Privacy

• Contact form. Your name, email address, company (optional) and the message you write. Stored with them are the language of the page, the page of this site you reached the form from (the path only), the campaign parameters of the link that brought you to the contact page (utm_source, utm_medium and utm_campaign), if any, and the date and time of the submission, which records the checked box confirming you read this page.
• IP address. Your IP address is never stored as it is. To limit the form to 5 submissions per hour from the same address (for IPv6, the same /64 network), the site keeps only a cryptographic hash of it, stored separately from your message and made with a secret key kept outside the database. Without that key, the address cannot be worked out from the hash: it is pseudonymized data, which Sigil Labs treats as personal data and deletes within 24 hours.
• Bot check. On the contact page, Cloudflare Turnstile checks that the form is used by a person. To do that, it receives technical data from your browser and your IP address, which the site also passes to it when it checks a submission, and it keeps a technical identifier of its own in your browser’s local storage (not in a cookie).
• Browsing. The site is served by Cloudflare, which processes technical connection data, such as the IP address, to deliver the pages and protect the service. Sigil Labs does not use that data to identify visitors. In some security situations, Cloudflare may set technical protection cookies; they are not used for advertising.
• Theme. If you use the theme button, your browser keeps the choice (light or dark) in local storage, under the key “sigil-tema”, for the next pages. It does not identify you and is not sent to Sigil Labs.
• Audience measurement. Cloudflare Web Analytics counts page visits, the referring site, the country and the type of browser and device. It uses no cookies and stores nothing in your browser. Cloudflare receives the IP address when the count is sent and states that it discards it at the nearest data center, without storing it in its core databases or logs.
• Email. When you write to Sigil Labs directly by email, it receives what you send, such as your name, email address and the content of the message.

Contact data is used only to reply to your message and, if both sides are interested, to prepare a proposal. The page language lets Sigil Labs reply in your language, and the source page and campaign parameters show Sigil Labs how you found the contact page. Audience measurement only shows how many people visit the site and where they arrive from, without identifying anyone.

The legal basis, under Brazil’s General Data Protection Law (Lei 13.709/2018), is your request, when you write to get a proposal or hire a service (art. 7, V), and Sigil Labs’ legitimate interest in replying to people who reach out (art. 7, IX).

Sigil Labs uses the IP hash and the bot check only to protect the form and the people who use it from abuse, also based on legitimate interest (art. 7, IX). Delivering the pages and measuring the audience also rely on Sigil Labs’ legitimate interest in keeping the site running and knowing how it is used (art. 7, IX).

Sigil Labs does not sell personal data. Apart from Cloudflare’s own use in Turnstile, described below, it passes only through the services that make the site and the contact work:

• Cloudflare: hosting, the database of form messages, the Turnstile check and Web Analytics. In Turnstile, Cloudflare handles the data on Sigil Labs’ behalf and also, as a controller, to improve bot detection, under the Turnstile privacy addendum.
• Resend: sends an email notice of each form message to Sigil Labs’ inbox. Resend keeps the data of each send in the United States for 30 days; Resend states that its backups persist for 7 days.
• Migadu: Sigil Labs’ email provider, which holds those notices and the messages received by email. Migadu states that the mailboxes and their backups are stored in France and the Netherlands.

All three services handle data outside Brazil. Cloudflare and Resend are US companies and Migadu is Swiss. The database of form messages is in North America.

Messages sent through the form are deleted automatically 12 months after they are sent, and the IP hash within 24 hours. Notices and email conversations are deleted within 12 months of the last message exchanged. If a conversation leads to a proposal or a contract, the messages of that relationship are kept until the applicable limitation period ends, as Brazilian civil law requires, and then deleted. You can ask for deletion sooner.

The database can be restored to its state at any moment in the last 7 days. So deleted data, the IP hash included, can still be recovered for 7 days, and not after that. If the database ever has to be restored, deletions made on request are carried out again. At Migadu, a deleted notice or email, Trash included, can remain in its backups for up to 14 days.

At any time and free of charge, you can ask Sigil Labs for:

• confirmation that it handles your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or handled in breach of Lei 13.709/2018;
• deletion of your data, even before the periods above, except what the law requires it to keep;
• portability of your data to another provider, under the ANPD’s regulations;
• information about who it is shared with.

You can also object to handling done without your consent if it breaches the law. If any handling depends on your consent (none does today), you can withdraw it and learn what follows if you do not consent.

Make the request through the form or the email address on the contact page. Email leaves you with a copy of your request; the form does not send one. Sigil Labs replies within 15 days of the request. You can also file a complaint with Brazil’s National Data Protection Agency (ANPD).

This page changes when the site starts handling data in a different way. The date of the last update is at the end of the page.