Who controls your data

The data controller is Agência 4RED, registered in Brazil under CNPJ 34.194.541/0001-10, based in Contagem/MG, Brasil and operating fully remotely. For anything related to personal data (a question, a request or a complaint), write to contato@agencia4red.com, which also serves as our data protection contact. We reply within 15 days.

What we collect

We collect only what is needed to reply to you and deliver what you asked for. No profiling beyond what is described here.

Contact form: your name, email and the description of the challenge you write. We also record the site language so we reply in the right one.
Visibility X-Ray: website or business name, city, email and phone. These are the minimum fields needed to run the diagnosis and deliver the result.
Payment (paid X-Ray and content packages): payments are processed by AbacatePay. We only receive the confirmation and the transaction identifiers. Never your banking details.
Technical browsing data: IP address, browser type and pages visited, logged by our hosting and analytics.
Cookies and similar technologies: used for audience measurement when Google Tag Manager is active. We do not use advertising cookies to sell your data.

We do not collect sensitive data (racial origin, religion, health, biometrics, political opinion) and we do not collect data from children. This site is not intended for anyone under 18.

Why we collect it (legal basis)

To reply to you and deliver the service you requested. Legal basis: performance of a contract or pre-contractual steps.
To run the diagnosis and send you the result. Legal basis: performance of a contract, even a free one.
To meet tax and accounting obligations for payments. Legal basis: legal obligation.
To measure audience and improve the site. Legal basis: legitimate interest, always with aggregated data and with your right to object.
To send commercial communication about our services to people who already engaged with us. Legal basis: legitimate interest, with one-click unsubscribe in every message.

Who we share it with

We do not sell personal data. We share only with the processors needed for the service to work, each receiving the minimum necessary:

Vercel: website hosting (technical browsing data).
Supabase: the database holding leads and diagnoses.
AbacatePay: payment processing.
Google (Tag Manager and Analytics): audience measurement.
n8n: internal workflow automation, on our own server.
AI and search-data providers (OpenAI, Google, Perplexity and DataForSEO): they receive only the domain, city and category of the business being analysed, to run the measurement. No personal contact data is sent to them.

Some of these processors handle data outside Brazil. International transfers rely on standard contractual clauses and on article 33 of the LGPD. We may also share data where required by law or court order.

How long we keep it

Contact leads and diagnoses: 24 months from the last interaction, or until you ask us to delete them.
Payment records and tax documents: 5 years, as required by Brazilian tax law.
Application access logs: 6 months, under article 15 of Brazil's Internet Civil Framework.
Analytics data: as configured in the tool, always in aggregated form.

Your rights

You may exercise the rights below at any time by writing to contato@agencia4red.com, free of charge and without having to justify the request.

Confirm whether we process your data, and access it.
Correct incomplete, inaccurate or outdated data.
Request anonymisation, blocking or deletion of unnecessary data.
Request portability of your data to another provider.
Withdraw consent and request deletion of data processed on that basis.
Object to processing based on legitimate interest.
Be told who we share your data with.
Complain to Brazil's data protection authority (ANPD) or to your local supervisory authority.

Security

The site runs entirely over HTTPS. Database access is restricted and key-authenticated, secrets live in environment variables (never in code), and the payment webhook is signature-validated before anything is released. No system is infallible: if a security incident with material risk occurs, we will notify you and the authority within the legal deadlines.

Cookies

We use strictly necessary cookies and, when Google Tag Manager is active, audience-measurement cookies. You can block cookies in your browser settings; the site keeps working, we simply stop measuring the visit.

Changes to this policy

When this policy changes we update the date at the top of this page. Material changes are communicated by email to anyone with an active relationship with us.

Privacy Policy