Privacy policy
Effective October 22, 2026 · version 1.0
This policy explains, in plain language, what personal data HandNexus processes on this website, why, for how long, who we share it with and how you can exercise your rights. It follows Brazil’s General Data Protection Law (Law No. 13,709/2018, “LGPD”) and the rules of the Brazilian Data Protection Agency (ANPD). The Portuguese version prevails over this translation.
1. Who is responsible for your data
The data controller is HandNexus Soluções de Marketing Ltda., Brazilian taxpayer ID (CNPJ) 63.336.605/0001-78, Alameda Rio Negro, 503, suite 2020, Alphaville, Barueri/SP, ZIP 06454-000, Brazil.
Privacy channel: contato@handnexus.com, subject “Privacy”. This is how you reach the person responsible for data protection at HandNexus.
2. What data we process, why and on what legal basis
| What | Why | Legal basis (LGPD) |
|---|---|---|
| Business Diagnosis answers (business context, goal, challenges, self-assessment and any indicators you choose to share) | To generate your report and, if you ask, prepare the in-depth conversation | Steps prior to a contract, at your request (art. 7, V) |
| Diagnosis contact details: name, company name, e-mail and WhatsApp; CNPJ or EIN only if you choose to provide it | To deliver the report and talk to you about it | Art. 7, V |
| Contact and meeting requests: name, e-mail, WhatsApp, company and message | To reply to your request and schedule the conversation | Art. 7, V, and legitimate interest in replying to people who contact us (art. 7, IX) |
| Marketing opt-in (separate, unchecked box) | To send HandNexus content and invitations by e-mail and WhatsApp | Consent (art. 7, I), which you can withdraw anytime |
| Access log: IP address, date and time of form submissions | To comply with Brazil’s Internet Civil Framework (art. 15) and investigate abuse | Legal obligation (art. 7, II) |
| Abuse control: an irreversible code derived from the IP that changes every day | To limit repeated attempts and bots | Legitimate interest in protecting the service (art. 7, IX) |
| Preferences in your browser: language, cookie choices and the diagnosis draft | To make the site work the way you chose | Legitimate interest (strictly necessary) |
What we never ask for: personal tax numbers (CPF or SSN), passwords, card details, health data or other sensitive data, or data about your customers. Exact revenue is never required. Free-text fields are for describing the business; please avoid entering other people’s personal data.
We do not sell or rent personal data.
3. How artificial intelligence is used
- The diagnosis report is written by an AI model from OpenAI, acting as a processor on our behalf and under our instructions.
- The AI receives only your answers about the business. Your name, e-mail, WhatsApp and CNPJ/EIN are not sent. Before sending, e-mail addresses, phone numbers and ID numbers typed into text fields are automatically masked.
- We ask the provider not to store the conversation (
store: false). Under OpenAI’s policy, API data is not used to train models by default and may be kept in security logs for up to 30 days. - Averages, coverage and priorities are calculated by fixed method rules, not by the AI. The report is guidance, not a decision about you. If you wish, our team reviews the result with you in the in-depth conversation (LGPD, art. 20).
4. Who we share data with
Only with providers needed to run the site, all contractually bound to protect the data:
- Supabase (database and diagnosis server), with data stored in the United States;
- OpenAI (AI-written report), in the United States;
- HostGator (website hosting);
- Titan (the contato@handnexus.com mailbox), when you write to us or we reply.
We may also share data when required by law or by order of a competent authority.
5. International data transfer
To generate the report and store your diagnosis, the data described above is transferred to the United States, where Supabase and OpenAI servers are located.
- Purpose: to store the diagnosis and write the report you requested.
- Duration: as set out in section 6. OpenAI does not store the data after the response, except for security logs of up to 30 days.
- Basis: the transfer is necessary to carry out the procedure you requested (LGPD, art. 33, IX, together with art. 7, V), and our providers adopt contractual data protection clauses.
- Security: data travels encrypted (HTTPS), is kept in a database that is not exposed to the public internet, with access restricted to the responsible team, and only business answers, without contact details, are sent to the AI.
- Responsibilities: HandNexus is responsible as controller; providers act as processors within our instructions.
You can request a copy of the applicable contractual safeguards through the privacy channel, and you have the rights in section 8, including the right to petition the ANPD.
6. How long we keep data
| Data | Period |
|---|---|
| Diagnosis (answers, report and contact details) | 12 months from submission, or until you ask us to delete it |
| Contact and meeting requests | 24 months |
| Record of consent and of the notice shown | 5 years, to prove your choice |
| Marketing opt-in | Until you withdraw consent |
| Access log (IP, date and time) | 6 months |
| Abuse control (IP-derived code) | Up to 48 hours |
| Preferences and draft in your browser | Until you delete them or complete the diagnosis |
When the period ends, data is deleted automatically. If you become a client, relationship data follows the contract and applicable legal periods.
7. Security
We built security in from the start: encrypted connection (HTTPS with HSTS), a content security policy that blocks third-party scripts, a database outside the public interface with restricted access, secret report links (we store only a fingerprint of them), abuse limits, data minimization and automatic deletion.
No system is fully invulnerable. If a security incident may cause relevant risk or harm, we will notify the ANPD and the people affected within the regulatory deadlines.
8. Your rights
At any time and free of charge (LGPD, art. 18), you can:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of unnecessary or unlawfully processed data;
- request data portability;
- request deletion of data processed with your consent, and withdraw consent;
- find out who we share your data with;
- be informed about the possibility of not consenting and its consequences;
- request review of automated decisions;
- object to processing carried out without consent when the law is not being followed.
How to ask: write to contato@handnexus.com with the subject “Privacy”. For the diagnosis, you can also use the “Delete this diagnosis and my data” button at the end of the report, which erases everything immediately. We reply within 15 days. To protect you, we may ask you to confirm your identity before delivering or deleting data.
You may also file a complaint with the ANPD (gov.br/anpd) and consumer protection bodies.
9. Cookies
We use only the storage needed for the site to work. See the Cookie Policy.
10. Children
This site is intended for businesses and their representatives. We do not knowingly collect data from anyone under 18.
11. Changes to this policy
If we change this policy, we will publish the new version here with its date. When a change affects a choice you made based on consent, we will let you know prominently beforehand.
12. For people in the United States
HandNexus does not sell or “share” personal information for cross-context behavioral advertising. Marketing e-mails are sent only with your consent and always include an unsubscribe link, which we honor within 10 business days. Marketing WhatsApp messages also require your opt-in, and you can reply “STOP” at any time.