MindBrand
PTEN

Privacy Policy

Last updated: September 25, 2026.

This Policy explains, in a straightforward way, which personal data MindBrand processes when you visit the website mindbrand.com.br, fill in one of our forms or talk to our team, what we use this data for, with whom we share it and how you exercise your rights under Brazil’s General Personal Data Protection Law (Law No. 13,709/2018, the LGPD).

1. Who is the data controller

MINDBRAND BRANDING E MARKETING DIGITAL LTDA, CNPJ 52.493.495/0001-31 (Brazilian company tax ID), with address at Av. Paulista, 2202, São Paulo/SP (“MindBrand” or “we”).

2. Data Protection Officer

MindBrand’s Data Protection Officer (DPO, “Encarregado”) is Edison Antunes. For any matter about your personal data, write to [email protected], with the subject “Privacy”.

3. Which data we collect

3.1. Data you give us

  • Business Diagnostic: name, WhatsApp and email (first step); company data, such as name, CNPJ, website, industry, city, size and scope; your job title; and information about the business, such as revenue range, marketing investment, channels you use today, challenges, goals, deadlines, competitors and availability for the presentation, and how you got to know MindBrand. The data from the first step is recorded as soon as you move on to the next step, even if you do not complete the form.
  • Budget Simulator: name, WhatsApp, email and the options chosen in the simulation.
  • Brand Coherence Diagnostic: name, email, company, the answers and the result of the diagnostic.
  • Contact form: first name, last name, company, email and WhatsApp.
  • Conversations: whatever you send us by email, WhatsApp or in meetings.

Together with the Business Diagnostic, Simulator and Brand Diagnostic forms, we also send the origin of your visit: the website, search engine, social network or artificial intelligence assistant you came from, the campaign parameters of the link (utm) and the page you entered through. We use this to know which channels bring contacts.

3.2. Public data about your company

When you enter a CNPJ in the Business Diagnostic, we query public databases of the Federal Revenue registry (through the BrasilAPI and Minha Receita services) to confirm the company’s legal name, activity and registration status.

3.3. Browsing data

When you browse the website, we automatically collect technical and usage information: pages visited, time on page, clicks, scrolling, origin of the visit, device and browser type, approximate location (city or region, estimated from the IP address) and visitor and session identifiers. For this we use:

  • Google Analytics 4, loaded by Cloudflare Zaraz (the sending is done from Cloudflare’s servers, and not directly from your browser): audience and conversion statistics, such as diagnostic requests and WhatsApp clicks. We do not use Google’s personalized advertising features.
  • Microsoft Clarity: heat maps and session recordings, which show how the page is used (movement, clicks and scrolling), to find navigation problems. Clarity hides the content typed into form fields.
  • Cloudflare Web Analytics: website performance metrics, without cookies.
  • Technical security logs: the hosting and Cloudflare record IP address, date and time of access to protect the website against attacks and abuse. Our forms also limit the number of submissions per IP address.

4. What we use the data for and the legal basis

  • Fulfilling your request (preparing the Business Diagnostic, the simulation or the brand diagnostic), contacting you by email and WhatsApp, sending the confirmation email and scheduling the presentation. Legal basis: your consent, given in the form’s checkbox (art. 7, I), and the performance of preliminary procedures related to a contract that you requested (art. 7, V).
  • Organizing the service: the Business Diagnostic answers generate an automatic priority classification, used only to organize the team’s internal queue. No decision about you is made solely by this calculation: every analysis and every contact is done by a person. You can request a review of this classification (art. 20).
  • Measuring and improving the website (Google Analytics, Clarity and Cloudflare Web Analytics). Legal basis: MindBrand’s legitimate interest in understanding how the website is used and fixing problems (art. 7, IX and art. 10). We use only what is necessary for this, we do not sell this data and we do not use it for personalized advertising. You can object at any time (see item 9).
  • Security and abuse prevention (technical logs and submission limit). Legal basis: legitimate interest (art. 7, IX).
  • Providing the contracted services, if you become a client. Legal basis: performance of a contract (art. 7, V).
  • Complying with legal and regulatory obligations and exercising rights in proceedings. Legal bases: art. 7, II and VI.

