Privacy Policy

Last updated: 23 September 2026

This is a courtesy translation. In the event of any discrepancy, the Portuguese version prevails.

Espiral Crossmedia respects your privacy. This policy explains, in plain terms, what data this site collects, why, and what you can do about it.

It applies to the website espiralcrossmedia.com.br.

Who is responsible

Espiral Crossmedia
São Paulo, Brazil
Barcelona, Spain
Email for privacy matters: atendimento@espiralcrossmedia.com.br
Phone (Europe): +34 642 11 48 74
Phone (Brazil): +55 11 3294-3902

We are the controller of the personal data processed on this site under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).

What this site does not do

We start with what we consider most important:

• We do not use analytics or tracking tools. There is no Google Analytics, social media pixel, heat map or any script that follows your behaviour.
• We do not use advertising or analytics cookies. Browsing this site writes no cookie to your browser.
• We do not sell, rent or share your data with third parties for commercial purposes.
• We do not profile you or make automated decisions about you.
• Fonts are served from our own site. Your browser does not communicate with Google when you access these pages.

Data we collect

1. When you fill in the contact form

We collect only what you type:

Purpose: to respond to your enquiry and assess a possible provision of services.
Legal basis: pre-contractual steps taken at your request (LGPD, art. 7, V).
Destination: the message is sent by email to atendimento@espiralcrossmedia.com.br, with your address in the reply-to field so we can answer you directly.

This data is not stored in any database of ours and is not added to any marketing list. It exists as an email in our inbox.

To prevent automated submissions by bots, the form temporarily keeps your IP address in server memory for up to 10 minutes. It is not stored, not logged and not used for any other purpose.

2. When you simply browse

We do not request or store any data about you. However, as with every website, access involves technical communication between your browser and the servers that host and deliver the content. In that process, those servers automatically receive technical information such as your IP address and browser type — data needed for pages, images and videos to reach you.

We explain below who those servers are.

Services we use

To keep the site running we rely on three companies. They act as processors: they handle data only to provide us a service.

Vercel — hosting and form processing.
Every visit passes through its servers, which receive technical connection data, including IP address. This is inherent to any hosted website.
Policy: vercel.com/legal/privacy-policy

Supabase — database and storage for the images and videos shown on the site.
When a page loads, your browser fetches that content directly from Supabase servers, which receive technical connection data, including IP address. This happens automatically, with no action on your part beyond visiting the site.
Policy: supabase.com/privacy

Brevo — delivery of form emails.
Receives the data you typed, only when you submit the form. If you never fill it in, Brevo receives nothing about you.
Policy: brevo.com/legal/privacypolicy

These services may process data on servers outside Brazil. International transfer takes place with the safeguards provided in LGPD articles 33 et seq.

Social media links: the footer links to our profiles on Instagram, LinkedIn and YouTube. They are plain links with no embedded content — those platforms only receive data about you if you click and leave our site.

Cookies

This site uses no cookies on its public pages. You can browse the entire site without anything being written to your browser.

There is a single cookie in the system, created only when an Espiral administrator logs in to the restricted content-management area. It keeps that session open and is strictly necessary for that area to work. Site visitors never receive it.

Because there are no analytics, advertising or personalisation cookies, we show no consent banner — there would be nothing to consent to.

How long we keep data

Form messages: kept in our inbox for as long as needed to handle the enquiry and maintain the business relationship history, and deleted when no longer useful or at your request.

Technical connection data: retention follows the policy of each service listed above. We do not control those periods.

Your rights

Under the LGPD you have the right to:

• Confirm whether we process your data and access it
• Correct incomplete, inaccurate or outdated data
• Request deletion of the data you provided us
• Request portability of your data to another provider
• Obtain information about whom we share your data with
• Withdraw consent, where that is the basis for processing
• Object to processing you consider irregular

To exercise any of them, write to atendimento@espiralcrossmedia.com.br. We reply within 15 days.

You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

Security

We adopt technical measures to protect the data we process: encrypted communication (HTTPS) across the whole site, administrative access restricted to authorised, authenticated people, and access keys kept outside the site’s code.

No system is fully immune. In the event of a significant security incident, we will notify affected individuals and the ANPD, as the law requires.

Beyond this site

This policy covers this site. The processing of personal data in the course of our services — concerning clients, team members, talent and people whose data we process on behalf of clients — is governed by Espiral Crossmedia’s Privacy and Personal Data Protection Policy, approved on 15 September 2026.

In short, that policy commits us to:

• Process only the necessary data, for a defined purpose and on an identified legal basis.
• When we act on behalf of a client, follow solely the instructions agreed in the contract, without using the data for our own purposes or to train artificial intelligence models.
• Use people’s image, voice and name only with express authorisation.
• Report incidents affecting client data within 24 hours of confirmation.
• Return or delete the data at the end of the contract, unless a legal obligation requires otherwise.

Our Data Protection Officer is Lucas Godoi, and any request can be sent to atendimento@espiralcrossmedia.com.br.

A summary of our practices on security, privacy and the use of artificial intelligence can be found on the Governance and compliance page. The full policy is made available to clients and partners on request.

Minors

This site is aimed at professionals and companies. We do not knowingly collect data from anyone under 18. If we identify such a submission, the data will be deleted.

Changes to this policy

We may update this document to reflect changes to the site or the law. The date at the top shows the last revision. Significant changes will be flagged on the site itself.

Questions

atendimento@espiralcrossmedia.com.br
Europe: +34 642 11 48 74
Brazil: +55 11 3294-3902
São Paulo, Brazil · Barcelona, Spain