Privacy Policy

1. Who the controller is

The controller of the data processed on this website is Rafael Rabelo de Souza (Rabelo Co.), Brazil. For any privacy matter — questions, requests or exercising your rights — the data subject channel is the email rafael@rabelo.company. We reply within 15 days.

2. What data we collect and when

AI agent chat (the "In practice" demo and "Request a proposal"): the messages you type, voice notes you record and images you send, plus the data you share in the conversation — typically name, company/niche, service channel, lead volume, main challenge, automation goal, email and WhatsApp. A random session identifier (UUID) keeps the conversation context.

"Request a proposal" form: name, company/industry, email, WhatsApp and your business description.

Scheduling (Cal.com): if you book a call, Cal.com collects your name, email and chosen time slot, under Cal.com's own privacy policy.

Technical data: your IP address is used transiently for abuse protection (rate limiting) and is not stored by the site in its own databases. We use no tracking cookies and no analytics tools; the only preference saved in your browser (localStorage) is the light/dark theme, which does not identify you.

3. Why we use it and on which legal basis

Qualification and business proposal: chat and form data are used exclusively to understand your business, prepare a personalized proposal and follow up via WhatsApp and email. Legal basis: preliminary procedures related to a contract to which you are a party (LGPD art. 7, V) and consent (art. 7, I), given when you start the conversation or tick the agreement box on the form.

Service security: transient technical data (IP) is processed under legitimate interest (art. 7, IX) to protect the site against automated abuse.

We do not sell, rent or share your data for third-party marketing. There is no automated decision-making with legal effect on you: the proposal is always prepared and sent by a person (Rafael Rabelo).

4. AI transparency

The chat is operated by an artificial-intelligence agent built on the n8n automation platform (Rabelo Co.'s own infrastructure). To generate replies, your messages are processed by OpenAI models (GPT-4o); voice notes are transcribed (Whisper) and images are described (computer vision). Under OpenAI's API terms, this data is not used to train their models. You are always informed that you are talking to an AI — the agent identifies itself as such.

5. Who data is shared with (processors)

To provide the service we use processors acting on our behalf: Vercel Inc. (website hosting, USA), OpenAI (chat language processing, USA), Cal.com Inc. (scheduling, USA, only if you book) and the n8n automation infrastructure maintained by Rabelo Co. itself. Follow-up contact may happen via WhatsApp (Meta) and email.

This entails international data transfer (LGPD art. 33) to countries under adequate contractual safeguards — all listed vendors operate under compatible data-protection agreements (DPAs). Data may also be shared if required by law or court order.

6. How long we keep it

Leads and chat conversations: kept for as long as needed to prepare and negotiate the proposal and for at most 12 months after the last contact — unless a contractual relationship starts (then legal contract terms apply) or you request deletion earlier. Technical automation execution logs have short, rotating retention. After these periods, data is deleted or anonymized.

7. Your rights (LGPD art. 18)

At any time and free of charge you may: confirm that processing exists; access your data; correct incomplete, inaccurate or outdated data; request anonymization, blocking or deletion of unnecessary or non-compliant data; request portability; obtain information about sharing; and withdraw consent (withdrawal does not affect processing already lawfully performed).

To exercise any right, write to rafael@rabelo.company with the subject "LGPD". If you believe processing violates the law, you may also petition the Brazilian Data Protection Authority (ANPD — gov.br/anpd).

8. How we protect data (art. 46)

Technical measures in place: encryption in transit (HTTPS/TLS with HSTS), security headers (CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy), per-IP rate limiting and origin validation on the APIs, validation and size limits on all submitted content, minimization (the site keeps no conversation database of its own; processing happens in the automation infrastructure with access restricted to the controller) and isolated credentials per service. In case of a security incident with relevant risk, we will notify affected data subjects and the ANPD, describing the event, the data involved and the measures taken.

9. Cookies and local storage

The site uses no first-party tracking cookies and no analytics. The only item saved in your browser is the theme preference (localStorage), essential to the experience and with no personal identification. The Cal.com scheduling widget, when loaded and used, may set its own cookies under Cal.com's responsibility.

10. Minors

Rabelo Co.'s services are aimed at businesses and are not directed at anyone under 18. We do not knowingly collect data from children or teenagers; if we identify such processing, the data will be deleted.

11. Changes to this policy

This policy may be updated to reflect changes to the site or the law. The last-updated date appears at the top of the page; material changes will be highlighted here.