Privacy and Cookie Policy
1. Who we are
We are STRATAFLOW TECNOLOGIA LTDA ("Strataflow", "we"), headquartered at Rua Atílio Piffer, 271, Sala 64, Casa Verde, São Paulo/SP, ZIP code 02516-000.
We are a B2B software (SaaS) company for go-to-market (GTM) strategies.
This Policy explains how we process your personal data when you visit the strataflow.co website (in Portuguese or English) or contact us through it. It follows the Brazilian General Data Protection Law (Law No. 13,709/2018, LGPD) and the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014, Marco Civil da Internet).
2. Our role: website and platform
On the website: Strataflow is the controller of the data described in this Policy. In other words, we decide how and why it is processed.
On the platform: when our customers enter personal data into the Strataflow platform, Strataflow acts as a processor. We process that data on the customer's behalf and according to the customer's instructions. This processing is governed by the contract with the customer and by the platform terms, which are a separate document.
If you are a user of one of our customers and want to exercise your rights over data entered into the platform, please contact the company that hired Strataflow first. We will help the customer respond.
3. What data we collect
3.1. Data you send us through the forms (Contact and Design Partner):
name;
business email;
company;
job title;
message content and any other information you choose to include.
Please do not send sensitive personal data (for example, about health, religion or political opinion) through the forms.
3.2. Data collected automatically when you browse:
IP address;
identifiers of cookies and similar technologies (pixels, tags, local storage);
device and browser data (type, operating system, language, screen resolution);
pages visited, browsing time, clicks and interactions;
traffic source (referring site, campaign, keyword, UTM parameters);
date and time of access.
Items that depend on analytics or marketing cookies are only collected if you accept those categories in the banner.
3.3. Consent record data: when you make a choice in the banner, we record that choice (see section 6).
4. How we use data and on what legal basis
We use your data only for the purposes below, based on article 7 of the LGPD.
Source
Data
Purpose
Legal basis
Browsing and necessary cookies
IP, technical identifiers, session data, your cookie preference
Make the website work, keep it secure, prevent fraud and abuse, and remember your cookie choice
Legitimate interest and technical necessity to provide the service you requested (art. 7, IX)
Analytics
Cookie identifiers, device and browser data, pages visited, interactions, traffic source
Understand how the website is used, measure the performance of pages and content, and improve the experience
Consent (art. 7, I). Only enabled if you accept "Analytics"
Marketing
Cookie identifiers, IP, pages visited, interactions, traffic source
Measure campaign conversions, show relevant ads on third-party platforms, generate aggregated audience statistics and identify, from the IP, the company linked to the visit (without identifying you individually) for B2B prospecting
Consent (art. 7, I). Only enabled if you accept "Marketing"
Contact and Design Partner forms
Name, business email, company, job title, message
Answer your request, schedule conversations, assess participation in the Design Partner program and present proposals
Preliminary procedures related to a contract to which you or your company is a party, at your request (art. 7, V)
B2B sales follow-up
Form data and interaction history
Continue the business conversation you started as a company representative, and send information about products and services related to the subject of your contact
Legitimate interest (art. 7, IX and art. 10). You can opt out at any time (see section 7)
Consent record
Date and time (UTC), anonymous ID (UUID), policy and banner versions, choice per category, action, source, language, URL and, if used, truncated or hashed IP
Prove that consent was validly given, refused or withdrawn
Compliance with a legal obligation (art. 7, II, combined with art. 8, paragraph 2 of the LGPD) and exercise of rights in judicial, administrative or arbitration proceedings (art. 7, VI)
Access logs
IP, date and time of access
Keep the access records required by law
Compliance with a legal obligation (art. 7, II, combined with art. 15 of the Marco Civil da Internet), for 6 months
We may also process data when necessary to exercise rights in judicial, administrative or arbitration proceedings (art. 7, VI).
Analytics and marketing always depend on your consent. We never use legitimate interest for these purposes.
We do not use your data for purposes other than those described in this Policy. If we need a new purpose, we will update this Policy and let you know in advance. Where the law requires, we will ask for your consent.
6. Record of your consent
We keep a record of every choice you make in the banner. It serves to prove that we respected your decision.
Where it is stored: on Strataflow's own infrastructure with a cloud provider that acts as a processor, providing the infrastructure. The records are stored in the European Union. Backup copies may be kept in other countries, with the same contractual safeguards described in section 10.
What we record: date and time (UTC), a random anonymous identifier (UUID), policy and banner version, your choice in each category, the action (accept, reject, save settings or withdraw), where the choice was made (banner, settings screen or footer link), the language and the page URL.
IP: we do not store your full IP. If used, it will only be truncated or hashed.
Integrity: once stored, the record cannot be changed. A new choice creates a new record.
How long: while the consent is in effect and for 5 more years after it ends, is withdrawn or is replaced.
7. Marketing emails and how to unsubscribe
We may send B2B marketing emails related to the contact you started with us.
You can stop receiving them at any time:
through the unsubscribe link included in all our marketing emails; or
by writing to contato@strataflow.co.
We will handle your request as soon as possible and record the opt-out so we do not email you again. Even after unsubscribing, you may receive necessary messages about a request in progress or a contract with your company.
8. Artificial intelligence and integrations
The website and our support may use artificial intelligence (AI) tools, for example to organize and answer messages. The providers of these tools follow the rules of this Policy and are treated like the other providers in section 9.
