Privacy Policy
How IAMV Consulting collects, uses, stores, and deletes the personal data processed on this website, under Brazilian Law 13.709/2018 (LGPD).
Last updated: August 21, 2026
1. Who the controller is
IAMV CONSULTING LTDA, registered under Brazilian company number (CNPJ) 58.468.168/0001-06, located at R Arcelina de Souza Brand, 788, Sala — Vila Antonio David — Anitápolis/SC — CEP 88.475-000, Brazil, is the controller of the personal data processed on this website.
Privacy contact and channel for exercising your rights: igorazevedo3@gmail.com.
2. What we collect
We collect five things: what you type into the contact form, the scheduling data Cal.com sends to the site, the answers you give to the recommendation simulator, a basic record of your navigation on the site, and the audience and performance metrics measured by Vercel, our hosting provider. Nothing beyond that.
Contact form — required: name, email, and message. Optional: phone, company, and the selected area of interest. Along with the submission, the site also records the language version you were using, the page the form was sent from, whether you ticked the WhatsApp contact checkbox, and the visit identifier described in section 3.
Scheduling — when you complete a booking on Cal.com, it sends the site the standard booking-created payload through a signed webhook; while Vercel processes it, that payload may contain booking, organizer, and attendee details. In Supabase, the site stores only the first attendee’s data (name, email, phone if provided, language/locale, and time zone), the event title, start and end times, notes if provided, Cal.com as the source, and the booking’s unique identifier (UID). Additional attendees are not stored, and the booking is not associated with the visit cookie or the page you viewed.
Recommendation simulator — when you are about to leave the site, an invitation may appear asking you to answer three multiple-choice questions (what you need, the size of your team, and your budget range) and showing which services best fit your case. If you answer, the site stores only the options you picked, the services recommended, the language version of the site, the page where the simulator was answered, and the visit identifier described in section 3. There is no open field on that screen: the options come from a closed list. No name, email, or free text is asked for or stored here — if you go on to book a call, your contact details reach us only through Cal.com, as described above.
Navigation — for each page you open, we record:
- the visit identifier (iamv_vid cookie);
- the path of the page you opened;
- the referring page (referrer), when your browser sends it;
- the campaign parameters in the URL: utm_source, utm_medium, utm_campaign, utm_term, and utm_content;
- the language version of the site (pt or en);
- the browser user-agent (the browser, version, and operating system string your browser sends);
- the identifiable section of the page, when a catalogued anchor is visible;
- the date and time of the record.
IP address — used only at the moment of the request, in server memory, to cap how many submissions and page records come from a single origin and to contain automated abuse. The IP is not written to the database and is not linked to your contact record.
If you submit the form from the same browser you browsed with, the visit identifier is stored alongside your contact record. In practice, this lets us read the order of pages and catalogued sections visited before you got in touch, with the granularity needed to understand the journey. We do not collect sensitive data, we do not buy lists, and we make no automated decisions about you.
4. Why we process it, and on what legal basis
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact form data | Reply to you, understand your request, and hold the commercial conversation | Legitimate interest (art. 7, IX) — you reached out to the consultancy on your own initiative and expect an answer |
| Scheduling data received from Cal.com | Record the booking, prepare the diagnostic call, and conduct the requested commercial contact | Legitimate interest (art. 7, IX) — you requested the booking on your own initiative |
| Phone number for WhatsApp contact | Contact you on WhatsApp at the number you provided | Consent (art. 7, I) — only if you tick the checkbox in the form; the choice is recorded |
| Recommendation simulator answers | Recommend the services that best fit your case and measure whether the recommendation convinces | Legitimate interest (art. 7, IX) — you chose to answer, and the answers are options from a closed list, with no name, email, or free text |
| Visit records (pages, catalogued sections, referrer, UTM, user-agent, language) | Measure audience, understand where traffic comes from, and improve the site | Legitimate interest (art. 7, IX) |
| Conversion events (CTA clicks, submission attempts and their outcome, WhatsApp clicks, exit invitation cycle) | Understand where the contact journey stalls — how many submission attempts failed and why, and whether the exit invitation helps or gets in the way | Legitimate interest (art. 7, IX) — measuring our own site |
| IP address held in memory | Cap submissions per origin and contain automated abuse of the public endpoints | Legitimate interest (art. 7, IX) — service security |
| Vercel Web Analytics and Speed Insights | Measure audience in aggregate and monitor the technical performance of the pages | Legitimate interest (art. 7, IX) — cookieless measurement that does not identify you |
| Monthly traffic aggregate | Keep the historical audience series after the purge | Anonymized data — no identifier, outside the scope of the LGPD (art. 12) |
We do not use your data for mass marketing, newsletters, behavioral advertising, data enrichment, or sale to third parties. This site has no mailing list.
