Skip to content
C de Calvo

C de Calvo Privacy Policy

Effective date: October 13, 2026

Hamlet Arencibia Casanova LTDA, doing business as C de Calvo, CNPJ 61.473.482/0001-91, located at Rua Pais Leme #215 Conj 1713, Pinheiros, São Paulo, 05424-150, Brazil ("C de Calvo," "we," "us," or "our"), explains in this Privacy Policy how we process personal data through cdecalvo.com, cdecalvo.com.br, and our business-contact channels.

For privacy or data-rights requests, contact us at privacy@cdecalvo.com.

1. Scope

This Policy applies to personal data that C de Calvo processes as controller for its own websites, contact requests, sales conversations, and business communications.

It does not govern personal data that we process solely on behalf of a website-services client. That processing is addressed in the applicable client agreement and Data Processing Addendum.

2. Information we process

When you use our contact form, we process the name, email address, and message you choose to provide.

When you use our website assistant, we process the chat messages you choose to send and recent messages from that browser session so the assistant can answer follow-up questions. We do not save chat conversations in our own server-side database. Recent messages remain in your browser's sessionStorage until that browser session ends or you clear the chat. The Gemini API's configured primary and secondary models process the messages to generate a response.

Please do not send passwords, payment credentials, health information, government identification numbers, or other sensitive or confidential information through an initial inquiry.

We may also process limited technical, operational, security, and website-performance information necessary to operate, protect, and improve the website and contact form, including information used to detect spam, automated traffic, abuse, security threats, page views, navigation/referrer patterns, and website performance.

When you visit the website, Cloudflare automatically loads its Web Analytics real-user monitoring (RUM) beacon. The beacon may process page-view and navigation/referrer information, browser and device/environment information, and website-performance metrics, including Core Web Vitals. We use this information to understand aggregate website use and performance. It is separate from contact-form data and from Cloudflare Turnstile.

C de Calvo uses Google Analytics 4 on cdecalvo.com and cdecalvo.com.br. When you visit either website and choose to allow analytics, Google Analytics 4 may process limited information about your use of that website. This may include page views, page paths and titles, referring pages, browser and device information, approximate geographic information, outbound link clicks, and confirmation that our contact service has accepted a form submission. Google Analytics uses first-party analytics cookies and pseudonymous identifiers, including the _ga cookie, to distinguish browsers and sessions. We do not intentionally send Google Analytics your name, email address, contact-form message, or other information that directly identifies you.

3. Why we process personal data

We process personal data for the following purposes and, where the Brazilian General Data Protection Law (LGPD) applies, on the corresponding legal bases:

  • to respond to inquiries, discuss requested services, prepare proposals, and take steps requested before entering into a contract;
  • to answer questions visitors choose to submit through our website assistant about C de Calvo's documented services and policies;
  • to perform and administer an agreed client relationship;
  • to protect our websites, contact forms, systems, and users against fraud, spam, abuse, and security threats, based on our legitimate interests where applicable;
  • to measure aggregate page views and website performance and improve site reliability and usability, based on our legitimate interests where applicable;
  • to measure aggregate use of our websites and improve them through Google Analytics 4, but only after you choose to allow analytics; we use this information for measurement, not advertising, profiling, or remarketing;
  • to comply with legal or regulatory obligations; and
  • to establish, exercise, or defend legal rights where necessary.

We do not rely on consent as the legal basis for every processing activity.

4. Marketing

At launch, we use contact-form information only to respond to the inquiry and manage the related business conversation.

We do not automatically add contact-form users to newsletters, promotions, or other marketing campaigns.

If we introduce marketing communications in the future, we will update this Policy and provide the choices required by applicable law before using personal data for that purpose.

5. Service providers and disclosures

We use service providers to host and secure our websites, prevent form abuse, transmit contact requests by email, route business messages, and manage business communications.

Cloudflare

Cloudflare provides infrastructure used to host and operate our websites and receive contact-form requests. A Cloudflare Worker temporarily processes information submitted through the contact form in order to validate the request and transmit it to our email service provider.

Cloudflare also processes limited technical, operational, and security information associated with requests. Operational and security logs may be retained according to the configuration and retention periods applicable to our Cloudflare service.

We intentionally use Cloudflare Web Analytics (RUM) to understand page views and website performance. Its beacon collects performance information from browser performance APIs, which may include page-view and navigation/referrer information, browser and device/environment information, and metrics such as Core Web Vitals. According to Cloudflare's current documentation, its RUM beacon does not use analytics cookies or access or store data in localStorage, sessionStorage, IndexedDB, or similar persistent client-side analytics storage. Cloudflare states that it discards the source IP address at its edge and does not store it in RUM core databases or logs. The beacon may generate a page-load ID for the current page view; Cloudflare describes its RUM/Vitals analytics as not fingerprinting individual visitors through IP address, user-agent, or other data.

