Privacy Policy

Who processes your data

PontoHub — Pontohub Brasil Ltda, registered under CNPJ no. 10.516.577/0001-04, headquartered at Estrada do Galeão, 1261, Jardim Guanabara, Rio de Janeiro — RJ, postcode 21931-052, Brazil — is the controller of the personal data described here.

For anything concerning personal data, including exercising the rights listed below, write to [email protected]. Our data protection officer is Tiago Antunes.

What this site collects

This site has no forms, no sign-up and no login area. We ask for no name, e-mail or phone anywhere. What actually exists is this:

• Stored on your own device: the language you picked and your cookie decision. It stays in the browser and never reaches our servers.
• Technical access logs: IP address, browser, operating system and pages visited, recorded by the infrastructure that serves the site in order to deliver content and block attacks.
• Page language: each language has its own address, and the suggestion to switch comes from your browser settings. That reading never leaves your device and no external geolocation service is queried.
• Audience measurement, only if you allow it: aggregate visit counts, with no identification of who you are.

When you contact us

The WhatsApp button opens a conversation in the app. From there, message handling also follows WhatsApp and Meta rules, over which we have no control. On our side, we keep the history and whatever you tell us — name, company, phone, description of your need — for as long as needed to reply and, if it becomes a project, for the contractual and legal period.

Why we use it and on what legal basis

• Delivering and keeping the site online — legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Security, abuse and fraud prevention — legitimate interest.
• Suggesting the page version in your language — legitimate interest, with no data sent to third parties.
• Measuring audience — consent.
• Replying to commercial enquiries — pre-contractual steps (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Complying with the law and defending rights — legal obligation and regular exercise of rights.

Who we share it with

We do not sell data and we do not hand it over for advertising. It only passes through the providers that keep the operation running:

• Cloudflare, Inc. — hosting, CDN, security and audience measurement.
• Google LLC and Unsplash — fonts and images loaded from their servers, which exposes your IP to those companies.
• WhatsApp / Meta Platforms — only if you start a conversation.
• Public authorities, where there is a legal duty or court order.

International transfers

Some of these providers are outside Brazil and the European Economic Area, mainly in the United States. In those cases processing relies on the European Commission’s standard contractual clauses and on the mechanisms in articles 33 and following of the LGPD.

How long we keep it

• Data in your browser: until you clear it. The cookie decision expires after 12 months and we ask again.
• Technical and security logs: for the provider’s retention period, typically up to 30 days.
• Commercial conversations that do not become projects: 24 months.
• Contract-related data: for the term of the contract and 5 years after it ends.

Security

The site is served over HTTPS only, with HSTS and a Content-Security-Policy restricting where scripts, styles and images may come from. It stores no data about you, which in itself greatly reduces the attack surface. No measure removes risk entirely: should a significant incident occur, we will notify you and the authorities within the legal deadlines.

Your rights

The LGPD (art. 18) and the GDPR (arts. 15–22) give you: confirmation that processing exists and access to the data; correction of anything incomplete or outdated; anonymisation, blocking or deletion of unnecessary or unlawfully processed data; portability; information about who we share with; withdrawal of consent at any time; and objection to processing based on legitimate interest.

To exercise any of them, write to [email protected]. We reply within 15 days. If you are not satisfied, you may complain to the ANPD in Brazil or the CNPD in Portugal.

Automated decisions and minors

We make no automated decisions with legal effect about visitors to this site. The site is aimed at companies and professionals and we do not knowingly collect data from anyone under 18; if that is identified, we will delete the record.

Changes to this policy

When we change this policy, we update the date at the top of the page. Changes that broaden data processing will be announced on the site before taking effect.

This text was written to be clear and to cover both the LGPD and the GDPR, but it does not replace review by a lawyer before publication.