Back to site
Legal

Privacy Policy

Last updated: July 28, 2026

This Privacy Policy describes how Eucalipto collects, uses, shares, and protects the personal data processed in connection with its services, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018).

01Introduction

The privacy and security of your data are priorities for Eucalipto. This Policy explains what information we process when you use our omnichannel platform and what your rights are as a data subject.

This Policy applies to the Platform, the website, and the other services offered by Eucalipto. By using them, you acknowledge that you are aware of the practices described herein.

02Data We Collect

We collect different categories of data, depending on your interaction with the Service:

  • Registration and lead data: name, email, telephone, form source, and the answers voluntarily submitted in the diagnostic questionnaire.
  • Account and billing data: subscribed plan, payment history, and billing details.
  • Website usage data, from the first public page load: a random first-party visitor identifier, session identifier, page and referrer, campaign parameters, page views, scroll milestones, button interactions, and form or questionnaire progress, including the displayed label and current content of the public name, email, and phone fields after completion.
  • Technical and security data: IP address obtained by our server, request date and time, browser and user agent, language, timezone, platform, viewport, screen, connection information when available, consent state, and Do Not Track or Global Privacy Control signals.
  • Communication content: messages and files processed through the integrated channels, as configured by you.

03How We Use the Data

We use personal data for the following purposes:

  • To provide, operate, and maintain the Platform and its features.
  • To process subscriptions, payments, and provide support.
  • To improve, personalize, and develop new features and services.
  • To ensure security, prevent fraud, and comply with legal and regulatory obligations.
  • To send operational communications and, subject to consent, marketing communications.

04Legal Basis for Processing

The processing of personal data is based on the legal bases set out in the LGPD, including the performance of a contract, compliance with a legal obligation, legitimate interest, and the data subject's consent, where applicable. We rely on legitimate interests to operate, secure, measure, and improve our own website with proportionate first-party telemetry; optional external analytics and advertising providers require your consent.

05Data Sharing

Eucalipto does not sell personal data. Sharing occurs only when necessary and in the following circumstances:

  • With infrastructure, messaging, and payment providers that support the operation of the Service.
  • With public authorities, when required by law or by court order.
  • In corporate transactions, such as mergers or acquisitions, with confidentiality preserved.
  • With your consent or express instruction.

06Cookies and Tracking Technologies

On your first public page load we set the eu_visitor_id first-party cookie, containing only an opaque random identifier. It expires after no more than 390 days and is not renewed by later activity. A per-tab session identifier expires with the tab or after 30 minutes of inactivity. These identifiers link page views, click and scroll milestones, questionnaire and form progress, source/referrer and limited browser/request metadata in our internal Supabase environment.

The optional-partner preference controls Google, Meta, Microsoft Clarity, Hotjar, and Vercel analytics or advertising integrations. They remain unloaded unless you allow them; rejecting them does not stop Eucalipto's internal first-party measurement. Do Not Track and Global Privacy Control force optional partners off and are recorded with the internal event context. The partial name, email, and phone values described above stay in our internal environment and are not sent to those partners. We do not copy arbitrary browser-cookie contents, record passwords, hidden or payment fields, or use canvas, audio, or font fingerprinting. You may object or request deletion through our DPO.

07Storage and Security

We adopt appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or improper disclosure, including encryption, access controls, and continuous monitoring.

Despite our efforts, no system is entirely immune to risks. In the event of a significant security incident, we will take the appropriate measures and make the communications required by law.

08Data Retention

Raw first-party visitor sessions, interaction events, and consent-event records are automatically deleted after 25 months. The eu_visitor_id cookie lasts no more than 390 days without renewal. Lead/contact records and their linked submission history are retained only for the commercial, contractual, legal, and rights-management periods that apply. Once processing has ended, data is securely deleted or anonymized.

09Your Rights as a Data Subject

Under the LGPD, you may exercise the following rights at any time:

  • Confirm the existence of processing and access your data.
  • Correct incomplete, inaccurate, or outdated data.
  • Request the anonymization, blocking, or deletion of unnecessary data.
  • Request the portability of your data to another provider.
  • Withdraw consent and object to processing carried out on the basis of legitimate interest.

10International Transfers

Some of our partners may store or process data on servers located outside Brazil. In such cases, we adopt appropriate safeguards to ensure that the transfer complies with the requirements of the LGPD.

11Children's Privacy

The Platform is intended for companies and professionals and is not directed at persons under 18 years of age. We do not intentionally collect data from minors. Should we identify such collection, we will take measures to delete the information.

12Changes to this Policy

This Policy may be updated from time to time. The current version will always be available on this page, together with the date of the last update. Material changes will be communicated through the appropriate channels.

13Data Protection Officer and Contact

To exercise your rights or clarify questions about the processing of personal data, please contact our Data Protection Officer (DPO) at privacidade@eucalipto.com.br.