Privacy policy

Who is responsible

The party responsible for processing your data (the "controller") is Nikolas Mello IT, CNPJ 63.658.767/0001-22, a company registered in Brazil. For anything on this page, write to me at contato@nikolasmelloit.com.

What I collect, and why

There is only one way to send me data on this site: the contact form.

• Name, email or phone, and message — whatever you type into the form. I use it solely to understand what you need and to reply.
• IP address — recorded only while you submit the form, to stop bots firing off messages in bulk. It stays in the server memory for 10 minutes and is then discarded. It is never written to disk or attached to your message.
• Language preference — a cookie named "idioma" holding just "pt" or "en", so the site opens in the language you picked. It does not identify you and is not used for tracking.
• Browser language and country — read as the page loads, purely to decide whether you see the site in Portuguese or English. Neither is stored anywhere.

On what legal basis

Processing the form data rests on Art. 7, V of the Brazilian LGPD: preliminary steps relating to a contract, taken at your request. Put plainly, you wrote to me so that I would reply, and that is all I use it for. Under the GDPR the equivalent basis is Art. 6(1)(b).

The language cookie and the submission limit rest on legitimate interest — keeping the site working and protected from abuse.

How long I keep it

• Form messages — they stay in my mailbox for as long as the conversation is relevant: through the project and for up to 5 years afterwards, the period Brazilian law expects for records of a commercial relationship. Ask me to delete them sooner and I will.
• IP address — 10 minutes.
• Language cookie — 1 year, or until you clear your browser data.

Who I share it with

Nobody, beyond what is needed for the site to run and for your message to reach me:

• An email delivery service — carries your message from the site to my mailbox.
• A hosting provider — where the site runs, and which keeps technical access logs.

What I do not do

Worth stating outright, because most sites do these things and this one does not:

• I do not sell, rent or trade your data with anyone.
• I use no advertising cookies, no social network pixels and no cross-site tracking.
• I do not build a profile of you to target advertising.
• The site fonts are served from my own domain — no request goes out to Google when you open a page.

Audience measurement

At present this site uses no analytics or audience measurement tool at all. Should I add one, it will be a cookieless tool that collects no personal data, and this page will be updated before it goes live.

Your rights

The LGPD (Art. 18) — and the GDPR, if you are in the EU — gives you rights over your data. Exercise any of them by writing to me at contato@nikolasmelloit.com. I reply within 15 days.

• Find out whether I hold data about you, and what it is.
• Correct data that is incomplete or out of date.
• Ask me to delete your data.
• Request a copy of what I hold.
• Withdraw consent and object to a given use.

Security

The site is served over an encrypted connection (HTTPS), validates everything the form sends on the server, and caps how many submissions can be made to contain abuse. None of your data goes into a database — your message goes straight to email and lives there.

Changes to this policy

If what the site does with data changes, this page changes with it and the date at the top tells you when. I do not make silent edits.