Privacy Policy

1. Who the controller is

The controller of the data processed on this site is Devx Software, registered under CNPJ (Brazilian company registry) no. 69.491.258/0001-34, headquartered in São Paulo. As a small-scale processing agent, we maintain a direct channel for personal data matters (Resolution CD/ANPD No. 2/2022, art. 11, issued by ANPD, Brazil's National Data Protection Authority): the contact form with the subject Privacy.

2. Data we collect

Contact form. Name, email, company (optional), subject and message — provided by you so that we can reply.

Product whitelist. Name, email, phone (optional), company (optional), product of interest, message (optional), whether you agreed to receive news (optional and separate) and the record of your consent: date, version of the terms and the confirmation made through the link sent to your email. We also keep the approximate location (country and city, provided by Cloudflare) and the page from which you signed up.

Emails we send. To confirm delivery, we record the recipient, subject, date and delivery status. The content of the messages is deleted from our queue 90 days after sending.

Bot protection. When enabled, Cloudflare Turnstile analyzes technical browser signals on forms to tell people apart from bots, without advertising cookies.

Audience measurement. Page visited, referring site (domain only), campaign parameters (utm), approximate network location (country, state and city, provided by Cloudflare), device type, browser and operating system (name only, no version) and clicks on navigation elements. The IP address and browser are used only to compute an anonymous identifier that changes every day; the IP is not stored. We do not use cookies for this.

On-page feedback. When you use the “Feedback” button, we receive the page, the spot you marked (the element and the position within it, if you marked one), the type (suggestion, problem or praise), the text you wrote, the window size, the browser and operating system (name only) and, if you provide it, your email. We do not keep your name or IP, we do not record the screen and we do not log anything outside the form.

Theme and language preferences. Your choice between light and dark theme and your choice between Portuguese and English are saved in your browser's local storage and are never sent to our servers.

3. Purposes and legal bases

The legal bases below refer to the LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law, Law No. 13,709/2018).

• Replying to messages sent through the form — preliminary procedures related to a contract, at your request (art. 7, V, of the LGPD), when the message concerns hiring or a commercial proposal; and legitimate interest (art. 7, IX) in other cases, such as questions, support and partnerships.
• Managing the whitelist, confirming your email and notifying you when access to the product opens — consent (art. 7, I, of the LGPD), which you can revoke at any time through the unsubscribe link in every email.
• Sending Devx news, only if you checked that option — specific and separate consent (art. 7, I, and art. 8, § 4, of the LGPD).
• Understanding aggregate use of the site in order to improve it — legitimate interest (art. 7, IX, and art. 10 of the LGPD), with minimal data and without identifying you: the anonymous identifier changes every day and the IP is not stored.
• Receiving and analyzing feedback sent through the “Feedback” button to improve the site and, if you leave your email, replying — legitimate interest (art. 7, IX, of the LGPD).
• Keeping the site secure and preventing abuse (submission limits, anti-spam filters and bot verification) — legitimate interest (art. 7, IX).
• Keeping the record of your consent and of the emails sent as evidence — regular exercise of rights (art. 7, VI) and the controller's duty to demonstrate that consent was obtained (art. 8, § 2, of the LGPD).

When the legal basis is legitimate interest, you may object to the processing through the same privacy channel (art. 18, § 2, of the LGPD).

4. Sharing

We do not sell personal data. To keep the site running, data is processed by the processors below, who act under our instructions:

• Hostinger — server (VPS in Brazil) that runs the site, and the email service used to send and reply to messages.
• Supabase — database, hosted in the São Paulo region.
• Cloudflare — DNS, delivery network, attack protection and bot verification (Turnstile). All access to the site goes through it.

Cloudflare operates a global network, so part of the traffic may be processed outside Brazil. This international transfer relies on the contractual data protection safeguards offered by the provider (art. 33 of the LGPD). We also share data when required by law or by a court order. No third-party tracking script is loaded by default.

5. Retention

• Contact messages: up to 24 months after receipt; after that they are deleted automatically. If the conversation results in a contract, the data then follows the contract and the applicable legal retention periods.
• Whitelist: unconfirmed sign-ups are deleted within 30 days; confirmed ones are kept until you leave the list or until 6 months after the product's public launch, whichever comes first.
• Log of emails sent: content deleted after 90 days; the delivery record (recipient, subject, date and status) is kept as proof of delivery.
• On-page feedback: up to 12 months after submission; after that it is deleted automatically.
• Audience events: up to 400 days, in aggregate form and without personal identification.

6. Your rights

Under art. 18 of the LGPD, you may request confirmation of processing, access, correction, anonymization, portability, deletion and information about sharing, and you may revoke consent where it is the legal basis. Send your request through the contact form with the subject Privacy. We reply immediately in simplified form and with the full statement within 15 days. To leave the whitelist, use the link included in every email we send.

7. Security

We use an encrypted connection (HTTPS), security headers, a restrictive content policy, request rate limiting and restricted access to the admin panel. No system is infallible; relevant incidents will be reported as required by law.

8. Changes to this policy

Relevant changes will be published on this page and announced in Updates before they take effect.