Privacy Policy

1.Introduction

This policy explains what personal data we collect when you visit thebrfactory.com, in which situations we use it, which tools and partners process it, and what you can do about it.

The controller of your data is .TBF. INC (CNPJ 61.360.565/0001-74), R. Pamplona, 145, Jardim Paulista, São Paulo, SP, 01405-100, Brazil. "We" and "our" mean .TBF. INC.

Personal data is any information that identifies you or can identify you. If you are in the European Union, we also take the GDPR into account, but this policy is written under Brazilian law and we do not promise rights that Brazilian law does not give.

2.What data we collect, and when

We collect data in four situations.

• When you write to usThe Access, Collective and contact forms ask for your name, e-mail address and message. Some forms also ask for an Instagram handle or portfolio link, and which entry point you are writing to. We collect only what you type.
• When you join the mailing listThe newsletter form (page and pop-up) collects your e-mail address. We then send you a welcome message.
• When you answer a surveyOur research questionnaires collect the answers you give, including partial ones. The rules are in the section on research below.
• When you browse the siteOur host receives technical data in standard server logs: IP address, browser and device type, pages requested and date and time. With your consent, analytics tools also record pages visited, time on page, approximate location, referring site and interactions such as clicks and scrolling.

We do not ask for sensitive personal data (LGPD, art. 5, II). Please do not send it in free-text fields. We do not collect payment data on the site. If you do not provide the data a form asks for, you can still read the site, but we cannot answer you or send you the newsletter.

3.Cookies and similar technologies

The first time you visit, a cookie notice asks for your choice. You can accept all, reject the optional ones, or choose by category. You can change your mind at any time through Cookie Preferences in the footer. The choice is kept in your browser for 12 months, then we ask again.

• NecessaryAlways active. Store your cookie choice (localStorage, key tbf-cookie-consent) and small interface flags, such as which stories you have already seen (localStorage) and whether the intro or pop-up has already appeared in this session (sessionStorage). They never leave your device.
• AnalyticsOnly after you accept. They load Vercel Analytics and Speed Insights, and Google Analytics 4. If you reject, or have not chosen yet, none of these scripts load. We do not use advertising or marketing cookies, and we do not build advertising profiles.

4.Legal bases (LGPD, art. 7)

We process your data only when one of these legal bases applies.

• ConsentFor analytics cookies, the mailing list and research questionnaires. You can withdraw it at any time.
• Pre-contractual procedures and contractWhen you write to us about a project, partnership or service, we need your data to answer and, if it goes ahead, to work with you.
• Legitimate interestFor site security, preventing abuse and keeping the site running, always weighed against your rights.
• Legal or regulatory obligationWhen Brazilian law requires us to keep or hand over information.

5.How we use your data

• Answer youRead and reply to messages sent through the forms.
• Send the newsletterSend the welcome message and later editions to people who joined the list. Every message carries an unsubscribe link.
• Understand the siteMeasure which pages are read and how fast they load, to improve content and performance. Only with consent.
• Protect the siteDetect abuse, errors and attacks.
• Meet the lawComply with legal obligations and defend ourselves in legal proceedings.

We do not sell, rent or trade your personal data.

6.Research questionnaires

.TBF. INC conducts market research through online questionnaires, directly or through projects under its incubation, such as CRIVO. This section governs the processing of personal data in such research and, where specific, prevails over the other provisions of this policy.

