Privacy
Effective
This page explains what personal data syphrax processes when you use this site, what for, on what legal basis, who it is shared with, how long it is kept, and how to exercise your rights. syphrax is a Brazilian company, so this processing is governed by Brazil's General Data Protection Law (Law 13,709/2018, the LGPD). We extend the same rights to every visitor, wherever you are.
What changed in this version
This version now covers the private link we use to send commercial proposals and the record of their acceptance (see “Proposal link and acceptance”). Everything else about how we process your data stays the same. The previous version, of September 27, 2026, changed the controller of your data: it was the sole proprietorship (MEI) that operated syphrax, and it became SYPHER WAY & UMBRA LIMITADA, CNPJ 69.341.042/0001-92 (see “Contact”).
What we collect
Through the contact form: name, email, message, the line of interest, the budget range and the page language, plus a record that you acknowledged this policy (see “Submission record”). When you visit, as with any website, the network that delivers the pages and the server receive technical connection data: IP address, date and time, page visited and browser. Audience is measured in aggregate, without identifying you.
What we use it for
Form data is used to answer you and, if you wish, to prepare a proposal. Technical data is used to deliver the pages, protect the site against attacks, measure audience in aggregate and keep the access logs that Brazil's Internet Civil Framework (Marco Civil da Internet) requires. We don't sell data, don't use it for advertising, and make no automated decisions about you.
Data we need to answer you
The form data is required to answer your request. Without name, email, message, line and budget range, and without the acknowledgment box checked, the form is not sent. Your rights still apply in full: to exercise them, write to [email protected].
Legal basis
Form: steps prior to entering a contract, at your request; you are the one reaching out about a service (LGPD, Art. 7, V). Technical data: compliance with a legal obligation, for keeping access logs (LGPD, Art. 7, II, and Marco Civil da Internet, Art. 15), and legitimate interest in keeping the site secure and measuring audience in aggregate (LGPD, Art. 7, IX).
Who we share it with
Only with the providers that make the site work, each in its own role: Resend, which sends the form message by email; Google Workspace, which hosts our email inbox; Cloudflare, which delivers the pages, protects the site and measures audience with Web Analytics, without cookies; and Hostinger, which hosts the site's server in Boston, in the United States. All of them process data in the United States, and Google and Cloudflare also in other countries. Transferring form data abroad relies on it being necessary to answer the contact you requested (LGPD, Art. 33, IX). Transferring proposal acceptance data relies on the same article when the person accepting is the contracting party, to perform the contract, and, after the contract ends, on keeping the evidence the law requires and defending legal claims (LGPD, Art. 33, IX, with Art. 7, II, V and VI). Beyond these providers, we only hand data to an authority when the law or a court order requires it.
Tracking and cookies
We use no cookies: neither tracking nor advertising. No other party uses this site to follow your activity across other websites. Cloudflare Web Analytics counts visits without identifying you. Because we track no one, your browser's Do Not Track signal changes nothing here: the site works the same with or without it.
Submission record
When you send the form, the email we receive records three things: that the acknowledgment box was checked, the version of this policy in effect, and the time it was sent. This record does not include your IP address or browser, and it is kept for as long as the contact itself. We also keep the text of every version of this policy, so we know what it said when you wrote to us.
Proposal link and acceptance
We send commercial proposals through a private link at backoffice.syphrax.dev, and this policy covers it too. When the link is opened, we record only the date and time of the first opening, how many times it has been opened and when it was last opened, with no IP address or browser. This lets us know the proposal arrived and protects the link against misuse (legitimate interest, LGPD, Art. 7, IX). To accept, you enter your full name and job title, and we record with them the date, time, IP address and browser. This record proves who accepted, when and from which connection, and is kept with the accepted proposal: items, amounts and terms. The legal basis for the acceptance is performance of the contract, when the person accepting is the contracting party (Art. 7, V), or legitimate interest in proving the agreement, when the person accepting represents a company (Art. 7, IX). Retention: the acceptance record is kept for as long as the contract lasts and for up to 10 years after it ends, the general limitation period under Brazil's Civil Code (Art. 205), because a company must keep its business records until then (Civil Code, Art. 1,194; LGPD, Art. 7, II and VI); a proposal that is not accepted follows the contact retention period. The data is stored on Hostinger's server in Boston, in the United States, passes through Cloudflare, and is included in backups kept in Google Workspace. If you ask us to delete it, the acceptance record is kept only for the period above and only as evidence, as the law allows (LGPD, Art. 16, I).
How long we keep it
Form data and the submission record: for as long as needed to answer you and, if a proposal moves forward, for the length of the business relationship and the legal periods that follow from it. Without a reply or continuation, we delete it within 24 months. Access logs: 6 months, kept confidential, as the Marco Civil da Internet requires.
Your rights
At any time, free of charge, you can request: confirmation that we process your data; access to it; correction; anonymization, blocking or deletion of anything unnecessary or excessive; portability; information on who we share it with; and to object to processing that does not comply with the law (LGPD, Art. 18). To review or correct your data, or make any other request, write to [email protected] and tell us what you want to see or change. We respond within 15 days. If you are not satisfied, you can complain to Brazil's National Data Protection Authority (ANPD).
Security
The site is served over HTTPS only, every code change goes through an automated security scan, and access to form data is limited to whoever answers the contact. If an incident may bring you relevant risk or harm, we will notify you and the ANPD, as the LGPD requires (Art. 48).
Changes to this policy
The effective date is at the top of this page. If we make a material change, such as to the data we collect, what we use it for, who we share it with or who the controller is, we publish the new version here, with the new date and a summary of what changed at the top of the page.
Contact
The controller of the data processed on this site is SYPHER WAY & UMBRA LIMITADA, a Brazilian limited liability company (sociedade limitada) based in São Paulo, CNPJ (Brazilian company registry number) 69.341.042/0001-92, which operates the syphrax brand. To exercise your rights or ask anything about privacy, write to [email protected].