Shift23
Privacy Policy
Updated
This policy explains what personal data Shift23 receives through this site, what we use it for and what your rights are. It follows Brazil's General Data Protection Law (LGPD) and, for people contacting us from Canada, PIPEDA and Alberta's PIPA.
Who we are
Shift23 is a product and innovation consultancy working from São Paulo (Brazil) and Calgary (Canada). It is the controller of the personal data sent through this site.
For any privacy matter, write to contato@shift23.com.br.
What we collect
The data you enter in the contact form: name, email, company and, if you want, a message.
Technical connection data, such as IP address and browser, which our hosting provider processes to serve the site. We use the IP only to protect the form against abuse, and it stays in memory for 24 hours at most.
Aggregate usage data, measured with Vercel Web Analytics: pages visited, referring site, country, device type, operating system and browser. It uses no cookies and doesn't identify you: to count visitors it derives a code from the request that is discarded every 24 hours, and it only shows us totals.
We don't use cookies, advertising or tools that follow you across sites. The site's fonts are served from our own domain.
What we use it for
To reply to your request, schedule the diagnostic and talk about possible work.
To protect the site and the form against abuse.
To understand, in aggregate numbers, which pages are useful and improve the site.
We don't sell your data or use it for advertising.
Legal bases
In Brazil, we process the form data to take pre-contractual steps at your request (LGPD, art. 7, V), and the technical data and aggregate usage measurement based on our legitimate interest in keeping the site secure and improving it (art. 7, IX).
In Canada, processing of the form data is based on the consent you give when you submit the form, under PIPEDA and Alberta's PIPA. Usage measurement is aggregate and identifies no one.
Who we share it with
With providers that help us operate: Vercel (site hosting and aggregate usage measurement), Resend (email delivery) and our email provider. They process data on our behalf and may do so outside Brazil, including in the United States, with the contractual safeguards provided for in art. 33 of the LGPD.
Other than that, we only share data when the law requires it.
How long we keep it
We keep messages for up to 24 months after the last contact, unless a contract or the law requires longer. After that, they are deleted.
Your rights
Under the LGPD (art. 18), you can ask us to confirm that we process your data, and request access, correction, anonymization, portability, deletion, information about who we share it with, and withdrawal of consent.
In Canada, you can request access to and correction of your data and withdraw consent.
To exercise any right, write to contato@shift23.com.br. We reply within 15 days.
Complaints
If you think your data was not handled as it should be, talk to us first. You can also contact Brazil's National Data Protection Authority (ANPD), the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.
Changes to this policy
When this policy changes, we update the date at the top of the page.