Privacy Notice

1. Who we are and who the controller is

Varcove is the brand under which we build our own products and provide software engineering services to other companies.

The controller of the personal data processed on this site is Caike Machado Batista Costa, a natural person responsible for the Varcove brand. There is currently no company incorporated for this activity.

We have not yet formally appointed a data protection officer. The address contato@varcove.com.br is the channel that receives privacy matters and data subject requests, and it is answered by the controller directly.

2. Data we process

We process personal data in four situations.

When you fill in the contact form: name, email, company (when provided), WhatsApp number (when provided), your preferred contact channel (which we only ask about if you give a WhatsApp number), when you would like to start (when provided), the challenge you select, and the description you write. Alongside that we record the language the form page was in, so we know which language to reply in.

When you browse with analytics enabled: technical and usage information — pages visited, the actions listed in section 7, browser, operating system, device type, screen resolution, language, time zone, page address and referring page — plus a technical identifier generated in your browser, which exists in memory only for the duration of the visit.

When the form is submitted: the IP address of the request, used at the moment of submission to limit repeated submissions and protect the form from abuse.

When we contact a company on our own initiative: professional data that has been made publicly available — name and role where these are published, the company, and a professional contact channel — together with a record of where each piece of data came from.

3. Why we process it

• Contact form — to reply to you through the channel you indicate, understand the challenge you describe, and assess a possible project or commercial relationship.
• Analytics — to understand how the site is used, which pages get traffic and which actions happen, so we can improve the content, the navigation and the clarity of what we offer.
• Security — to keep the contact channel available and protected from automated submissions and abuse.
• Commercial contact on our initiative — to identify and approach companies that what we do may be relevant to.

4. Legal bases

Each purpose has its own legal basis.

• Contact form — performance of preliminary procedures related to a contract, at the data subject's request (art. 7, V, LGPD). You fill in the form precisely to start a conversation about a possible project.
• Analytics — legitimate interest (art. 7, IX, LGPD). We keep an internal assessment supporting this basis: the intended purpose, its necessity, the impact on you and the minimisation measures in place. You can object at any time, through the control in section 7 or by email.
• Form security — legitimate interest (art. 7, IX, LGPD), to the extent necessary to keep the contact channel working.
• Commercial contact on our initiative — legitimate interest (art. 7, IX, LGPD). We keep an internal assessment supporting this basis, in the form of purpose, necessity and balancing, together with the safeguards in place. You can object at any time.

These are the bases we understand to apply. They are subject to legal review, and this notice will be updated if that review points to a different basis.

5. Contact form

The form delivers what you write to our mailbox. Resend performs the delivery and ImprovMX forwards messages addressed to contato@varcove.com.br.

We reply by email or, if you give a WhatsApp number and choose that channel, by WhatsApp. In that case the conversation takes place on the WhatsApp platform, operated by Meta, and the data involved is subject to the processing necessary for that service to work. Giving a WhatsApp number is optional: without one, we reply by email.

We do not use this data for marketing, we do not sell it, and we do not pass it to third parties for their own purposes. We reply to your message and, if there is no follow-up, the record is deleted as described in section 11.

6. Commercial contact on our initiative

As well as replying to people who write to us, we may contact companies that have not spoken to us yet, where we think what we do relates to what they do.

What data we use: professional data the company or the person has made publicly available — name and role where these are published, the company, and a professional contact channel. We record where each piece of data came from. We do not buy lists, we do not collect in bulk, and we do not process sensitive data for this purpose.

How we approach you: every message identifies Varcove, says where your data came from, and why we are writing to you specifically. We do not send bulk blasts.

How to object: just reply asking not to be contacted again, or write to contato@varcove.com.br. We stop there and do not push. So that we can honour the request, we keep a record that it exists — the minimum needed not to approach you again.

7. Analytics

We use PostHog to measure how the site is used.

What we measure: the pages visited, and a small set of actions declared explicitly in the code — clicks on the service links, on the start-a-project button and on the WhatsApp button, plus a successful form submission. Each click records the event name, the point of the site it came from, and the page language; when the click belongs to a particular service it also records which service, and when it belongs to none, no service is recorded at all. A successful form submission records the challenge you selected and the page language, and nothing you wrote.

What we never send: no event sends anything you type. Name, email, company, WhatsApp number, contact preference, timing and the project description are never sent to PostHog.

How it is configured: we do not use session recording, automatic click capture, heatmaps or surveys, and we never call any identification function. The technical identifier used for measurement is kept in memory only for the duration of the visit and is not written to your browser — in practice, a return visit is counted as a new one.

