Privacy Policy

Who is responsible

The website is operated under the VonTuring brand, at vonturing.tech. The controller of personal data is the individual micro-entrepreneur (Microempreendedor Individual) 64.562.452 LUIZ CARLOS RIBEIRO NEDUZIAK.

Privacy requests may be sent to contato@vonturing.tech.

Information you provide

The form asks for your name, email address, company if you choose to provide it, and message. This information is sent so the message can be read and answered. Delivery goes to contato@vonturing.tech.

The form does not ask for sensitive data. If you include that kind of information in the message, it is processed only to answer the inquiry.

A hidden field exists only to detect automation. When it is filled in, the message is not sent and its content is not written to the application log.

Form security

Cloudflare Turnstile reduces automated submissions. The browser communicates with Cloudflare to obtain a token. The server checks that token and does not send the IP address with the check. The widget on this website does not enable pre-clearance, the mode in which Cloudflare’s documentation describes the cf_clearance cookie.

The Turnstile privacy addendum of June 18, 2025 describes signals such as IP address, TLS fingerprint, browser, site key, and origin. To protect the website, Cloudflare describes itself as a processor. To improve automated-traffic detection, it describes itself as a controller. That addendum does not list a cookie for the challenge.

Submissions are also limited. The IP address is converted into an HMAC-SHA256 value with a key that stays on the server. This is pseudonymization, not anonymization: someone who has the key can test addresses against the stored value.

Redis stores that value and a counter. It does not store the raw IP address or the text of the message. The ten-minute counting window is not the lifetime of the key: the key can remain for about twenty minutes. The twenty-four-hour window can remain for about forty-eight hours. This record is kept in a database in Washington, D.C.

Audience measurement

The site includes Vercel Web Analytics on every page. According to Vercel’s current documentation, the measurement does not use third-party cookies, distinguishes a visit by a hash of the request, and discards that session after 24 hours. It may process the page viewed, the referring page, device type, browser, and approximate location. The 24-hour period refers to that session, not to a single period for the aggregated statistics in the dashboard.

This measurement is not required to answer an inquiry. The application code does not set a cookie or use local storage for this measurement.

Hosting and records

The site and the form run on Vercel. The infrastructure may process the IP address, the requested page, and technical connection data in order to provide the service. The function region is not fixed in the code, and the network edge is global.

The log written by the application records a request identifier, time, result, and category. It does not record name, email, message, token, IP address, or the value derived from the IP address. Vercel’s current documentation publishes runtime-log retention by plan: 1 hour, 1 day, 3 days, or 30 days. Those platform logs may include technical connection data.

WhatsApp

The WhatsApp link is shown only when a public number is configured. If the link appears, selecting it leaves this website and opens a WhatsApp conversation with a prepared first sentence.

Legal bases

When a message asks about the services or concerns a possible engagement, the reply rests on article 7, V, of the LGPD, because the person requested that step. The form does not ask for separate consent. A message that is not about an engagement does not fall under that provision.

A request about a person’s own personal data is answered because the LGPD requires the controller to handle it. The indicated basis is article 7, II.

Other institutional messages are read and answered because they were sent to this channel. That purpose is not a pre-contractual procedure. The indicated basis is legitimate interest, article 7, IX, limited to reading and answering the message.

Checks against abuse, through Turnstile and submission limits, rest on legitimate interest, article 7, IX, and on the duty to keep personal data secure. Audience measurement also rests on legitimate interest and is not required to answer an inquiry. Technical hosting records and the application log exist to run the website and investigate failures, on the same basis and the same security duty.

Providers and transfers

The controller and the channel contato@vonturing.tech are in the section Who is responsible. Rights, including the right to lodge a complaint with the Brazilian National Data Protection Authority, are in the section Rights. A person may ask for information about these transfers through the same channel.

The contact message is delivered by Resend so it can be read and answered. Resend states that it stores customer data in the United States, including content, delivery records, and account data. The sending region does not change that storage. Its documentation describes, on the Free, Pro, and Scale plans, 30-day retention of email and log data while the account is active, backups for 7 days, and deletion of remaining data within 90 days after the account ends. The Enterprise plan is described with flexible retention. The documentation also describes encryption in transit and at rest.

The website and the form are hosted on Vercel in order to serve the pages and carry out the submission. Its public documentation states that the primary processing facilities are in the United States and that data may also be processed in other countries where Vercel or its subprocessors operate.

Turnstile checks whether a submission looks automated. The June 18, 2025 addendum describes signals such as IP address, TLS fingerprint, browser, site key, and origin, and does not name a single country for those signals. Cloudflare’s privacy policy, which that addendum keeps applicable, describes a company based in the United States, with primary storage in the United States and the European Economic Area, and access from other countries where the group operates.

Submission limits store only the HMAC value of the IP address and a counter at Upstash, in a database in Washington, D.C., in the United States.

Retention

Institutional contact messages, and the replies tied to that conversation, are kept for up to 12 months after the last interaction related to the inquiry. Keeping them may end sooner, when the data is no longer needed to answer or follow the request. The website does not delete these messages automatically. A legal requirement may justify keeping them longer, with the reason recorded. The 12-month limit is the operational rule for the mailbox. It does not guarantee that the provider’s copy remains available for that whole period.

When a conversation is deleted from the mailbox, Resend’s current documentation describes moving it to the trash and scheduling deletion in 30 days. During that interval the conversation can be restored. Leaving the mailbox is not immediate permanent deletion. The 30-day retention of email and log data, the 7-day backups, and the period after the account ends are the provider’s periods, separate from the 12-month rule.

The Redis security counters expire in about 20 minutes or about 48 hours. The audience session described in Vercel’s documentation is discarded after 24 hours. Vercel’s documentation publishes runtime-log retention by plan: 1 hour, 1 day, 3 days, or 30 days.

Rights

A person may request confirmation, access, correction, anonymization, blocking, deletion, portability, and information about sharing. They may object to processing based on legitimate interest and lodge a complaint with the Brazilian National Data Protection Authority. The form does not use consent. Not sending the message is enough for that data not to be collected through this channel.

Deletion of a contact message follows the Retention section. Leaving the mailbox does not permanently erase the conversation at that same moment. These requests may be sent to contato@vonturing.tech.

Updates

The current version is the one published on this page. Material changes will be made here. The Portuguese version is at /privacidade.