Gemini API

The Gemini API is configured to use Gemini 3.5 Flash-Lite as the primary model and Gemini 3.1 Flash-Lite as the secondary model when an eligible temporary rate-limit, quota, timeout, network, or upstream failure affects the primary model. Both models use the same server-side API key. Because we currently use the Gemini API's unpaid quota, Google may use prompts and generated responses to provide, improve, and develop Google products and machine-learning technologies, and human reviewers may read, annotate, and process inputs and outputs for quality and improvement under Google's applicable terms. Do not send sensitive, confidential, or personal information. We do not enable Gemini tools, Search grounding, files, tuning, caching, or conversation persistence.

Google Analytics 4

We use Google Analytics 4 only to understand aggregate use of cdecalvo.com and cdecalvo.com.br after a visitor allows analytics. Google Analytics may receive the measurement information described in Section 2, including a pseudonymous cookie or identifier used to distinguish browsers and sessions.

Our GA4 measurement covers page views, outbound link clicks, and contact-form submissions accepted by our contact service. Outbound link measurement may include the linked website's domain and destination URL. We count a submission as a lead only after it is accepted; submit-button clicks, validation failures, and failed requests are not counted as leads. The additional lead information is a generic indication that our contact form was used, without the information entered in the form.

User-provided data collection and automatic detection of names, email addresses, phone numbers, and addresses are disabled. We do not use Google Signals, Google Ads linking, remarketing, advertising personalization, User-ID, data import, or Measurement Protocol, and we do not send contact-form contents to Google Analytics. We configure allow_ad_personalization_signals as false. We also do not intentionally configure GA4 to collect information from form fields or URL parameters that could identify you.

Our GA4 data-sharing settings also permit Google to use Analytics data to improve Google products and services, and to use aggregated and de-identified measurement data for modeling and business insights. Google technical-support personnel may access Analytics data and our account when necessary to provide support. Google may also use account usage and configuration information to provide business recommendations. These settings do not link our property to Google Ads, and Google states that the Google products and services setting does not permit Google to use our Analytics data for its own advertising personalization or ad targeting.

Our cookie and privacy settings also offer a separate advertising measurement choice. It controls Google's consent signals for advertising-related storage and use of measurement data for advertising purposes. It does not permit personalized advertising, remarketing, or collection of the contents of our contact form. No advertising tag or Google Ads measurement destination is currently enabled by our website. Saving this preference does not add or activate an advertising tag. If we introduce an advertising measurement service, we will update its disclosures and use it only within the permissions you have granted.

Google explains how it uses information from sites and apps that use its services at How Google uses information from sites and apps that use its services.

We also use Cloudflare Turnstile to help distinguish legitimate visitors from automated or abusive traffic. Turnstile processes browser and security signals and a verification token for that purpose. We do not intentionally provide the name, email address, or message entered in the contact form to Turnstile as part of the Turnstile verification process.

Resend

We use Resend to transmit contact-form submissions by email. Resend may process the information included in the submission, such as name, email address, message, reply-to address, and delivery metadata.

Resend retains delivery-related data according to the retention periods applicable to our service plan and maintains backups according to its applicable security and retention practices.

Email routing and Gmail

We use Cloudflare Email Routing and Google Gmail to receive and manage business communications. Access to business communications is restricted to authorized personnel.

We do not sell personal data.

We may disclose information where required by law, legal process, or a valid governmental request, or where reasonably necessary to protect people, rights, property, or security.

6. International processing and transfers

Some of our service providers operate or store information outside Brazil, including in the United States. As a result, personal data submitted through our contact channels and limited technical/analytics data generated when the website is used may be processed internationally.

International processing may occur in order to receive, secure, transmit, store, and respond to requests submitted to us, operate and measure the performance of our websites, prevent abuse, and maintain business communications.

Where the LGPD applies, C de Calvo uses international-transfer mechanisms permitted by applicable law. This may include transfers necessary for contractual or pre-contractual procedures requested by the data subject, as permitted by the LGPD, together with contractual, technical, and organizational safeguards appropriate to the processing.

The principal providers currently involved in these flows include Cloudflare, Resend, Google Gmail, Gemini API for website-assistant responses, and, when you allow analytics, Google Analytics. Google Analytics data may be processed outside Brazil, including in the United States. Where the LGPD applies, C de Calvo uses international-transfer mechanisms permitted by applicable law and maintains appropriate contractual, technical, and organizational safeguards for the processing.

