Privacy Policy

Inky Digital, registered in Brazil under CNPJ 38.181.372/0001-34 ("Inky", "we"), is the controller of the personal data processed on the website inkydigital.com.br, in its forms, in the newsletter and in our support channels (email and WhatsApp).

This policy does not apply to data we process within projects contracted by clients. In those cases, Inky acts as a processor, following the client's instructions and the terms of the contract.

By using the site, you confirm that you have read this policy. Where consent is required, it is requested separately and can be withdrawn at any time.

Data you give us

• Contact form: name, email, company (optional), phone (optional) and your message.
• Project briefing (optional, offered after the first contact): email, job title, website and your answers about your operation, the systems you use, the problem to solve, its impact and who takes part in the decision.
• Tools (the calculators and tests on the pages at inkydigital.com.br/ferramentas/, available in Portuguese only): calculations run in your browser, and the numbers you type are not sent to Inky. Only when you ask for a person's review do we receive your name, email, company, WhatsApp number and job title (the last three optional), your answer to the tool's question and, if you tick the option, the result you calculated. Without that option ticked, the result is not stored. In the invoice tool, the CNPJ (Brazilian company registration number) you type is sent to Inky and looked up on BrasilAPI, which gathers public data from Brazil's Federal Revenue Service, only to show the company's tax regime: the lookup is neither stored nor linked to you. Any invoice XML you test is read in your browser and sent to no one. In the contact X-ray tool, Inky opens the website address you type as a regular visitor would, queries the domain's public DNS and, when the speed test is enabled, sends the address to Google PageSpeed Insights. The report is built on the spot and is not stored.
• Newsletter: email, confirmed by double opt-in.
• WhatsApp and email: name, phone number, email address and the content of the conversation.

Data we obtain from public sources

When you contact us about a project, we look up public information about the company you mention, to prepare for the conversation: company registration data published by Brazil's Federal Revenue Service, the company's website and equivalent public records.

The purpose is a single one: to arrive at the conversation already understanding your business, instead of spending the meeting asking about what is already public. The legal basis is legitimate interest (LGPD, art. 7, IX) in steps preliminary to a contract, and you can ask us to delete this research at any time through the channels in the Your rights section. We do not buy lists and we do not look up any data that is not publicly available.

Data collected automatically

• Access logs: IP address, date and time, browser and operating system.
• Bot check: technical signals from the browser and connection (such as IP and User-Agent), analyzed by Cloudflare Turnstile when you submit a form.
• Browsing: pages visited, visit source, device type, approximate region and time on page.
• Contact source: when you submit a form, we record with your message the page where you entered the site, the page where you submitted it, the referring site and the link's campaign parameters (utm), so we know which channels bring in conversations. With analytics consent, this source is kept in your browser for up to 30 days; without it, until you close the tab.
• Interaction (only with consent): clicks, scrolling and cursor movements, recorded by Microsoft Clarity.

We do not ask for sensitive data (such as health, religion or biometrics). Please do not send it through our channels.

Each use has a defined purpose and a legal basis under the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018, art. 7):

We do not use your data for automated decisions that affect your interests, nor to train artificial intelligence models.

Cookies are small files stored in your browser. We use three categories:

• Necessary: they keep the site secure and working, such as storing your cookie choice and the Cloudflare Turnstile bot check, which runs in invisible mode, with no challenge on screen, and follows the Turnstile Privacy Addendum. They cannot be turned off by the site.
• Analytics (Google Analytics): such as _ga and _ga_*, which tell visits and sessions apart.
• Experience (Microsoft Clarity): such as _clck, _clsk, CLID and MUID, which group the interactions of a single visit.

Analytics and experience cookies are only turned on after you consent in the cookie notice. You can change your choice at any time with the button below, delete cookies in your browser settings or use the Google Analytics opt-out browser add-on. Blocking necessary cookies may prevent forms from being submitted.

We only share data with vendors that run the site on our behalf, to the extent each service requires:

We may also share data with public authorities when required by law or court order, with legal and accounting advisors bound by confidentiality, and with a possible successor in the event of a corporate reorganization, which will be bound by this same policy.

We do not sell or rent personal data.

Some of the vendors above store data outside Brazil, mainly in the United States and the European Union. These transfers follow art. 33 of the LGPD and are covered by contractual clauses and data protection safeguards offered by each vendor.

• Inquiries and business conversations: for as long as needed to handle the request and, after that, for up to 5 years, for the regular exercise of rights.
• Newsletter: until you unsubscribe.
• Google Analytics: up to 14 months.
• Microsoft Clarity: for the retention period Microsoft sets for the service.
• Access logs: 6 months, as required by the Brazilian Internet Civil Framework.

Once the period ends, the data is deleted or anonymized, unless the law allows or requires it to be kept.

We use an encrypted connection (HTTPS), need-to-know access, protection against bots and abuse on forms, and vendors with recognized security standards.

No system connected to the internet is completely invulnerable. If a security incident occurs that may cause significant risk or harm, we will notify Brazil's National Data Protection Authority (ANPD) and the affected data subjects, as required by art. 48 of the LGPD.

Under art. 18 of the LGPD, you can request, at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• portability of your data to another provider;
• deletion of data processed on the basis of consent;
• information about who we share your data with;
• information about the option not to consent and its consequences;
• withdrawal of consent;
• objection to processing based on legitimate interest, when the law is not being complied with.

To exercise any of these rights, write to atendimento@inkydigital.com.br. We may ask for information to confirm your identity before responding. We reply within 15 days. You can also file a complaint with the ANPD.

To unsubscribe from the newsletter, use the link at the end of any issue.

Questions, requests and complaints about personal data go to our data protection officer: atendimento@inkydigital.com.br.

This policy is governed by the laws of Brazil. The courts of the city of São Paulo (SP), Brazil, have jurisdiction, except where the law grants jurisdiction to the data subject's place of residence.