5. Cookies and similar technologies

Cookies are small files saved in your browser. The website uses:

  • Microsoft Clarity analytics cookies (_clck, for up to 1 year, and _clsk, for 1 day): they recognize the visitor and group the pages of a single visit.
  • Cloudflare Zaraz identifiers for Google Analytics 4: they recognize visits and sessions in a pseudonymous way, on the mindbrand.com.br domain itself.
  • Local storage of the visit origin (mb_origem, for up to 180 days, and mb_origem_visita, deleted when the browser is closed): it stores where you came to the website from, to send along with a form, if you fill one in. It stays only in your browser until that submission.
  • Local storage of the cookie notice (mb_aviso_cookies): it only remembers that you have already seen the notice, so as not to show it again.

As the measurement is based on legitimate interest, the notice displayed on the website is informational. You can block or delete cookies in your browser settings at any time; the website keeps working normally.

6. With whom we share the data

We do not sell or rent personal data. We share data only with suppliers that provide services to us (processors), to the extent necessary for each service:

  • Hostinger: hosting of the website and of the server that receives the forms.
  • Cloudflare: delivery and security of the website, Cloudflare Zaraz and Cloudflare Web Analytics.
  • Google (Google Analytics 4): audience statistics.
  • Microsoft (Clarity): heat maps and session recordings.
  • Web3Forms: sending of the form answers to the team’s email.
  • Brevo: contact page form.
  • Agendor: customer relationship management (CRM) system, where we record the contacts and the progress of the service.
  • Zoho: corporate email, including the sending of the confirmation email.
  • Calendly: meeting scheduling, when you use the calendar link.
  • WhatsApp (Meta): conversations started by you through the website’s buttons.

We may also share data when the law requires, by order of a competent authority, or to defend MindBrand’s rights.

7. International transfer

Some of these suppliers (such as Google, Microsoft, Cloudflare, Web3Forms, Brevo, Zoho, Calendly and Meta) may store or process data on servers outside Brazil. These transfers follow art. 33 of the LGPD, based on the contractual and data protection guarantees offered by these suppliers.

8. How long we keep the data

  • Contacts that did not become clients (forms and CRM): up to 2 years after the last contact. After that, the data is deleted.
  • Clients: during the contract and, after it, for the period necessary to comply with legal, tax and contractual obligations.
  • Browsing data: for the retention period configured in each analytics tool, and after that it is deleted by the tool itself.
  • Consent: we keep the record that you accepted the form’s terms (text, date and time) for as long as we keep your data, as proof of consent.

9. Your rights

Under the LGPD (art. 18), you can, at any time and at no cost:

  • confirm whether we process your data and have access to it;
  • correct incomplete, inaccurate or outdated data;
  • request the anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
  • request the portability of the data to another provider;
  • know with whom we share your data;
  • revoke consent and request the deletion of the data processed based on it;
  • object to processing based on legitimate interest, such as the website’s audience measurement;
  • request a review of decisions made based on automated processing.

To exercise any of these rights, write to [email protected]. We may ask for information to confirm your identity before fulfilling the request. We reply within 15 days. You may also file a complaint with the National Data Protection Authority (ANPD), through the website gov.br/anpd.

10. Security

We adopt technical and administrative measures to protect the data, such as an encrypted connection (HTTPS) across the whole website, system access keys kept outside the public website and restricted access for the team that needs the data to work. No system is completely immune to incidents; if an incident occurs that may bring a relevant risk or harm, we will notify the ANPD and the affected people, as determined by the LGPD.

11. Children and adolescents

The MindBrand website and services are aimed at companies and professionals. We do not intentionally collect data from people under 18.

12. Links to other websites

The website has links to third-party services, such as WhatsApp, Calendly and social networks. When using them, each one’s privacy policy applies.

13. Changes to this Policy

We may update this Policy to reflect changes in the website, in the services or in the law. The date of the last update is always at the top of this page. If the change is relevant to those who have already sent us data, we will notify through the contact means provided.