Privacy Policy

1. Data collected

We may collect data voluntarily provided through the contact form, such as name, corporate e-mail, phone number, area of interest and the message sent.

2. Purpose of use

We use the data to respond to requests, propose business solutions and improve the user experience on the website.

3. Legal basis and consent

Processing takes place on the basis of the data subject’s consent and the legitimate interest for commercial contact, always respecting the principles of the LGPD.

4. Sharing and storage

Data may be processed by the technology providers strictly necessary to provide the service, listed below. Formspree, Plausible and Vercel operate outside Brazil, which constitutes an international data transfer. The hosting provider (Vercel, United States) logs technical access data, such as IP address, date and time, under Vercel’s own privacy policy. Messages are kept for as long as needed to reply and follow up on the business conversation, and are deleted when the data subject asks. If you contact us on WhatsApp, Meta’s privacy policy also applies; those conversations have the same purpose and the same retention as the form.

• Formspree (United States), to receive the contact form messages.
• Plausible (European Union), for aggregated browsing statistics, without cookies and without identifying the visitor.
• Microsoft 365, which hosts the mailbox that receives the messages.
• Vercel (United States), which hosts the website and delivers it through servers in several countries.

5. Data subject rights

You may request confirmation, access, correction, anonymization, portability or deletion of your data. You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

To exercise your rights or ask about how your data is processed, send an e-mail to contato@yottaflow.com.br.

6. Cookies

The site does not use its own cookies. Your browser stores locally only the theme, the language, whether the privacy notice has been shown, a copy of the pages so the site works offline and, for the session, the conversation with the assistant and its session code. When you open the assistant, the Cloudflare anti-bot check may use strictly necessary technologies (section 7). Audience measurement is done by Plausible, without cookies and without identifying the visitor.

7. AI virtual assistant

The website has an AI virtual assistant to answer questions about our services and route contact requests. The messages you write are sent to Yottaflow's API on Microsoft Azure (Brazil) and to the AI model provider, only to generate the answer. Yottaflow does not store the conversation text: it stays only in your browser until the tab is closed. We keep only usage metrics, without the text and without identifying the visitor, for up to 90 days (for example, date, website sections retrieved for the answer, amount of text processed and cost). To limit abuse, we keep for up to 24 hours a code derived from the IP address, without the IP itself, and the random code of the assistant session. Please don't write sensitive personal data in the conversation.

• OpenAI (United States), the AI model provider. Under OpenAI's policy, data sent through the API does not train models and may be kept for up to 30 days to monitor abuse.
• Cloudflare Turnstile (United States), the anti-bot check loaded when you open the assistant. It may use strictly necessary technologies to detect bots and does not read what you type.
• Microsoft Azure (Brazil), where the assistant's API runs.

OpenAI and Cloudflare also involve an international data transfer. Contact details left through the assistant go through Formspree, with the same purpose, legal basis and retention as the contact form.

8. Updates to this policy

This policy may be updated periodically. Last updated: 19 October 2026.