Privacy Policy

This website, rudekwydra.com.br, is operated from Brazil by RudekWydra, at Rua Kansas, 1195 - Brooklin, São Paulo - SP, CEP 04558-060, Brazil. This policy is written to Brazil’s General Data Protection Law (LGPD, Law 13.709/2018).

Requests, questions, and complaints about personal data go to [email protected]. A person reads that inbox.

This policy covers visitors to this website. How we present client case studies and protect commercial information is a separate subject, covered in Confidentiality.

The Contact and Quote forms are the only places on this site where you type anything. They ask for:

• Required: name, email, phone, and company.
• Optional: a free-text message.
• A short diagnostic — seven multiple-choice questions about the company, not about you: segment, who you sell to, main urgency, channels already running, how leads are managed today, goal, and intended timeline.
• Sent along without you typing it: the URL of the page you were on and, if present in the address, campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the Google Ads click identifier (gclid).

Where it goes: there is no lead database behind this site. The form composes an email and sends it to a RudekWydra inbox through Google’s mail servers. From there the data lives in that inbox and, once a contact becomes an active commercial opportunity, in an internal contact base with restricted access.

This site runs Google Analytics 4 (property G-3EWJF2X24G) on every page, in both languages. Analytics records which pages you visited, how long you stayed, device and browser type, where you came from, and an approximate location derived from your IP address. It writes Google’s own cookies in your browser.

Analytics is the only third-party tool loaded on these pages. There is no Meta, LinkedIn, or TikTok remarketing pixel, no marketing automation script, no heatmap, and no session recorder. That is verifiable: open the page source and look.

Pages under /info/ are assembled by a RudekWydra content system running on third-party infrastructure. That call is made server to server, not from your browser: what travels is your browser’s preferred language, not your IP address or your cookies.

People in an active conversation with us receive a proposal link. Two things happen there, and you should know about both:

• Opening the on-page proposal triggers an internal notification telling our team the proposal was opened, carrying the document identifier and the time. That notification travels through Telegram. No name, no email, and nothing you read is included.
• Opening the PDF proposal records the date and time, the browser used, the page the click came from, and an irreversible hash of the IP address. The IP itself is not stored; the hash exists to recognize repeat openings of the same document, not to identify you.

Why it exists: knowing a proposal was read is what tells us when to follow up. If you would rather not be measured at that stage, email [email protected] and we will send the document another way, with no open tracking.

The LGPD requires every processing activity to have a stated purpose and a legal basis. Ours, one by one:

We do not sell, rent, or hand personal data to advertisers, data brokers, or third-party lists. The sharing that does exist is with vendors running parts of the infrastructure, each with a specific job:

Google, Cloudflare, and Telegram operate on servers outside Brazil, and part of the processing described above happens there. Under the LGPD, the transfer rests on Article 33: it is necessary for the pre-contractual steps and the contract itself, and for the legitimate interests set out in section 05.

The origin server for this site is located in Germany (Nuremberg), with Cloudflare in front serving cached copies from servers in several countries.

• Form messages: kept in the inbox and contact base for as long as there is a commercial interest — yours or ours. There is no automated routine today that deletes these records after a fixed period. What does exist is the deletion request, and it is honoured.
• Proposal open records: deleted within 90 days of each open. The routine that deletes them runs whenever a proposal is accessed, at most once a day — so the purge can take longer than the stated period if nobody opens one. The retention period covers every field in that record: the time, the scrambled code for the network address, the browser, and the referring page.
• Internal Telegram alert: the notification is not written to any database of ours, but it stays in the Telegram conversation until that conversation is cleared. The message carries the document code and the time — nothing about who opened it.
• Google Analytics data: retained for the period configured on the Analytics property, within the limits the tool itself allows.
• Traffic source in your browser: cleared when you close the tab.

We would rather write this than publish a tidy retention period nobody enforces. If you want your data deleted now, the request in section 09 settles it, and it needs no justification.

Article 18 of the LGPD gives you the right to ask for:

• Confirmation that processing exists, and access to the data we hold.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability to another provider, where applicable.
• Deletion of data processed on the basis of consent.
• Information about who we share your data with.
• Information about the option not to consent, and what follows from that.
• Withdrawal of consent, where consent is the basis.
• Objection to processing based on legitimate interest.

To exercise any of them, email [email protected]. We answer within 15 days, per Article 19 of the LGPD. We may ask for additional information to confirm the request is yours — and only for that.

We make no automated decisions about you. The form diagnostic does not score or classify anyone by machine: a person reads it before any reply goes out.

If our answer does not settle the matter, you may complain to Brazil’s National Data Protection Authority (ANPD).

That is the whole list. There is no advertising, remarketing, or profiling cookie on this site, and the site itself sets no cookies. Since there is no consent banner yet, the control sits with you: blocking third-party cookies switches measurement off without breaking any part of the site.

• The whole site is served over an encrypted connection (HTTPS), with no page excepted.
• A content delivery and abuse-protection layer sits in front of the origin server.
• The form writes to no internet-facing database: the message becomes an email, and that attack surface goes with it.
• In the proposal-reading log, the IP address is stored as an irreversible hash, never in clear text.
• Access to the inboxes and the contact base is restricted to the people handling enquiries.

None of this makes a system unbreakable, and we will not claim it does. If we identify a security incident carrying relevant risk to data subjects, we notify those affected and the ANPD, as Article 48 of the LGPD requires.

This site is aimed at professionals and companies. We do not knowingly collect data from anyone under 18. If you know a minor has submitted data here, email [email protected] and we will delete the record.

When the practice changes, the text changes with it — which is why this policy describes mechanisms rather than intentions. The last update date sits at the top of this page, and any material change gets a notice on the page itself.