Privacy Policy

1. Who the controller is

The controller of the data processed on this website is Deciban (Brazilian company ID 66.323.849/0001-04), represented by Rafael Rabelo de Souza, São Paulo, Brazil. For any privacy matter — questions, requests or exercising your rights — the data subject channel is the email contato@deciban.com.br. We reply within 15 days.

2. What data we collect and when

AI agent chat (the agents section and "Request a proposal"): the messages you type, voice notes you record and images you send, plus the data you share in the conversation — typically name, company/niche, service channel, lead volume, main challenge, automation goal, email and WhatsApp. A random session identifier (UUID) keeps the conversation context.

"Request a proposal" form: name, role, company and industry, email, WhatsApp, what you want to build, the problem it solves, tools you already use, deadline, investment range, who decides and previous attempts.

Scheduling: if you request a call slot, we collect your name, email, the topic you share and the chosen day, time and duration, to confirm the meeting by email.

Technical data: your IP address is used transiently for abuse protection (rate limiting) and is not stored by the site in its own databases. We use no tracking cookies and no analytics tools; your browser only stores the light/dark theme (localStorage) and, during the visit, a flag that the opening animation was already seen (sessionStorage) — neither identifies you.

3. Why we use it and on which legal basis

Qualification and business proposal: chat and form data are used exclusively to understand your business, prepare a personalized proposal and follow up via WhatsApp and email. Legal basis: preliminary procedures related to a contract to which you are a party (LGPD art. 7, V) and consent (art. 7, I), given when you start the conversation or tick the agreement box on the form.

Service security: transient technical data (IP) is processed under legitimate interest (art. 7, IX) to protect the site against automated abuse.

We do not sell, rent or share your data for third-party marketing. There is no automated decision-making with legal effect on you: the proposal is always prepared and sent by a person (Rafael Rabelo).

4. AI transparency

The chat is operated by an artificial-intelligence agent built on the n8n automation platform (deciban's own infrastructure). To generate replies, your messages are processed by OpenAI models (GPT-4o); voice notes are transcribed (Whisper) and images are described (computer vision). Under OpenAI's API terms, this data is not used to train their models. You are always informed that you are talking to an AI — the agent identifies itself as such.

5. Who data is shared with (processors)

To provide the service we use processors acting on our behalf: Vercel Inc. (website hosting, USA), OpenAI (chat language processing, USA) and the n8n automation infrastructure maintained by deciban itself. Follow-up contact may happen via WhatsApp (Meta) and email.

This entails international data transfer (LGPD art. 33) to countries under adequate contractual safeguards — all listed vendors operate under compatible data-protection agreements (DPAs). Data may also be shared if required by law or court order.

6. How long we keep it

Leads and chat conversations: kept for as long as needed to prepare and negotiate the proposal and for at most 12 months after the last contact — unless a contractual relationship starts (then legal contract terms apply) or you request deletion earlier. Technical automation execution logs have short, rotating retention. After these periods, data is deleted or anonymized.

7. Your rights (LGPD art. 18)

At any time and free of charge you may: confirm that processing exists; access your data; correct incomplete, inaccurate or outdated data; request anonymization, blocking or deletion of unnecessary or non-compliant data; request portability; obtain information about sharing; and withdraw consent (withdrawal does not affect processing already lawfully performed).

To exercise any right, write to contato@deciban.com.br with the subject "LGPD". If you believe processing violates the law, you may also petition the Brazilian Data Protection Authority (ANPD — gov.br/anpd).

8. How we protect data (art. 46)

Technical measures in place: encryption in transit (HTTPS/TLS with HSTS), security headers (CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy), per-IP rate limiting and origin validation on the APIs, validation and size limits on all submitted content, minimization (the site keeps no conversation database of its own; processing happens in the automation infrastructure with access restricted to the controller) and isolated credentials per service. In case of a security incident with relevant risk, we will notify affected data subjects and the ANPD, describing the event, the data involved and the measures taken.

9. Cookies and local storage

The site uses no first-party tracking cookies and no analytics. Your browser only stores the theme preference (localStorage) and, during the visit, an opening-seen flag (sessionStorage) — essential to the experience and with no personal identification.

10. Minors

deciban's services are aimed at businesses and are not directed at anyone under 18. We do not knowingly collect data from children or teenagers; if we identify such processing, the data will be deleted.

11. Changes to this policy

This policy may be updated to reflect changes to the site or the law. The last-updated date appears at the top of the page; material changes will be highlighted here.