Strataflow does not use personal data collected on the website to train third-party AI models.
If you connect AI tools or other services through connectors or integrations (for example, MCP), the data that passes through that provider is subject to the terms and privacy policy of the provider you chose. Strataflow does not control how that provider processes the data.
You can revoke an integration's access at any time by requesting it at contato@strataflow.co.
9. Who we share data with
We do not sell personal data. We share data only with providers that help us operate the website and the business, and only to the extent necessary:
Analytics and tag management tools: measuring audience and website performance. Analytics tools depend on your consent.
Advertising platforms and social networks: conversion measurement, audience statistics and advertising, with your marketing consent.
Sales intelligence tools: identifying the company linked to the visitor's IP, with your marketing consent. This data stays on the provider's platform and does not automatically enter our CRM.
Cloud providers: infrastructure for the consent record, as processors.
Website hosting and other cloud infrastructure providers: website hosting, storage and operation of our services.
CRM providers and email and productivity tools: managing contacts and business communications originating from the forms.
Public authorities, when there is a legal obligation, a court order or a request from a competent authority.
Some providers act as processors (they process data on our behalf and according to our instructions). Others, such as advertising platforms and social networks in certain advertising uses, may also act as independent controllers or joint controllers, with their own privacy policies.
10. International transfer
Some providers process data outside Brazil. Analytics tools, advertising platforms and social networks, and sales intelligence tools may store or process data in the United States and in the European Union.
These transfers follow article 33 of the LGPD and ANPD Board Resolution (Resolução CD/ANPD) No. 19/2024, through standard contractual clauses approved by the ANPD or another valid mechanism provided for by law. For analytics and marketing, these tools are only enabled with your consent.
Other providers in section 9, such as hosting, cloud, CRM and email providers, may also process data in the United States and in the European Union, and follow the same rules.
The consent record is stored with a cloud provider, with storage in the European Union, and backup copies may be kept in other countries. These transfers follow the standard contractual clauses approved by the ANPD.
11. How long we keep data and what happens at the end
We keep data only for as long as necessary for each purpose:
Forms (Contact and Design Partner): up to 24 months after the last contact or after the end of the business relationship, whichever is later.
Analytics data: 14 months.
Marketing cookies: according to each cookie's duration, up to 13 months.
Visiting company identification data: while we keep an account and active use of the tool, with an annual review of the need.
Access and security logs: 6 months (art. 15 of the Marco Civil da Internet).
Consent record: while the consent is in effect and for 5 more years after it ends, is withdrawn or is replaced.
When the purpose ends or the period expires, we securely delete or anonymize the data. We only keep it longer when the law requires or to exercise rights in judicial, administrative or arbitration proceedings (art. 16 of the LGPD).
12. Security
We adopt technical and administrative measures to protect your data against unauthorized access, loss, alteration or destruction. These include encryption in transit (HTTPS), access only for those who need it, strong authentication on tools and security requirements in contracts with providers.
If there is a security incident that may pose a relevant risk or harm to you, we will notify the ANPD and the affected data subjects, as provided in the LGPD, and take measures to reduce its effects.
13. Your rights
You can request, at any time and free of charge (art. 18 of the LGPD):
confirmation that we process your data;
access to your data;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
portability of your data to another provider, subject to commercial and industrial secrets;
deletion of data processed based on your consent, except for the exceptions in art. 16 of the LGPD;
information about the companies and public entities with which we share your data;
information about the possibility of not giving consent and what happens if you do not;
withdrawal of consent;
objection to processing based on legitimate interest, if there is non-compliance with the LGPD.
You can also request a review of decisions made solely on the basis of automated processing that affect your interests (art. 20 of the LGPD).
Withdrawing consent: for cookies, use the "Cookie preferences" link in the footer. For marketing emails, use the unsubscribe link or write to contato@strataflow.co.
How to request: write to contato@strataflow.co. We may ask for information to confirm your identity and prevent fraud. We respond within 15 days of receiving the request. If we cannot fulfill it right away, we will explain why.
Complaints: if you believe your request was not properly handled, you can file a complaint with the ANPD (section 18).
14. Children and teenagers
Strataflow's website and services are intended for companies and professionals. They are not directed at children or teenagers. We do not knowingly collect data from anyone under 18. If we identify such collection, we will delete the data.
15. Corporate reorganization
If Strataflow undergoes a merger, acquisition, merger by absorption, spin-off or other corporate reorganization, your data may be transferred to the successor company. The successor must comply with this Policy. We will notify you before the transfer takes place or as soon as possible, through the website or by email.
16. Changes to this Policy
We may update this Policy due to changes in the law, in technology or in the tools we use. The version and the date of the last update are always shown at the top. Relevant changes will be highlighted on the website. If they affect the use of cookies, we will ask for your choice again in the banner.
17. Data Protection Officer and contact
Data Protection Officer (Encarregado): Guilherme de Toledo Costa
Email: contato@strataflow.co
Address: Rua Atílio Piffer, 271, Sala 64, Casa Verde, São Paulo/SP, ZIP code 02516-000.
18. Brazilian Data Protection Authority (ANPD)
You can file a complaint with the ANPD through the channels available at www.gov.br/anpd.
19. Governing law
This Policy is governed by Brazilian law, in particular the LGPD and the Marco Civil da Internet.