Privacy Policy

In Short: MX PM Consulting is the controller of your personal data. Reach our privacy channel at privacy@mxpmconsulting.com.

Controller. M. RICARDO CABRAL XIMENES CONSULTORIA EM TECNOLOGIA LTDA, registered at 2001 R. Verbo Divino, SALA 305 TORRE B ANDAR 3, São Paulo, São Paulo 04719-002, Brazil.

Data protection contact (Encarregado channel). privacy@mxpmconsulting.com. Under LGPD Article 41 and ANPD Resolution CD/ANPD No. 2/2022, small-sized processing agents are exempt from formally designating a Data Protection Officer, provided we maintain a clear, functional, and accessible communication channel with data subjects — this email address is that channel, and requests are handled personally by our founder.

In Short: We collect what you submit through our contact form, plus limited technical data collected automatically, and (only with your consent) analytics data.

Data you provide to us

When you use our contact form, we collect: your name, email address, company name, country, project type, a free-text project brief, and your budget range. We also record the page you submitted the form from and your selected language.

Sensitive data. We do not intentionally request or process sensitive personal data (e.g., health information, racial or ethnic origin, religious belief, or political opinion) through our Services. Please do not include such information in your project brief.

Data collected automatically

When you submit our contact form, our servers automatically record your IP address and browser user-agent string, for fraud-prevention and security purposes.

If you accept analytics cookies (see “Cookies and Similar Technologies” below), Google Analytics collects standard usage data such as pages viewed, approximate location (city/country level), device and browser type, and referring pages. If you do not accept, none of this is collected.

In Short: We only process your personal data when we have one of the legal bases listed in LGPD Article 7.

• Execution of a contract or preliminary procedures requested by you (Art. 7, V): processing your contact-form submission to respond to your inquiry and prepare a proposal.
• Consent (Art. 7, I): use of non-essential cookies and Google Analytics; you may withdraw this consent at any time (see “Cookies and Similar Technologies” below).
• Legitimate interests (Art. 7, IX): fraud prevention, information security, and improving our Services, always balanced against your fundamental rights and freedoms.
• Compliance with a legal obligation (Art. 7, II): retaining records as required by Brazilian tax, accounting, or civil law.

In Short: We use your data to respond to you, run our Services securely, and, only with consent, to measure site usage.

• To respond to your inquiry and prepare a proposal for our services.
• To send you service-related communications (such as confirming receipt of your message) and, only with your consent, occasional marketing communications you can opt out of at any time.
• To analyze aggregate usage of the Site, only if you have accepted analytics cookies, so we can improve it.
• To maintain the security and proper functioning of our Services and prevent fraud or abuse.
• To comply with legal and regulatory obligations.

In Short: We share your data only with the service providers (“operators”) that help us run our Services — never for their own marketing purposes, and we do not sell your data.

• Supabase — database hosting and backend infrastructure for our contact form and email delivery.
• Vercel — content delivery network (CDN) hosting our website.
• Lovable / Mailgun — our transactional email provider, used to reply to your inquiry and to notify us of new leads.
• Cal.com — our scheduling provider, only if you use the embedded scheduler or booking link on our Contact page (the embed loads only after you accept cookies, or you may open it in a new tab instead).
• Google Analytics — website usage analytics, only if you accept analytics cookies (see “Cookies and Similar Technologies” below).

We may also disclose your data if required by law, court order, or valid governmental request, or in connection with a merger, acquisition, financing, or sale of company assets. We do not sell your personal data.

In Short: Some of our service providers store data outside Brazil, primarily in the United States, under contractual safeguards.

Our Services are hosted globally via Vercel's CDN and Supabase's cloud infrastructure, with primary data storage in the United States. Where our providers process your personal data outside Brazil, we rely on the mechanisms permitted by LGPD Article 33, including contractual clauses with our providers and, where applicable, the transfer being necessary to provide the Services you requested (for example, replying to your inquiry).

You may request a copy of the relevant contractual safeguards, excluding any trade secrets, by writing to privacy@mxpmconsulting.com; we will respond within 15 days.

In Short: Non-essential cookies (Google Analytics, Cal.com) load only if you accept them in our cookie banner, and you can change your choice at any time.

Essential storage. We store your language preference and your cookie choice in your browser's local storage. These are strictly necessary for the Site to function and do not require consent.

Non-essential cookies (require your consent). If you click “Accept” on our cookie banner, we load:

• Google Analytics — sets cookies (e.g., _ga) to measure Site usage. See Google's Privacy Policy. You can also opt out of Google Analytics tracking generally at https://tools.google.com/dlpage/gaoptout.
• Cal.com — our scheduling embed, which may set its own cookies once loaded on our Contact page.

If you click “Reject,” or make no choice, none of the above load and no non-essential cookies are set. You can change your choice at any time using the “Cookie preferences” link in the footer of every page.

In Short: We keep contact-form submissions for up to 24 months after our last interaction with you, unless a longer period is required by law.

We retain the personal data submitted through our contact form for up to 24 months from your last interaction with us, after which it is deleted or anonymized, unless a longer retention period is required by Brazilian tax, accounting, or civil law. Email delivery logs are retained for up to 12 months for security and troubleshooting purposes. If we have no ongoing legitimate need to process your data and cannot delete it immediately (for example, because it is stored in a backup archive), we isolate it from further processing until deletion is possible.

In Short: Under LGPD Article 18, you have a full set of rights over your personal data, plus the right to lodge a complaint with the ANPD.

Subject to applicable law, you have the right to:

• Confirmation of whether we process your personal data;
• Access to your personal data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD;
• Portability of your data to another provider, upon your express request;
• Deletion of personal data processed with your consent;
• Information about the public and private entities with which we have shared your data;
• Information about the possibility of denying consent and the consequences of doing so;
• Withdrawal of your consent at any time; and
• Review of decisions made solely through automated processing that affect your interests (we do not currently use automated decision-making).

To exercise any of these rights, contact privacy@mxpmconsulting.com. We will respond within the timeframes required by the LGPD.

You also have the right to lodge a complaint with Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD) at https://www.gov.br/anpd.

In Short: We do not knowingly collect data from, or market to, anyone under 18.

We do not knowingly collect, solicit, or process personal data from children or teenagers under 18 years of age, nor do we knowingly market to them. By using the Services, you represent that you are at least 18. If we learn that personal data from a user under 18 has been collected, we will take reasonable measures to promptly delete it from our records. If you believe we may have collected data from a minor, contact us at privacy@mxpmconsulting.com.

In Short: Yes, we will update this notice as necessary to remain compliant with applicable law.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised “Last updated” date at the top of this notice. If we make material changes, we will notify you by prominently posting a notice on the Site. We encourage you to review this notice periodically.

For any privacy question or to exercise your rights, contact our privacy channel:

M. RICARDO CABRAL XIMENES CONSULTORIA EM TECNOLOGIA LTDA
2001 R. Verbo Divino, SALA 305 TORRE B ANDAR 3
São Paulo, São Paulo 04719-002
Brazil
Email: privacy@mxpmconsulting.com
Phone: (+55) 11 95372-1380