Privacy Policy
Last updated: September 29, 2026
1. Who is the controller
This site (immoz.art) belongs to Mozart Consultoria em TI, the trade name of Francis M. Silva de Andrade Sucupira LTDA, a Brazilian company registered under CNPJ 54.168.408/0001-04, headquartered in São Paulo, Brazil. Under Brazil's data protection law (LGPD, Law 13.709/2018), and under the equivalent role in the GDPR for visitors in the EU or UK, this company is the data controller for the data described here.
We are a small processing agent and have not appointed a data protection officer. Any request, question or complaint about your data goes to francis@immoz.art.
2. What data we collect
Site contact form: your name, company name, WhatsApp number and team size.
Freight-floor fine review form (Brazil only, page /piso-minimo-frete): name, company, CNPJ, WhatsApp, email (optional) and a range for how many fines the company received.
With any form, the site stores some technical metadata about the submission: where the visit came from (UTM parameters, when you arrive through a specific ad or link), the page you were on, the referring site (referrer) and the date and time. We use this metadata only to know where contacts come from.
WhatsApp or email messages: we receive what you wrote and the contact details you used (a number or email address, and your name if you share it).
Cookies: the site sets a technical cookie (immoz_consent) to remember your cookie choice and, only if you authorize it, ad-measurement cookies from Meta and Google. No marketing cookie is set before you authorize it. Details, durations and how to revoke are in the Cookie Policy.
We also store your language preference (Portuguese or English) in a key called immoz_lang, in your browser's localStorage. It stays on your device, doesn't identify you and never reaches us.
3. What each use is for, and its legal basis
- Replying to your request (form, WhatsApp or email): pre-contract steps taken at your request (LGPD Art. 7, V; GDPR Art. 6(1)(b)). When you write on behalf of the company you work for, we also rely on legitimate interest (LGPD Art. 7, IX; GDPR Art. 6(1)(f)). If the conversation becomes a contract, the basis is contract performance.
- Knowing where contacts come from (submission metadata): legitimate interest.
- Storing your cookie choice: legitimate interest, so we don't ask again on every visit.
- Measuring Meta and Google ads: only if you authorize the "Marketing and measurement" category in the cookie notice. The basis is consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)), which you can revoke at any time via "Manage cookies" in the footer.
- Reaching out to businesses (B2B outreach): legitimate interest, as described in section 4.
There is no marketing mailing list. Filling out a form or talking to us doesn't add you to any list.
4. B2B outreach
We also contact businesses that haven't talked to us yet, to offer our services. Each contact is individual and goes to the channel the business itself published for commercial contact. We don't buy lists or use scraping tools.
- Businesses outside Brazil: the data we use, its sources, and how long we keep it are described in our outreach notice at /prospeccao/privacy.
- Businesses in Brazil: the full description, including the public sources we use (the Federal Revenue company registry and ANTT notices published in the Federal Official Gazette), is in section 5 of the Portuguese version of this policy.
- Opting out: reply STOP or SAIR to any message, or write to francis@immoz.art, and we won't write again. To honor the request, we keep only an irreversible code (hash) of the email, phone or company ID.
- We don't sell, rent or share the list with anyone.
5. Where data is stored and who we share it with
- Vercel Inc. (United States): hosts the site. Form submissions pass through Vercel's servers, which log technical data for each request (IP address, date, time and page requested) to run and protect the service, based on legitimate interest. Retention of these logs follows Vercel's terms. We have no direct access to them and don't use them to profile visitors.
- Hostinger, virtual server in Boston (United States): runs our automations (n8n) and our CRM, LeadRadar, which we operate ourselves. Form data, sales conversations and outreach records are stored there. Hostinger acts as our processor.
- Hostinger, email: the francis@immoz.art mailbox is on Hostinger's email service, with servers outside Brazil.
- Google, backups: the automation database has a daily copy, kept for 7 days, and a weekly copy, kept for 28 days, in a Google Drive folder owned by Mozart.
- Anthropic, PBC (United States): when we use AI to summarize or organize a sales conversation with someone who contacted us, the text goes through the Claude model. Anthropic's commercial terms don't allow it to train models on this data. Personal data from outreach is not sent to third-party AI tools.
- WhatsApp (Meta): when you message us there, WhatsApp handles the messages under its own terms, as controller of its platform.
- Meta and Google: only with your marketing consent, we send these companies the signal that a conversion happened, to measure ads. We don't send your name, your WhatsApp number or the content of the conversation.
Several of these providers process data outside Brazil, mainly in the United States, which Brazilian law treats as an international transfer (LGPD Art. 33). For these transfers we currently rely on the data processing agreements each provider offers its customers; we have not yet put in place with them the Brazilian authority's standard contractual clauses (ANPD Resolution CD/ANPD No. 19/2024). We plan to move our server to Hostinger's data center in São Paulo, Brazil, and will update this page when we do. We don't sell, rent or share your data with anyone beyond those listed here.
6. How long we keep it
- Forms and conversations you start: without a reply or a contract, we delete the data within 12 months of the last contact. If it becomes a contract, we keep it for the length of the contract and afterwards for as long as the law requires, such as for tax obligations and the defense of possible disputes.
- B2B outreach: see section 4.
- Access logs of our CRM: 6 months, kept confidential (Brazil's Internet Civil Framework, Art. 15).
- Consent cookie: 12 months. Marketing cookies follow the periods in the Cookie Policy.
7. Your rights
Brazilian law (LGPD Art. 18) and, for EU/UK visitors, the GDPR let you, at any time: confirm whether we hold data about you, request access or a copy, correct what's wrong, request anonymization, blocking or deletion, find out who we've shared it with (section 5), object to processing based on legitimate interest, and revoke any consent you've given, including for marketing cookies.
To exercise any of these rights, write to francis@immoz.art. We answer within 15 days. You can also complain to Brazil's data protection authority (ANPD) or, in the EU or UK, to your local data protection authority.
8. Changes to this policy
When the site or the company starts handling data in a new way, we update this page first, and the date at the top changes with it.