit-count data described above, with no cookie and no visitor identifier, and its data processing agreement follows the EU standard contractual clauses and the Data Privacy Framework.
If you choose to book a time in the calendar offered after you submit the form or in the confirmation email, the booking happens on Pipa’s Google Calendar page, under Google’s privacy policy, and the site does not receive that data. What you enter there reaches the partners through Google Calendar and is used only for the conversation you booked.
How long we keep data
- Contact messages: while the conversation is active. If no project follows, we delete them within 12 months of the last contact. If there is a project, we keep them for the term of the contract and any legally required periods. Technical copies at Vercel and Resend follow those services’ short retention periods.
- Analytics data: we configured Google Analytics to keep event and user data linked to the identifier for 2 months. After that, only aggregate reports remain.
- Visit counts: Cloudflare keeps a record of each page view, with no visitor identifier, for 7 days; after that it keeps only a summarized sample, which can be viewed for up to 6 months.
- Technical logs: for the hosting provider’s retention period, which is short and used only for operations and security.
Cookies and browser storage
| Name | Set by | Purpose | Duration | When |
|---|---|---|---|---|
pipa-consentimento | Pipa (local storage) | Remember whether you accepted or declined analytics | 12 months | After you choose |
_ga, _ga_* | Google Analytics | Tell visits apart using a random (pseudonymous) identifier | 12 months in the browser; data kept in Analytics for 2 months | Only if you accept |
Cloudflare’s visit count uses no cookie and stores nothing in your browser, so it isn’t listed in this table. If you’d rather not be counted, block static.cloudflareinsights.com in your browser or content blocker; the site works the same.
Declining doesn’t change how you can use the site. To change your choice, use the button below or clear this site’s data in your browser.
Your rights
Under the LGPD (Art. 18), you may request at any time:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary or processed in violation of the law;
- portability to another provider;
- information about who we share your data with;
- objection to processing based on legitimate interest;
- information about the option not to consent and what happens if you decline (for analytics, nothing changes in how you use the site);
- deletion of data processed based on your consent, and withdrawal of that consent.
To exercise any of these rights, email contact@pipa.global. We reply within 15 days and may ask for some information to confirm the request is yours. If you believe we haven’t handled it properly, you can also contact Brazil’s National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).
Security
We use an encrypted connection (HTTPS) across the site, restricted access to Pipa’s email inboxes, and providers with recognized security practices. No system is infallible; if an incident occurs that may pose a relevant risk or harm to you, we will notify you and report it to the ANPD as the law requires.
Children and adolescents
The site is aimed at businesses and is not intended for anyone under 18.
Changes to this policy
We may update this policy when the site or the company changes, for example once Pipa has a CNPJ. The date at the top shows the version in effect. If a change is significant, we’ll announce it on the site.