Privacy Policy
Last updated: September 4, 2026
1. Who we are
Chiarelli Labs, registered under CNPJ 62.822.123/0001-65, is the controller of the personal data collected on this website. We are a Brazilian software company that eliminates manual back-office work (the invisible shift) for SMBs running a local ERP, based in Brazil.
2. Data we collect
We collect data you provide directly, data received through Meta forms when you request contact through that channel, and the site usage events described in section 10:
- Name and email
- Company and job title (optional)
- Project description and track of interest
- Budget, timeline, and decision profile
- Briefing file (optional, stored on Vercel Blob)
- Call scheduling: chosen date and time, plus your timezone
- Tools we operate for clients: technical usage events and error reports, as agreed in each client's contract
- Commercial communications: authorization, sending, delivery, reply, opt-out, scheduling offer, and booking-confirmation records
3. Purpose of processing
We use data to assess the fit between a project and our work, respond to requests, prepare proposals, schedule calls, perform contracts, and operate the affiliate program where applicable.
We also use contact data for contextual commercial communications, only where there is a legal basis and in accordance with your preferences, refusals, and opt-outs. Client data is processed to provide the contracted service and technical support.
4. Legal basis (LGPD, art. 7)
We apply the legal basis appropriate to each purpose: legitimate interest for commercial evaluation and B2B relationships, consent for optional cookies and situations where it is requested, performance of a contract for services and affiliates, and compliance with a legal or regulatory obligation where necessary.
You may object to processing based on legitimate interest where applicable and withdraw consent without affecting prior processing lawfully carried out.
5. Sub-processors
We share data only with the service providers strictly necessary for operations:
- Resend: transactional email delivery
- Neon: database (serverless PostgreSQL)
- Vercel: website hosting and file storage
- Anthropic: AI-based lead classification and X-ray analysis
- Google: call scheduling (Calendar) and internal tracking spreadsheet
- Stripe: project payment processing
- Meta: receiving leads submitted through Meta forms and advertising measurement only after consent where applicable
- Postmark: technical receipt of email replies when we use a dedicated reply address
Some providers may process data outside Brazil. In those cases, we adopt safeguards and instruments applicable to international data transfers under the LGPD. Each provider processes data only to the extent necessary for the contracted service.
6. Cookies and analytics
We use functional cookies to retain language and consent preferences for up to 365 days, plus source attribution and the same experiment variant for up to 90 days. These cookies do not store your name, email, or form content.
Google Analytics, the Google Ads tag, and the Meta Pixel only load after you accept them in the consent banner (default: denied). If you decline, no analytics or advertising cookies are created. To withdraw acceptance, clear this site's cookies in your browser. The first-party site usage measurement, which uses no cookie and does not depend on consent, is described in section 10.
7. Data retention
Lead, proposal, activity, and commercial-communication data is kept while there is an active relationship. If there is no conversion, we delete or anonymize data within 24 months of the last contact, unless retention is required by law.
First-party measurement events are retained for up to 12 months. X-ray media is deleted after the analysis is complete or, in case of failure or review, within 7 days. Client, payment, commission, scheduling, and support data follow the applicable contract and legal retention periods.
8. Your rights (LGPD, art. 18)
You have the right, at any time, to:
- Access the data we hold about you
- Correct incomplete or outdated data
- Request deletion of your data
- Receive your data in a portable format
- Withdraw consent at any time
- Confirm that processing exists and know the origin and purpose of the data
- Know which entities received shared data and request anonymization, blocking, or deletion where applicable
- Request review of a decision made exclusively by automated means that affects your interests, where applicable
We will respond within 15 days from receipt of the request.
9. AI and automated decisions
We use AI to support lead classification, X-ray analyses, and technical activities. We do not make a decision with legal effect or significant impact solely through automated processing without the possibility of human review. You may request information about applicable criteria and a review where appropriate.
10. First-party site usage measurement
To understand where people stop on the site, we record navigation events (page view, button click, form start and submit) on our own server, plus aggregated interaction metadata (for example, the estimated value range in the calculator), never the content you type. This uses a random identifier stored in your browser for 30 days, with no third-party cookie, no cross-site tracking, no IP address and no device data beyond its class (phone, tablet or desktop). The identifier is only associated with you if you submit a form; until then, it is anonymous. We keep these events for up to 12 months. Third-party tools (Google Analytics, Meta) still depend on your consent in the cookie notice.
11. Security
The website operates exclusively over HTTPS. Data is stored in a managed serverless database with restricted access. No data is transmitted in plain text.
12. Contact
To exercise your rights, request cookie preferences, or ask questions about this policy, send an email to contato@chiarelli.dev.