Privacy Policy
Effective date · April 30, 2026
This Privacy Policy explains what personal data we collect through the website at vanor.co (the "Site"), how we use it, and the rights you have over it. It applies to visitors of the Site only, not to clients with whom Vanor has a separate signed agreement (those engagements are governed by their own data-protection terms).
1. Who controls your data
The data controller is Vanor, a trade name operated by Lucas Weiss Brito, an individual entrepreneur based in Brazil. We can be reached at legal@vanor.co. The same address serves as the contact for our Data Protection Officer / Encarregado de Dados under the Lei Geral de Proteção de Dados ("LGPD").
2. What we collect
Information you give us
When you submit a contact form or a discovery-call form, we collect the information you choose to provide — typically your name, work email, company, role, and any message or context you write. If you book a call through our scheduling tool, that tool collects scheduling details (your selected time, time zone, and any answers you give it).
Information collected automatically
When you visit the Site, we and our analytics providers collect technical and usage data, including: IP address, approximate location derived from IP, device and browser type, operating system, referring URL, pages visited, time spent on pages, and interaction events (clicks, scrolls, mouse movements). Microsoft Clarity additionally records anonymized session replays — recordings of mouse movement, clicks, and scroll behavior on the page.
We do not knowingly collect special-category data (such as health, racial, religious, or political data), and we ask you not to submit such data through the Site.
3. Why we use it
Under the LGPD and equivalent laws (such as the GDPR), we process personal data on the following bases:
- To respond to your inquiries and schedule calls — to take steps at your request prior to entering into a contract (LGPD Art. 7, V), and on legitimate interest in operating the business (LGPD Art. 7, IX).
- To analyze and improve the Site — based on legitimate interest in understanding how the Site is used and improving it.
- To comply with legal obligations — when applicable.
You may object to or withdraw any consent-based processing at any time (see "Your rights" below).
4. Who we share it with
We use the following third-party services to operate the Site. Each one processes only the data needed to provide its specific function, and is contractually required (or, where standard, by published terms) to safeguard that data.
- Vercel — hosting and content delivery (server logs, IP address).
- Supabase — storage of contact-form and discovery-call submissions.
- Google Analytics 4 (Google LLC) — site analytics and traffic measurement.
- Microsoft Clarity (Microsoft Corporation) — heatmaps and anonymized session replays.
- cal.com — scheduling tool used to book discovery calls.
We do not sell personal data, and we do not share it for advertising purposes.
5. International transfers
Some of the providers listed above (notably Google, Microsoft, Vercel, and cal.com) are based in the United States or operate global infrastructure, which means your personal data may be transferred outside Brazil and outside your country of residence. We rely on the safeguards offered by these providers under their published terms (including, where applicable, EU Standard Contractual Clauses and equivalent transfer mechanisms) and on the cross-border-transfer permissions in LGPD Art. 33.
6. How long we keep it
- Contact-form and discovery-call submissions — up to 24 months after our last interaction with you, after which the record is deleted unless we are legally required to retain it longer.
- Analytics data — retained according to the default retention settings of each analytics provider (typically 14 months for GA4 events; varies for Clarity).
- Server and hosting logs — retained by Vercel for short rolling windows per their default policy.
7. Your rights
Under the LGPD, the GDPR, and similar laws, you have the right to:
- confirm whether we process your data, and access a copy of it;
- correct incomplete, inaccurate, or out-of-date data;
- request deletion of your data, subject to legal-retention exceptions;
- request portability of your data to another provider;
- object to processing carried out on the basis of legitimate interest;
- withdraw any consent you have given, at any time, with effect going forward;
- be informed about the public and private entities with which we have shared your data.
To exercise any of these rights, email legal@vanor.co. We will respond within fifteen (15) days, in line with LGPD Art. 19. If you believe your rights are not being respected, you may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or your local supervisory authority.
9. Security
We rely on the security controls provided by Vercel, Supabase, and the other infrastructure providers listed above, including encryption in transit and at rest, access controls, and isolated environments. Access to personal data is restricted to personnel who require it to operate the service. No system is perfectly secure; if we ever become aware of a breach affecting your personal data, we will notify you and the relevant authority where the law requires it.
10. Children
The Site is intended for a business audience and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, contact legal@vanor.co and we will delete it.
11. Changes to this Policy
We may update this Policy from time to time. The current version, with its effective date, will always be posted on this page. Material changes will be highlighted at the top of this page for at least thirty (30) days.
12. Language
This Policy is made available in English and Portuguese. The English version is the controlling version. In the event of any conflict or inconsistency between versions, the English version prevails.
13. Contact
For any privacy question, including data-rights requests, email legal@vanor.co.