7. Retention

If an inquiry does not become a client relationship, we may retain the related correspondence for up to 12 months after the last meaningful interaction so that we can respond to follow-up questions, preserve relevant business history, or address disputes or questions concerning the inquiry.

We do not retain website-assistant conversations in our own server-side database. The browser-session copy can be cleared from the chat panel or ends with the browser session. AI providers may temporarily retain prompts or responses according to their applicable service terms and safety controls.

For Google Analytics 4, we retain event data for two months and user-level data for 14 months. Aggregate reports may remain available after those periods because they no longer identify a browser or session in the same way. We may adjust these periods only by updating this Policy before or when the change takes effect where required.

We may delete information earlier when it is no longer necessary.

Records connected to a client relationship, billing, taxes, contracts, disputes, security matters, or legal obligations may be retained for a longer period when justified by that separate purpose or requirement.

8. Your rights and choices

Where the LGPD or another applicable privacy law applies, you may have rights regarding your personal data, including rights to request confirmation of processing, access, correction, anonymization, blocking or deletion where applicable, portability where applicable, information about certain disclosures, and review or objection in situations provided by law.

You may also have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD) or another competent data-protection authority.

To exercise a privacy right, contact privacy@cdecalvo.com. We may need to verify your identity before completing a request and may retain information where applicable law permits or requires us to do so.

You may allow or reject analytics and advertising measurement separately through our cookie and privacy settings on either website. The compact banner lets you accept all optional cookies, reject optional cookies, or choose Customize to open the separate category choices; Save preferences applies your selections. You can change or withdraw either permission later by reopening the preferences through the Privacy settings control in the footer. Rejecting optional measurement does not prevent you from using the website or submitting a contact request. You can also manage or delete cookies through your browser settings and use Google's browser add-on to opt out of Google Analytics. These controls do not affect necessary security or anti-abuse technologies.

9. Security

We use technical and organizational measures appropriate to the nature and scale of our processing. These measures include access controls, account-security protections, abuse-prevention mechanisms, and safeguards for application secrets and service credentials.

No internet transmission, system, or storage method is completely secure, and we cannot guarantee absolute security.

10. Children

Our websites are intended for business audiences and are not directed to children. We do not knowingly request children's personal data through the contact form.

The website assistant is also intended only for this business audience.

11. Cookies and similar technologies

We intentionally use Cloudflare Web Analytics (RUM) for privacy-oriented page-view and website-performance measurement. As described in Section 5, Cloudflare states that its RUM beacon does not use analytics cookies or persistent client-side analytics storage.

We use Google Analytics 4 on cdecalvo.com and cdecalvo.com.br, but only after you actively allow analytics through our cookie and privacy settings. Google Analytics uses first-party analytics cookies and pseudonymous identifiers, including the _ga cookie, to measure aggregate website use. We do not use Google Analytics for advertising, cross-site behavioral tracking, session replay, or remarketing.

Analytics and advertising measurement are separate optional categories and are both denied by default. Analytics permission controls Google's analytics-storage signal. Advertising measurement permission controls its advertising-storage and advertising-user-data signals. The advertising-personalization signal remains denied regardless of these choices. Granting analytics alone does not grant advertising measurement, and granting advertising measurement alone does not load Google Analytics or send analytics events.

We remember your choices in the first-party cdecalvo_privacy_preferences cookie for up to 180 days. It stores the preference version and your category choices, not contact-form contents, and is separate for each website domain. If you previously chose analytics through our older settings, we retain that analytics choice but keep advertising measurement denied and ask you to review the expanded options. If your browser prevents preference storage, we show a notice; your choice still applies to the current page, but you may need to choose again on a later visit.

You can withdraw either permission through Privacy settings. We update Google's consent signals on the current page. Withdrawing analytics disables its measurement and clears accessible first-party GA cookies; withdrawing advertising measurement clears accessible first-party Google advertising measurement cookies and related local storage. Withdrawal does not delete data already processed or cookies held on another provider's domain. Necessary security, abuse-prevention, and preference-storage technologies remain active where required for their function.

If we change our analytics, advertising, or other tracking technologies, we will update this Policy and implement any consent or notice mechanisms required by applicable law.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will publish the revised version with a new effective date and provide additional notice where required by law or appropriate because of the nature of the change.

13. Contact

Hamlet Arencibia Casanova LTDA (C de Calvo)
Rua Pais Leme #215 Conj 1713
Pinheiros, São Paulo, 05424-150, Brazil
privacy@cdecalvo.com