Privacy Policy
How IAMV Consulting collects, uses, stores, and deletes the personal data processed on this website, under Brazilian Law 13.709/2018 (LGPD).
Last updated: July 31, 2026
1. Who the controller is
IAMV CONSULTING LTDA, registered under Brazilian company number (CNPJ) 58.468.168/0001-06, located at R Arcelina de Souza Brand, 788, Sala — Vila Antonio David — Anitápolis/SC — CEP 88.475-000, Brazil, is the controller of the personal data processed on this website.
Privacy contact and channel for exercising your rights: igorazevedo3@gmail.com.
2. What we collect
We collect three things: what you type into the contact form, a basic record of your navigation on the site, and the audience and performance metrics measured by Vercel, our hosting provider. Nothing beyond that.
Contact form — required: name, email, and message. Optional: phone, company, and the selected area of interest. Along with the submission, the site also records the language version you were using, the page the form was sent from, whether you ticked the WhatsApp contact checkbox, and the visit identifier described in section 3.
Navigation — for each page you open, we record:
- the visit identifier (iamv_vid cookie);
- the path of the page you opened;
- the referring page (referrer), when your browser sends it;
- the campaign parameters in the URL: utm_source, utm_medium, utm_campaign, utm_term, and utm_content;
- the language version of the site (pt or en);
- the browser user-agent (the browser, version, and operating system string your browser sends);
- the date and time of the record.
IP address — used only at the moment of the request, in server memory, to cap how many submissions and page records come from a single origin and to contain automated abuse. The IP is not written to the database and is not linked to your contact record.
If you submit the form from the same browser you browsed with, the visit identifier is stored alongside your contact record. In practice, this lets us see which pages were visited before you got in touch. We do not collect sensitive data, we do not buy lists, and we make no automated decisions about you.
4. Why we process it, and on what legal basis
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact form data | Reply to you, understand your request, and hold the commercial conversation | Legitimate interest (art. 7, IX) — you reached out to the consultancy on your own initiative and expect an answer |
| Phone number for WhatsApp contact | Contact you on WhatsApp at the number you provided | Consent (art. 7, I) — only if you tick the checkbox in the form; the choice is recorded |
| Visit records (pages, referrer, UTM, user-agent, language) | Measure audience, understand where traffic comes from, and improve the site | Legitimate interest (art. 7, IX) |
| IP address held in memory | Cap submissions per origin and contain automated abuse of the public endpoints | Legitimate interest (art. 7, IX) — service security |
| Vercel Web Analytics and Speed Insights | Measure audience in aggregate and monitor the technical performance of the pages | Legitimate interest (art. 7, IX) — cookieless measurement that does not identify you |
| Monthly traffic aggregate | Keep the historical audience series after the purge | Anonymized data — no identifier, outside the scope of the LGPD (art. 12) |
We do not use your data for mass marketing, newsletters, behavioral advertising, data enrichment, or sale to third parties. This site has no mailing list.
Where processing relies on legitimate interest, you may object to it at any time through the channel in section 7.
5. How long we keep it
The periods below are implemented: an automated job runs every day and deletes from the database everything past its deadline. This is not a policy intention — it is what the code executes.
| Data | Retention | What happens at the end |
|---|---|---|
| Contact form submissions (leads table) | 24 months from submission | The record is permanently deleted |
| Visit records (visits table) | 12 months from the visit | The record is permanently deleted, after the aggregate below is generated |
| Monthly aggregate (visit_stats_monthly table) | No deadline | Kept: it holds only pageview and visitor counts per month, page, and traffic source — no visit identifier, IP, or user-agent |
Two honest exceptions to the automated deadline. First: the new-contact notification arrives by email in IAMV’s inbox and is not removed by the job — it follows the email provider’s retention and is deleted on request. Second: if a technical failure prevents us from both storing and emailing what you wrote, the form content is written to the server log so the contact is not lost and can be picked up manually; that log follows the hosting provider’s retention. This is a fallback path, not normal operation.
7. Your rights
Art. 18 of the LGPD grants you, at any time and free of charge:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed unlawfully;
- portability to another provider, upon express request;
- deletion of data processed on the basis of your consent;
- information about who we share your data with;
- information about the option not to consent and what follows from that;
- withdrawal of consent — in our case, for WhatsApp contact;
- objection to processing based on legitimate interest.
To exercise any of these, write to igorazevedo3@gmail.com. We respond within 15 days, as required by art. 19, II of the LGPD. We may ask for additional information to confirm the request really comes from the data subject — that protects you, it is not an obstacle.
You may also file a complaint with the Brazilian Data Protection Authority (ANPD).
8. How to opt out of measurement
If you would rather not be counted in our audience measurement, add ?analytics=off to the address of any page on the site and load it once. That sets a flag in your browser which switches off both Vercel Web Analytics and our own visit tracking. Speed Insights, which measures only loading times and does not identify you, stays active — it has no per-visitor switch.
- To be counted again: open any page with ?analytics=on.
- The flag applies per browser and per device, and disappears if you clear the site’s data.
- Opting out does not affect the contact form: if you write to us, we process what you send under this policy.
9. Security
- Database tables have Row Level Security enabled with no public access policies: no visitor reads from or writes to them directly — every write goes through the site’s server.
- The visit cookie is httpOnly and Secure, and cannot be read by page scripts.
- The public write endpoints verify the request origin and apply a per-IP rate limit.
- The scheduler runs in an isolated iframe, with no third-party script loaded inside the site.
No measure removes risk entirely. If we identify a security incident posing relevant risk to you, we will notify you and the ANPD, as required by art. 48 of the LGPD.
10. Changes to this policy
This policy changes when the site changes. The version in force is always the one published on this page, and the last-updated date at the top lets you check whether anything changed since you last read it.