Privacy policy

Who we are

XSinc provides IT, automation and development services to businesses. As a Brazilian company, XSinc is the controller of the personal data handled on this website under Brazil’s General Data Protection Law (Law 13,709/2018, the LGPD), which applies wherever our visitors are.

Data controller: XSinc, based in Imbituba, SC, Brazil.

Privacy contact

For anything about your data, email us at the address at the end of this page. As a small data processing agent under Brazilian rules (ANPD Resolution 2/2022), XSinc doesn’t have to appoint a data protection officer, but keeps this channel open for you.

What we collect

What you enter in our forms: name, email, phone or WhatsApp, company, industry, your message, the calculator numbers and your online assessment answers.

With each submission we record the page it came from, the date and the approximate country of the connection. Our hosting provider (Cloudflare) processes your IP address to serve pages and block abuse; we don’t store it.

If you message us on WhatsApp or by email, we receive what you write there.

Why we use it, and on what legal basis

Each use has a legal basis under the LGPD (article 7):

• replying to your message, assessment or report request, preparing proposals and discussing a possible contract: steps you asked for before a contract (item V);
• delivering the services you hire us for: performance of a contract (item V);
• sending articles and news by email or WhatsApp: only with your consent, given in the optional box on our forms, which you can withdraw anytime (item I). For Canadian recipients, this box is the express consent required by CASL;
• issuing invoices and meeting other legal obligations (item II);
• protecting the site from abuse and bots, and exercising our rights in legal proceedings if needed: legitimate interest and the regular exercise of rights (items IX and VI).

Business outreach

XSinc also reaches out to businesses that may benefit from our services, using public business information and the company’s own website. This outreach relies on legitimate interest, always includes a way to opt out, and honors opt-outs right away. Anyone who opts out goes on a list that blocks future contact. Our emails follow CAN-SPAM in the US and CASL in Canada.

Automated assessment results

The online assessment result is put together automatically from your answers, as a first pointer. It doesn’t decide anything about you: a person at XSinc reviews your answers before any proposal. You can ask for a review of any automated processing (LGPD, article 20).

Who we share it with

We never sell your data or share it for advertising, including cross-context behavioral advertising. We use providers that handle data on our behalf, only as needed to serve you:

• Cloudflare: website hosting, forms and temporary storage of submissions;
• Microsoft: email (Microsoft 365);
• Meta: WhatsApp, when you chat with us there;
• Cal.com: scheduling, only if you book a time;
• Resend: internal email alerts when a submission arrives, if enabled;
• Anthropic: AI used in our internal system to organize messages and draft replies, on a plan that doesn’t use the data to train models;
• our accountants, for invoices, and authorities when the law requires it.

International transfers

Some of these providers store data outside Brazil, mainly in the United States. Transfers rely on the contractual safeguards they offer, or happen because they’re needed to fulfill your request or our contract (LGPD, article 33, items II and IX).

How long we keep it

We keep data only as long as needed:

• website submissions: up to 180 days in website storage, until they move to our internal system;
• contacts who didn’t become clients: up to 2 years after the last contact;
• clients: for the length of the contract and 5 more years, for legal and tax purposes;
• consent to receive news: until you withdraw it;
• people who opted out: only the email or phone number, on the list that blocks future contact.

Cookies and browser storage

This site doesn’t use advertising or tracking cookies. We only store your language choice in your browser, so we don’t ask again.

Your rights

Under the LGPD (article 18), you can ask us at any time for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data handled against the law;
• data portability;
• deletion of data processed with your consent, and withdrawal of that consent;
• information about who we share your data with, and about the option not to consent;
• objection to processing based on legitimate interest;
• review of decisions made solely by automated means.

How to make a request

Email us at the address at the end of this page. We reply within 15 days (LGPD, article 19). If you’re not satisfied, you can file a complaint with Brazil’s National Data Protection Authority (ANPD), at gov.br/anpd.

Security

We use secure connections (HTTPS), restricted access with two-factor authentication, and backups. No system is foolproof: if an incident creates a relevant risk for you, we’ll notify you and the ANPD, as the law requires.

Children

This site is meant for businesses and isn’t directed at anyone under 18.

Changes to this policy

We may update this policy. The date at the top shows the version in effect.