About the IP address: PostHog receives the request your browser sends and, as with any service reached over the internet, that request carries the IP address. We have enabled the project setting that discards the client IP so that it is not stored alongside events. Because the IP can be received and processed before that discard, and because events carry technical information and an identifier, we do not describe this measurement as anonymous.

8. Cookies and local storage

This site uses no advertising cookies, no social network cookies, and no third-party tracking cookies.

With analytics enabled, PostHog writes no analytics cookie and no analytics local storage in your browser: the configuration we use keeps the technical identifier in memory only.

Two functional items may exist in your browser:

• NEXT_LOCALE — a cookie written when you choose the language manually, so the choice is remembered.
• varcove_analytics — a local storage item written only if you disable analytics. It contains nothing but the word recording that choice: no identifier, no date, no data about you. It is never sent to our server.

9. Vendors and sharing

We do not sell personal data and we do not share it for third parties' own purposes. To run the site and to talk to you, we rely on third-party services:

• Vercel — hosting and delivery of the site.
• Resend — delivery of form messages.
• ImprovMX — forwarding of the contact address.
• PostHog — usage measurement, when analytics is enabled.
• Google — the account holding the mailbox that receives forwarded messages and the spreadsheet where we record commercial opportunities. It is an ordinary account, not a business data processing agreement.
• WhatsApp, operated by Meta — the platform where the conversation happens if you give a WhatsApp number and choose that channel. It is not a service we contract to process data on our behalf: it is the means of communication itself, and what travels through it is subject to the processing necessary for the platform to work.

The vendors we contract process data on our behalf, only as far as necessary to provide the contracted service. We may also share data where required by law or by a competent authority.

10. International transfers

The vendors listed above are foreign companies and may process data outside Brazil, including in the United States and the European Union. The same applies to the WhatsApp platform, if you choose to talk over that channel. Data processed on this site may therefore be transferred internationally.

We are reviewing the contractual instruments and safeguards applicable to each vendor against the Brazilian rules on international data transfers. Until that review is complete, this notice does not claim that these transfers fall under any specific mechanism provided for in the LGPD.

If you would like to know where that review stands, write to contato@varcove.com.br.

11. Retention

We do not keep data for longer than the purposes on this page require.

• Form messages and the conversation that follows, by email or on WhatsApp — kept while the commercial conversation is active and for a reasonable period afterwards, so we can resume contact or evidence what was discussed. Without follow-up, the record is deleted.
• Usage measurement data — kept for the retention period of the analytics service we use.
• Technical records tied to protecting the form — they exist only during the submission and are not kept as history.
• Records of commercial prospecting — kept while the opportunity is active and for a reasonable period afterwards. If you ask not to be contacted again, we keep only the record of that request, so that we can honour it.

The exact period for each category is being decided and will be published here once settled. You can ask for your data to be deleted at any time, as described in section 13.

12. Security

The site is served only over an encrypted connection (HTTPS). Access keys for the services we use are held in environment variables, outside the site's code. The mailbox that receives form messages is protected by authentication.

No measure removes risk entirely. If a security incident occurs that may create relevant risk or harm to you, we follow an internal procedure to contain, assess, document and communicate the incident to the authority and to affected individuals, on the terms and within the deadlines required by the applicable regulation.

13. Your rights

The LGPD gives you, in relation to your personal data:

• confirmation that processing exists;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary or excessive data, or data processed contrary to the law;
• portability to another provider, under the applicable rules;
• deletion of data processed on the basis of consent, in the cases provided by law;
• information about the entities we share data with;
• information about the option not to give consent and the consequences of refusing;
• withdrawal of consent, where processing relies on it;
• objection to processing carried out under a basis other than consent, in case of non-compliance with the law.

You may also petition the Brazilian data protection authority (ANPD). Some requests may be subject to limits or exceptions provided by law — for instance, where we must keep a record to comply with a legal obligation or to exercise rights in proceedings. Where that applies, we will explain why.

14. How to exercise your rights

Write to contato@varcove.com.br describing what you want.

To locate your data, the email address you used in the form is usually enough. We will only ask for additional information if it is genuinely necessary to confirm the request is yours, and we will ask for as little as possible.

We reply within the deadlines set by the applicable legislation. If we cannot fulfil a request, we will explain why.

15. Changes to this notice

We may update this notice when we change how we process data, when we change vendor, or when the legal review under way points to adjustments. The date of the last update is at the top of this page, and material changes are described here.

16. Contact

Questions about this notice, requests about your data, or any privacy matter: contato@varcove.com.br.

This channel is answered by the controller directly. There is currently no formally appointed data protection officer.