• Data processedThe answers given to the questionnaire, including partial answers, and technical session metadata: a random session identifier, date and time, device type, time spent on each screen and the point at which the participant stopped. Questionnaires do not ask for name, company, contracts, prices or sensitive personal data.
• Partial answersBy agreeing on the first screen, the participant expressly authorizes the recording of the answers already given, even if the questionnaire is not completed. Such answers are saved periodically while the questionnaire is being filled in and when the page is closed, and are processed for the exclusive purposes of the research, in particular to understand where participants stop and to improve the questionnaire.
• Exclusive purposeData collected in a survey is used exclusively for that research. It is not used for advertising, individual profiling or automated decisions, nor shared with third parties for their own purposes. Results are analyzed and disclosed only in aggregate form, without identifying participants.
• Interview contactIf the participant agrees to be contacted for a later conversation, the contact provided is stored separately from the answers for up to 12 months and then deleted.
• Audio recordingA conversation is recorded only with specific consent, given at the start of the recording. The audio is deleted once the summary is prepared, within 12 months at most. The participant may refuse recording and still take part.
• Legal basis and withdrawalConsent of the data subject (LGPD, art. 7, I), given freely, informed and unambiguously on the first screen. The participant may withdraw consent and request deletion of their data, including partial answers, at any time, through the contact in the last section or the address shown in the questionnaire.
• RetentionAnswers, complete or partial, are kept for as long as needed to complete the research and analyze its results, and are then deleted or anonymized.

7.Tools and partners

These are the services that process data on our behalf or receive it when you use the site. Each one has its own privacy policy.

• VercelHosting and delivery of the site. Receives technical data from every visit (server logs). Vercel Analytics and Speed Insights measure visits and performance, only with consent.
• Google Analytics 4Audience measurement: pages, sessions, approximate location, device. Only with consent, under Google Consent Mode, with denied as the default. Google may process data outside Brazil.
• ResendSends the e-mail notifications of forms and mailing-list sign-ups to our team. Receives the content of your message, name and e-mail address.
• BrevoStores the mailing list and sends the welcome message and newsletters. Receives your e-mail address.
• SanityContent management for articles and pages, and the delivery of their images. It does not receive form data. Image requests reach its servers like any file you load.
• SupabaseDatabase for research questionnaires. Receives the answers, including partial ones, and session metadata. It may process data outside Brazil.
• Cloudflare StreamPlays videos embedded in some pages. The player loads only when you press play, and it then receives your IP address and device data.
• Links to other servicesThe site links to Instagram, LinkedIn and Calendly, among others. When you click, you leave our site and their policies apply. Calendly receives whatever you type to book a call.

Our typefaces are hosted on our own server, so no font service sees your visit.

8.Your rights as a data subject

Under LGPD, art. 18, you can ask us for any of the following, at no cost.

• ConfirmationWhether we process your data.
• AccessA copy of the data we hold about you.
• CorrectionFixing data that is incomplete, wrong or out of date.
• Anonymization, blocking or deletionOf data that is unnecessary, excessive or processed unlawfully.
• PortabilityReceiving your data to take to another provider, when applicable.
• DeletionOf data processed with your consent, except where the law requires us to keep it.
• Information on sharingWho we shared your data with.
• Information on refusing consentWhat happens if you say no.
• Withdrawal of consentAt any time. For analytics, use Cookie Preferences. For the newsletter, use the unsubscribe link.
• ObjectionTo processing based on legitimate interest, if you think it breaks the law.

We answer within 15 days. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD). To exercise a right, use the contact in the last section.

9.Security, retention and transfers

We use HTTPS on the whole site, restrict access to the tools above to the people who need them, and keep our API keys out of the public code. No system is fully secure, and if an incident puts your data at risk we will tell you and the ANPD as the law requires.

We keep data only as long as needed for the purpose. Mailing-list e-mails stay until you unsubscribe. Messages from the forms stay while the conversation or the working relationship lasts, and are deleted when you ask, unless the law requires us to keep them. Analytics data follows the retention period set in each provider account.

Several partners above, such as Vercel, Google, Resend, Brevo and Supabase, operate servers outside Brazil. We only use providers that offer adequate safeguards for international transfers, as LGPD art. 33 requires.

10.How we tell you about changes

We update this policy when the site changes how it handles data, for example when a new tool is added. The date of the last change is at the top of the page. If the change affects your consent, we ask again through the cookie notice.

11.How to contact us

For questions about this policy or to exercise your rights, write to our data protection contact (DPO):

legal@thebrfactory.com
.TBF. INC · CNPJ 61.360.565/0001-74
R. Pamplona, 145. Jardim Paulista
São Paulo, SP. 01405-100 · Brazil