Privacy Policy

1. Who the controller is

The controller of personal data processed on this site is Mettric Data Technology LTDA, CNPJ 53.179.077/0001-37, Av. Paulista, 1471 — Bela Vista — São Paulo/SP — CEP 01311-927. For privacy matters, contact our Data Protection Officer at privacidade@mettric.com.br.

2. What we collect

We collect only what is needed to run the site and respond to your enquiries:

• Contact form: name, email and message and, optionally, phone, company, company size and main interest.
• Browsing data (only with your consent): metrics and session recordings via Google Analytics and Microsoft Clarity; with marketing consent, campaign attribution, Meta and LinkedIn pixels, CRM navigation tracking and native Web Push subscription data.
• A record of your consent decision (mtc_consent cookie).

3. Why we use it and legal bases

• To respond to your enquiry and conduct commercial discussions (pre-contractual steps at your request — LGPD art. 7, V).
• To measure site usage and improve the product (consent — art. 7, I).
• To measure campaigns and score leads in our CRM (consent — art. 7, I).
• To comply with legal obligations and exercise rights in proceedings (art. 7, II and VI).

4. Cookies

We use required cookies (always on) and, only with your consent, analytics, marketing and preference cookies. Details of each cookie, retention and purposes are in our Cookie Policy. You can change or withdraw your decision at any time via the “Manage cookies” button in the footer.

5. Who we share with

We do not sell personal data. We share only with processors that help us run the site:

• The contact form is processed by Mettric on our own endpoint in Brazil and forwarded directly to our internal mailbox; we do not use an external form intermediary.
• Google (Google Tag Manager / Google Analytics): usage metrics, only with analytics consent.
• Microsoft Clarity (Microsoft, USA): heatmaps, diagnostics and session recordings, only with analytics consent. Sensitive form fields are masked.
• Meta Platforms and LinkedIn (USA): campaign measurement and remarketing, only with marketing consent.
• Native Web Push (VAPID, our own infrastructure in Brazil): manages notification subscriptions and delivery only after marketing consent and an additional browser permission; we do not use OneSignal.
• Mautic (CRM self-hosted by Mettric at crm.metadados.io, in Brazil): marketing automation and lead scoring, only with marketing consent.

6. How long we keep it

• Consent decision: 12 months (or until the policy changes, when we ask again).
• Campaign attribution data: 90 days.
• Analytics, pixel and push data: according to each processor's retention period or until consent is withdrawn; on withdrawal, we issue opt-out commands, remove local identifiers and cancel the push subscription.
• Messages sent through the contact form: up to 24 months after the last contact, or until you request deletion.

7. Your rights

The LGPD (art. 18) grants you: confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and withdrawal of consent at any time. To exercise them, write to privacidade@mettric.com.br — we reply within 15 days. Cookies can be withdrawn instantly via “Manage cookies” in the footer.

8. Security

We adopt technical and organizational measures proportional to risk: encryption in transit (TLS), access control, event logging and least privilege. No tracking identifier is stored before your consent.

9. Changes to this policy

We may update this policy to reflect changes in the site or the law. When a change is material, the consent banner reappears so you can decide again. The last-updated date is at the top of this page.