Privacy Policy

This policy explains clearly how information may be processed when you use the Castteli Technology website: what data may be processed, for what purpose, with whom it may be shared and what your rights are.

It was written to describe how the site actually works as of the update date shown. Whenever that changes, the policy will be updated.

This policy applies to the Castteli Technology institutional website and to the interactions carried out through it, such as browsing its pages and sending messages through the contact form.

External websites that may be referenced by links have their own policies, which are not covered by this document.

Data you provide

The site does not require registration or login. The only personal data provided directly is what you choose to send through the contact form:

• name;
• email address;
• company (optional);
• selected subject;
• message content.

The form does not ask for a phone number, identification documents or sensitive personal data. We recommend that you do not include this kind of information in the text of your message.

Technical data

As with any website, some technical information is processed automatically to deliver the pages, keep the site running and protect it against abuse, such as:

• IP address;
• browser and operating system type and version;
• date, time and address of the pages requested;
• technical logs generated by the hosting infrastructure.

The site does not use audience analytics, advertising or behavioral tracking tools.

Information may be processed to:

• respond to requests you send;
• continue the communication you started;
• ensure the security of the site and prevent abuse, such as automated submissions;
• keep the site technically running, fix errors and perform maintenance;
• improve the experience of using the site;
• comply with legal obligations, where applicable.

Processing follows the legal bases set out in the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018) that apply to each purpose, such as responding to a request made by the data subject themselves and the legitimate interest in keeping the site secure.

Data you voluntarily send through the contact form is used to respond to your request and to continue the conversation you started.

Before anything is sent, the site checks the origin of the request, the format of the data and signs of automation. Once validated, the message is forwarded to a third-party service specialized in receiving forms, which delivers it to the channel responsible for replying. The site itself does not save messages in a database and does not record your personal data in logs.

Sending a message does not create an account, a subscription to email lists or any other relationship beyond handling the request itself.

Data is kept only for as long as necessary to fulfill the purposes described in this policy, or for the period required by a legal or regulatory obligation, where applicable. Once it is no longer needed, the data is deleted or anonymized.

Specific retention periods, where applicable, will be disclosed in this policy.

Castteli does not sell personal data. Data may be processed by technology providers strictly necessary to operate the site, which currently are:

• Vercel: hosting and delivery of the site, including processing of the technical data described in this policy;
• Formspree: receiving and forwarding messages sent through the contact form.

These providers may process data on servers located outside Brazil. Whenever there is an international transfer, it must comply with the requirements of the LGPD.

Data may also be shared with public authorities when required by a legal obligation or court order.

The site was built with security practices applied from the development stage, including:

• encrypted connection (HTTPS) on every page;
• security headers, including a content security policy (CSP);
• validation of all data received before any processing;
• abuse protections on the form, such as origin verification, detection of automated submissions and a minimum fill time;
• data minimization: the site collects only what is necessary and does not store messages;
• credentials and sensitive information kept out of the source code, with restricted access to the infrastructure;
• automated security checks during development.

No system connected to the internet is completely immune to incidents. For this reason, these measures are continuously reviewed, but absolute security cannot be guaranteed.

The site does not use analytics, advertising or marketing cookies. The use of cookies and similar technologies is described in the Cookie Policy. Cookie Policy

The LGPD guarantees you, as the data subject, the right to request:

• confirmation that processing takes place;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• data portability, under the applicable regulations;
• deletion of data processed on the basis of consent, where applicable;
• information about the entities with which the data has been shared;
• information about the possibility of not giving consent and its consequences;
• withdrawal of consent, where applicable.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

This policy may be updated to reflect changes to the site, to providers or to the law. The date of the last update is always shown at the beginning of the document.

A dedicated privacy and data protection channel will be announced once it is formalized. Until then, requests can be sent through the form on the contact page, stating in the subject that the request concerns privacy. Contact page

The registration and legal information related to the data controller will be made available on this page once the corresponding legal structure has been formalized.