Privacy Policy

This policy is maintained by Filipo Teixeira Negrão Consultoria em Tecnologia da Informação LTDA ("FTN", "we"), registered under CNPJ 45.195.584/0001-36, responsible for filiponegrao.com.br and for the systems listed in the "systems" section of the home page.

For anything concerning personal data — including the rights described in section 6 — write to filiponegrao@gmail.com.

This is FTN's general policy. It states who we are, what your rights are and how to reach us — the layer that applies to everything we do.

Each FTN system handles different data for different purposes, so each has its own specific annex supplementing this document. Where they diverge about a given system, that system's annex prevails.

• Penélope ChatBot — automated customer service on WhatsApp: see its annex, covering message handling, end-consumer data and data obtained from Meta's platform.

New systems arrive as new annexes. This document does not change when a product launches or is discontinued.

filiponegrao.com.br is a corporate site and deliberately simple. It uses no tracking cookies, has no analytics or advertising tools, builds no visitor profiles and shares no browsing data with third parties.

The contact form is not yet operational: in this version it only displays a notice and neither transmits nor stores what you type.

As with any web server, the hosting infrastructure records technical access data (IP address, timestamp, user agent) in logs, for as long as needed for security and troubleshooting. These records are not used to identify visitors nor cross-referenced with other databases.

Brazil's LGPD distinguishes whoever decides on the processing (controller) from whoever merely carries it out on another's behalf (processor). FTN occupies both roles, at different moments, and that changes who you should turn to.

In the second case, if you come to us, we will forward your request to the responsible company and support it technically — but the decision about the data is theirs, not ours.

We apply technical and administrative measures proportionate to risk: encrypted traffic in transit (TLS), passwords stored only as hashes, third-party credentials and tokens encrypted at rest with AES-256-GCM, restricted administrative access and session authentication with expiry.

No system is infallible. Should a security incident pose relevant risk to data subjects, we will notify those affected and Brazil's data protection authority, as required by article 48 of the LGPD.

The LGPD (article 18) guarantees you, at any time and free of charge:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability of your data to another provider;
• deletion of data processed on the basis of your consent;
• information about who we share your data with;
• information about your option to withhold consent, and its consequences;
• withdrawal of consent;
• review of decisions made solely by automated processing.

Write to filiponegrao@gmail.com describing your request. We may ask for additional information to confirm your identity — a protection for you, so that nobody accesses or erases data in your name.

We respond within 15 days. For deletion requests, the procedure and deadlines are detailed on the data deletion page.

Part of our infrastructure and some of our suppliers operate outside Brazil, notably in the United States. In those cases the transfer occurs to perform the contract or under contractual clauses ensuring protection compatible with the LGPD. Each system's suppliers are listed in its annex.

We may update this document. The last-updated date at the top always reflects the version in force. Material changes will be communicated to active clients through their registered contact channels.