sampaiodev · legal
Privacy & LGPD
Last updated:
This Privacy Policy explains how contact-form data is handled, based on Brazil's General Data Protection Law (Law No. 13.709/2018) and ANPD guidance. We collect only what is necessary, and with your consent.
Controller
The data controller (LGPD, art. 5, VI) is Gabriel Sampaio de Souza (the “sampaiodev” brand, sampaiodev.com.br), responsible for decisions about the processing. Any third parties that process data on the controller's behalf (hosting/VPS, email provider and PostgreSQL database) act as operators (art. 5, VII) under a formalized relationship.
Data collected
The contact form collects name, email, WhatsApp (optional), budget range (optional) and a description of the need. For security and abuse prevention, minimal metadata may be recorded, such as the date/time of submission and consent and a hash of the IP (pseudonymization — not the raw IP). Only what is necessary is collected (necessity/minimization principle, art. 6, III).
Purpose
The data is used solely to respond to your contact, assess the budget/need and keep a record of the conversation. There is no use for profiling, advertising or any purpose other than the one stated (purpose and adequacy principles, art. 6, I and II).
Legal basis — consent
Processing of form data is based on free, informed and unambiguous consent (art. 7, I), given by checking the confirmation box — which is not pre-checked and is separated from other clauses (art. 8). Submission does not happen without consent, and it can be withdrawn at any time (art. 8, §5).
Supporting legal basis — legitimate interest
Security measures of the form itself (rate limiting, an invisible honeypot and IP hashing to prevent spam/fraud) may rely on the controller's legitimate interest (art. 7, IX, and art. 10), limited to the minimum necessary and subject to the balancing test guided by the ANPD.
Storage
When processed by the backend, data is stored in a PostgreSQL database, with access control and security measures. The admin panel (/admin) is intended for restricted use and must be protected by authentication before operating in production.
Sharing
Data is not sold or transferred for commercial purposes. It may be processed by operators strictly necessary for operation (hosting, email, infrastructure) and disclosed only under a legal obligation or order from a competent authority. Information about sharing may be requested by the data subject (art. 18, VII).
Data subject rights
Under art. 18 of the LGPD, the data subject may, at any time, request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed under consent; information about sharing; information about the option not to consent; and withdrawal of consent. Where legitimate interest applies, the right to object is ensured (art. 18, §2).
Security
Technical and administrative measures are adopted to protect data against unauthorized access and accidental or unlawful destruction, loss, alteration or disclosure (art. 46) — including access control, secure storage, form rate limiting and IP hashing instead of the raw IP, following ANPD best practices for small-scale processing agents.
Security incidents
In the event of an incident that may cause relevant risk or harm to data subjects, the controller will notify the ANPD and the affected subjects, following the applicable procedure and deadline (ANPD Board Resolution No. 15/2024).
Retention and deletion
Data is kept only for the period needed to handle the contact and the corresponding conversation, and is deleted after processing ends or upon consent withdrawal, except for legal retention cases (LGPD, arts. 15 and 16). Once the backend is active, the admin panel will allow deleting leads, in line with the data subject's rights.
Data subject contact and updates
The data subject can exercise their rights and ask privacy questions via the official email [email protected]. This Privacy Policy may be updated; the current version, with its update date, is always the one published on this page.