Legal
Privacy Policy
Last updated: July 22, 2026
The short version
This site is Arvor's company showcase: you browse, read about our products, and, if you'd like, reach out through a form. There's no login, cart, or payment here — that lives inside our product apps (AMIGO, Caption, and others), which have their own policies. We collect the minimum we need to answer you and understand how the site is used, we never sell your data, and you can ask us to delete it whenever you want.
- What we collect: contact-form data (name, email, optional WhatsApp, optional company/role/interest/budget, message) and browsing metrics via Google Analytics.
- Why: to reply to your message and understand what's working on the site.
- Who sees it: only the providers that run the site (Vercel, Resend, Google, Cloudflare) — never sold or rented.
- Your rights: access, correct, port, or delete your data at any time through the contact form.
1. Who we are
Arvor Tecnologia ("Arvor"), based in São Paulo, Brazil, is the controller of the data collected on this institutional site (arvor.co). This policy doesn't cover what happens inside our product apps (AMIGO, Caption, and others) — each one has its own privacy policy, specific to what it does inside the product.
2. What we collect and why
| Data | When | Purpose |
|---|---|---|
| Name, email | When you submit the contact form | To reply to your message and know who's reaching out |
| WhatsApp (optional) | Contact form, if you provide it | To reach you on another channel, if you've allowed it |
| Company, role, interest, budget (optional) | Contact form | To understand context and route you to the right person |
| Message | Contact form | The content of your request |
| Language, referring page | Automatically, when you submit | To know which language to reply in and where the interest came from |
| IP address | Automatically, when you submit | To prevent spam and abuse (rate limiting, bot filtering) |
| Browsing identifiers (Google Analytics cookies) | While browsing the site | To understand aggregate traffic (pages viewed, source, device) |
3. Legal basis
We rely on legitimate interest (LGPD Art. 7, IX and Art. 10) to respond to business inquiries and protect the site from abuse; consent (LGPD Art. 7, I), where applicable, for non-essential analytics cookies; and legal obligation when required. For visitors in the EU/EEA, we treat these as equivalent to the legal bases required under GDPR Art. 6.
4. Cookies and analytics
We use Google Analytics 4, loaded through Partytown (it runs in a worker thread, so it doesn't block the page) to understand how people use the site: pages viewed, traffic sources, device type. This sets cookies and anonymized/pseudonymized identifiers. You can opt out at any time by disabling cookies in your browser settings, installing the Google Analytics Opt-out Browser Add-on, or browsing in private mode. We don't run advertising or remarketing cookies on this institutional site.
5. Sharing and sub-processors
We don't sell, rent, or trade your data. We share it only with the providers that run the site's infrastructure, each acting as a processor under our instructions:
- Vercel — hosting and content delivery.
- Resend — delivers the contact-form email to our team.
- Google (Analytics) — aggregated usage metrics.
- Cloudflare — DNS, CDN, and attack protection, when active.
Each provider has its own privacy policy and may process data outside Brazil — see section 6.
6. International data transfers
The providers above run global infrastructure, so your data may be processed on servers outside Brazil (including in the United States) by Vercel, Resend, and Google. These transfers rely on the safeguards required under LGPD Art. 33 and, where applicable, standard contractual clauses equivalent to those required under GDPR.
7. How long we keep it
Contact-form data is kept for as long as our business conversation with you is active, plus a reasonable period afterward for recordkeeping and legal obligations, then deleted or anonymized. Analytics data follows Google Analytics' standard retention settings (typically up to 14 months), always in aggregated form.
8. Your rights
Under LGPD Art. 18 — and, for visitors in the EU/EEA, GDPR — you can: confirm whether we process your data; access it; correct inaccurate or outdated data; request anonymization, blocking, or deletion of unnecessary data; port your data; withdraw consent; and object to processing based on legitimate interest. To exercise any of these, reach us through the contact form — we intentionally don't publish an email address on this page, to keep spam and phishing down.
9. Security
We use reasonable technical and organizational measures: encrypted transport (HTTPS/TLS), rate limiting and a honeypot against bots on the contact form, and restricted infrastructure access at the providers listed above. No system is fully invulnerable, but we monitor and patch continuously.
10. Children
This site is institutional and not directed at children. We don't knowingly collect data from anyone under 18.
11. Changes to this policy
We may update this policy as the site, the law, or our providers change. The date at the top of this page always reflects the latest version.
12. Contact and data protection officer
Questions about this policy or your data? Reach our data protection officer through the contact form, subject line "Privacy." We don't publish a direct email or phone number on this page, for security reasons.