Privacy Policy

Google Consent Mode v2

Google uses advanced Consent Mode v2: before a choice or after rejection, it may receive cookieless signals for aggregate measurement. Optional cookies and ad identifiers linked to the CRM require consent. WhatsApp clicks indicate contact intent, not a confirmed conversation.

Service follow-up

Commercial emails may include an observation image and links with a random identifier. Detected opens and clicks are associated with the contact and opportunity for up to 90 days. Automated tools may generate these signals; they do not prove reading. With marketing consent, an accepted form may associate browser navigation with the CRM contact. Email addresses are not included in tracking URLs. Contact our privacy channel to stop this tracking.

ChatGPT ad measurement

With marketing consent, the OpenAI pixel measures page views and server-accepted contacts for ChatGPT ad attribution. The SDK may automatically match normalized and hashed contact information. Cookies __oppref (up to 30 days) and __obref (up to 365 days) support measurement and are removed on consent withdrawal. mtc_lead_receipt is a session lasting up to 10 minutes, created with analytics or marketing consent to confirm an accepted contact once. Google Analytics receives the event only with analytics consent; advertising pixels only with marketing consent. You can refuse or withdraw consent in the footer.

Google Ads measurement and audiences

With marketing consent, we may measure conversions and use contact data provided directly to Mettric to create Google Ads audiences. Email addresses are normalized and hashed before being sent for matching with Google Accounts. The purpose is measurement, remarketing and exclusion control; you can refuse or withdraw consent in the footer or through our privacy channel.

1. Who the controller is

The controller of personal data processed on this site is Mettric Data Technology LTDA, CNPJ 53.179.077/0001-37, Av. Paulista, 1471 — Bela Vista — São Paulo/SP — CEP 01311-927. For privacy matters, contact our Data Protection Officer at privacidade@mettric.com.br.

2. What we collect

We collect only what is needed to run the site and respond to your enquiries:

• Contact form: name, email, phone, CPF or CNPJ and message and, optionally, company, company size and main interest.
• Browsing data (only with your consent): metrics and session recordings via Google Analytics and Microsoft Clarity; with marketing consent, Google Ads measurement and audiences, OpenAI campaign attribution, Meta and LinkedIn pixels, CRM navigation tracking and native Web Push subscription data.
• Mettric Identity (only with marketing consent): pages and campaigns, sessions, server-observed IP, device and browser category, active-time and scroll-depth bands, CTAs, downloads, media engagement, and form steps, validation errors or interruptions. We do not record keystrokes or field contents before submission.
• Technical security trail (independent of marketing consent): server-observed IP, date and time, path without query parameters, HTTP status and a browser-agent hash. We do not use this trail for advertising, commercial scoring or automatic contact association.
• A record of your consent decision (mtc_consent or mtc_consent_session cookie).

3. Why we use it and legal bases

• To respond to your enquiry and conduct commercial discussions (pre-contractual steps at your request — LGPD art. 7, V).
• To measure site usage and improve the product (consent — art. 7, I).
• To measure campaigns and score leads in our CRM (consent — art. 7, I).
• To protect the site, control abuse and investigate incidents through limited technical records (legitimate interests — art. 7, IX, with purpose, necessity and safeguards).
• To comply with legal obligations and exercise rights in proceedings (art. 7, II and VI).

4. Cookies

We use required cookies (always on) and, only with your consent, analytics, marketing and preference cookies. Details of each cookie, retention and purposes are in our Cookie Policy. You can change or withdraw your decision at any time via the “Manage cookies” button in the footer.

5. Who we share with

We do not sell personal data. We share only with processors that help us run the site:

• The contact form is processed by Mettric on our own endpoint in Brazil and recorded in our CRM for follow-up; we do not use an external form intermediary.
• Google (Google Tag Manager / Google Analytics / Google Ads): usage metrics with analytics consent; conversions, remarketing and customer lists using hashed email addresses, only with marketing consent.
• Microsoft Clarity (Microsoft, USA): heatmaps, diagnostics and session recordings, only with analytics consent. Sensitive form fields are masked.
• Meta Platforms and LinkedIn (USA): campaign measurement and remarketing, only with marketing consent.
• OpenAI (USA): ChatGPT ad attribution through the Pixel and Conversions API, using campaign and browser identifiers plus a hashed email address, only with marketing consent.
• Native Web Push (VAPID, our own infrastructure in Brazil): marketing notifications require marketing consent and an additional browser permission; service updates require a separate authorization on the individual link. We do not use OneSignal.
• Mettric Identity (our own infrastructure in Brazil): records the consented signals described above and links a journey to a contact only after deterministic identification through a form or authenticated account. A separate security trail retains IP and limited technical metadata for a limited period regardless of marketing consent; IP and browser are context, not identity proof.

6. How long we keep it

• Full acceptance: 12 months (or until the policy changes). Refusal and custom preferences: current visit only; we ask again in the next session.
• Campaign attribution data: 90 days.
• Server technical security trail: 90 days, with automatic deletion at the end of the period.
• Analytics and pixel data: according to each processor's retention period or until consent is withdrawn; on withdrawal, we issue opt-out commands and remove applicable local identifiers.
• Web Push: IP address and browser-agent metadata are minimized after 90 days without an update; inactive subscriptions are deleted after a further 90 days, and notification-action history is deleted after 12 months. Withdrawing marketing revokes that grant; the physical subscription remains only for another separately authorized purpose, such as service updates.
• Messages sent through the contact form: up to 24 months after the last contact, or until you request deletion.

7. Your rights

The LGPD (art. 18) grants you: confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and withdrawal of consent at any time. To exercise them, write to privacidade@mettric.com.br — we reply within 15 days. Cookies can be withdrawn instantly via “Manage cookies” in the footer.

8. Security

We adopt technical and organizational measures proportional to risk: encryption in transit (TLS), access control, event logging, limited retention and least privilege. Commercial tracking cookies, pixels and identifiers require consent; the server may separately retain IP addresses for control and security.

9. Changes to this policy

We may update this policy to reflect changes in the site or the law. When a change is material, the consent banner reappears so you can decide again. The last-updated date is at the top of this page.