Where processing relies on legitimate interest, you may object to it at any time through the channel in section 7.
5. How long we keep it
The periods below are implemented: an automated job runs every day and deletes from the database everything past its deadline. This is not a policy intention — it is what the code executes.
| Data | Retention | What happens at the end |
|---|---|---|
| Contact form submissions and Cal.com bookings (leads table) | 24 months from the database record | The record is permanently deleted |
| Visit records (visits table) | 12 months from the visit | The record is permanently deleted, after the aggregate below is generated |
| Recommendation simulator answers (simulator_results table) | 12 months from the answer | The record is permanently deleted. It stores only the options chosen and the services recommended — no name, email or free text |
| Monthly aggregate (visit_stats_monthly table) | No deadline | Kept: it holds only pageview and visitor counts per month, page, and traffic source — no visit identifier, IP, or user-agent |
Two honest exceptions to the automated deadline. First: the new-contact or booking notification arrives by email in IAMV’s inbox and is not removed by the job — it follows the email provider’s retention and is deleted on request. Second: if a technical failure prevents us from both storing and emailing what you wrote in the form, that content is written to the server log so the contact is not lost and can be picked up manually. In that record the content is encrypted: anyone with access to the log cannot read it, and only IAMV, using a key kept outside the hosting provider, can open it. All that stays readable in the log is an incident identifier, which does not say who you are. That record follows the hosting provider’s retention. This is a fallback path, not normal operation.
7. Your rights
Art. 18 of the LGPD grants you, at any time and free of charge:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed unlawfully;
- portability to another provider, upon express request;
- deletion of data processed on the basis of your consent;
- information about who we share your data with;
- information about the option not to consent and what follows from that;
- withdrawal of consent — in our case, for WhatsApp contact;
- objection to processing based on legitimate interest.
To exercise any of these, write to igorazevedo3@gmail.com. We respond within 15 days, as required by art. 19, II of the LGPD. We may ask for additional information to confirm the request really comes from the data subject — that protects you, it is not an obstacle.
You may also file a complaint with the Brazilian Data Protection Authority (ANPD).
8. How to opt out of measurement
If you would rather not be counted in our audience measurement, add ?analytics=off to the address of any page on the site and load it once. That sets a flag in your browser which switches off Vercel Web Analytics, our own visit tracking and the conversion-event tracking. Speed Insights, which measures only loading times and does not identify you, stays active — it has no per-visitor switch.
- To be counted again: open any page with ?analytics=on.
- The flag applies per browser and per device, and disappears if you clear the site’s data.
- Opting out does not affect the contact form or scheduling: we process what you send through those channels under this policy.
9. Security
- Database tables have Row Level Security enabled with no public access policies: no visitor reads from or writes to them directly — every write goes through the site’s server.
- The visit cookie is httpOnly and Secure, and cannot be read by page scripts.
- The form and visit endpoints verify request origin and apply a per-IP rate limit; the Cal.com webhook validates an HMAC-SHA256 over the raw body before processing its content.
- The scheduler runs in an isolated iframe, with no third-party script loaded inside the site.
No measure removes risk entirely. If we identify a security incident posing relevant risk to you, we will notify you and the ANPD, as required by art. 48 of the LGPD.
10. Changes to this policy
This policy changes when the site changes. The version in force is always the one published on this page, and the last-updated date at the top lets you check whether anything changed since you last read it.