Privacy
Privacy Policy
This document describes the processing observed on CadSyntra's institutional website, including the contact form, optional analytics, and operational logs.
Version privacy-notice-en-v1 · Effective
English adaptation reviewed for linguistic and legal publication. This factual text is not legal advice or a declaration of compliance.
Controller and privacy contact
The controller responsible for the processing described in this policy is 61.850.221 PEDRO HENRIQUE RAMOS MARTINS, operating under the CadSyntra brand.
Requests concerning access, correction, deletion, or withdrawal may be sent to [email protected]. The owner monitors this channel; no public response deadline is promised in this version.
Data processed and purposes
- General contact: name, email address, message, and consent, used to receive, assess, and respond to the request.
- Quote request: the same data plus the controlled area of interest selected by the visitor.
- Optional analytics: route without query string, locale, page type, categorized referrer, and categorical actions from the public catalog. Form content and personal identifiers are prohibited.
- Operational logs: time, route class, status, error class, duration, opaque technical identifier, and sanitized transport code, without payload, name, email address, or message.
- Rate limiting: a temporary HMAC digest of the request origin is held only in process to limit abuse; the application does not log the source address in plain text.
Independent consent choices
The contact-consent-v1 consent covers only the use of data to respond to the commercial request and its delivery to the monitored mailbox. It does not authorize newsletters, training, portfolio use, or secondary purposes.
Analytics has a separate optional choice. Umami loads only after explicit permission. The granted or denied preference is stored in this browser's localStorage without a visitor identifier and can be changed from the footer.
Self-hosted analytics
CadSyntra uses self-hosted Umami in separate services on contracted infrastructure. The analytics.cadsyntra.com hostname is served through Cloudflare's proxy. After consent, automatic collection, search parameters, fragments, cookies, persistent identification, fingerprinting, session replay, and heatmaps remain disabled.
Allowed events are page_view, cta_click, inquiry_start, inquiry_validation_error, inquiry_submit, inquiry_delivery_error, and article_service_click. Names, email addresses, messages, correlation IDs, files, and query strings must not be sent.
Sharing and providers
- HostGator provides the VPS, infrastructure, and email used to publish the website and receive requests.
- Umami and PostgreSQL run as self-hosted services on the contracted infrastructure to store authorized analytics data.
- Cloudflare intermediates HTTP/HTTPS traffic for analytics.cadsyntra.com and may process technical metadata and security logs in its operation. The application catalog does not send form content or persistent identifiers through that path.
- UptimeRobot checks website pages and the health route for availability. Automated monitoring does not submit forms or receive their content.
- EasyPanel, Traefik, and Nodemailer are operational technologies; their use does not automatically mean that each acts as an independent external data processor.
- The domain registrar and DNS provider will be identified according to the effective domain configuration.
Retention and deletion
- Real commercial contacts: up to 12 months after the last relevant commercial interaction, except during active negotiation, a contractual relationship, or an applicable legal obligation.
- Synthetic test messages: preferably deleted within one day after the required evidence is recorded.
- Analytics: a rolling 12-month window; the operational routine and PostgreSQL backups follow the same limit.
- Sanitized operational logs: one day.
- At this stage, CadSyntra does not create a lead database, CRM, parallel spreadsheet, or additional permanent mailbox copy.
Rights and choices
A data subject may request confirmation of processing, access, correction, sharing information, deletion where applicable, and withdrawal through the privacy contact.
Withdrawing analytics permission stops future events in that browser. Withdrawal of contact consent may be requested by email, subject to legally applicable retention grounds.
Security and limitations
The published website uses HTTPS, server-side validation, abuse controls, authenticated SMTP, security headers, and minimized logs. No internet-connected system has zero risk; incidents and material changes must be assessed and communicated under applicable rules.
Do not submit drawings, DWG files, or confidential information through the form. Any file exchange will be defined later through a channel appropriate to the project.
Markets and transfers
The launch primarily targets Brazil. The English version may receive passive international interest without initially targeting a specific foreign jurisdiction.
External providers may operate infrastructure outside Brazil. International expansion and applicable transfer mechanisms must be reviewed before the bilingual launch and whenever the provider chain changes.
Changes to this policy
Material changes to purposes, data, providers, retention, or consent require an updated document and, where applicable, a new visitor choice. The version and effective date remain visible at the top of the page.