Privacy Policy

DEVSKIN DESENVOLVIMENTO DE SOFTWARES LTDA ("DEVSKIN", "we", "our", or "us") is a Brazilian software development company headquartered in Barueri, São Paulo. We design and build custom digital products — including web and mobile applications, automation systems, and AI-assisted software — for businesses across Brazil and internationally.

This Privacy Policy explains what personal data we collect when you visit devskin.site (our "Website"), how we use it, how we protect it, and what rights you have over it. It applies to all visitors, potential clients, and anyone who contacts us through any channel associated with our Website.

We are committed to handling your personal data lawfully, transparently, and in a manner that respects your privacy. We comply with Brazil's Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018) and, where applicable, the European Union General Data Protection Regulation (GDPR — Regulation 2016/679).

We collect personal data in two ways: directly from you when you voluntarily provide it, and automatically as you interact with our Website.

2.1 — Information you provide to us directly

When you fill in a contact or project-inquiry form, request a quote, subscribe to our communications, or reach us by email, you may provide:

• Full name and professional role or title
• Business or personal email address
• Phone number (optional, when provided)
• Company name and industry sector
• Details about your project, business needs, or questions
• Any additional information you choose to include in free-text fields or direct messages

We collect only what is necessary to respond to your inquiry and assess how we can best serve you. You are never required to submit sensitive personal data (such as financial information, health records, or government ID numbers) to use our Website — please do not include such information in contact forms.

2.2 — Information collected automatically

When you navigate our Website, our servers and third-party analytics tools automatically collect certain technical and behavioural data, including:

• IP address and approximate geographic location (city/country level)
• Browser type, version, and operating system
• Device type (desktop, tablet, or mobile)
• Referring URL — the page or search result that brought you to our site
• Pages visited, time spent on each page, and navigation path through the site
• Date and time of access
• Interaction events such as button clicks, form starts, and scroll depth

This data is collected primarily through cookies and similar tracking technologies, which are described in detail in Section 4.

We use the personal data we collect for specific, legitimate purposes. We do not sell your data or use it for purposes unrelated to the ones listed below.

• Responding to inquiries and project discussions. When you contact us, we use your name, email, and project details to get back to you promptly, understand your requirements, and prepare a relevant proposal.
• Managing our business relationship. If a project engagement begins, we use your contact and company information to communicate throughout the work, issue invoices, and fulfil our contractual obligations.
• Improving the Website. Aggregated and anonymised analytics data helps us understand which content is useful, where visitors encounter friction, and how to make the Website faster and more helpful.
• Marketing communications. Only with your explicit prior consent, we may send updates about our services, published content, or relevant industry insights. Every such communication includes an unsubscribe link and you can withdraw consent at any time.
• Advertising performance measurement. We use anonymised conversion data from tools like Google Ads to understand how well our advertising reaches the right audience. No personally identifying information is shared with ad platforms beyond what is described in Section 5.
• Legal compliance and legitimate interests. We may process your data when required by applicable law, to establish or defend legal claims, or to protect the rights and safety of our staff and clients.

The legal bases we rely on under the LGPD and GDPR include: your consent (for marketing and non-essential cookies), contract performance (when processing is necessary to carry out work you have requested), legitimate interests (for analytics and security, balanced against your privacy interests), and legal obligation (when required by law).

Our Website uses cookies — small text files stored on your device — and similar technologies such as web beacons and pixel tags. We use them for three categories of purpose:

Strictly necessary cookies. These are essential to operate the Website and cannot be switched off. They include session management, security tokens, and load-balancing cookies set by our hosting infrastructure. No personal data is retained beyond your session, and these cookies do not require your consent.

Analytics cookies. With your consent, we use Google Analytics 4 (GA4) to collect aggregated data about how visitors use the Website. GA4 uses cookies (including _ga and _ga_*) that persist for up to 13 months. We have enabled IP anonymisation so that full IP addresses are never stored by Google. The data collected is used exclusively by DEVSKIN to improve the Website experience.

Advertising and remarketing cookies. With your consent, we may use Google Ads conversion tracking and Google Tag Manager. These tools record whether a visit to our Website followed a click on one of our advertisements, allowing us to measure advertising effectiveness and optimise our campaigns. They do not give us access to any personal data already stored on your device.

When you first visit the Website, a cookie-consent banner informs you of these categories and asks for your permission before any non-essential cookies are set. You may change or withdraw your consent at any time using the Cookie Preferences link in the site footer. You can also configure your browser to block or delete cookies — note that doing so may affect certain Website features.

For detailed information about how Google uses data from websites that use its services, visit policies.google.com/technologies/partner-sites.

We do not sell, rent, or trade your personal data. We share it only in the limited circumstances described below, and always in accordance with applicable data-protection law.

• Service providers acting as data processors. We engage carefully selected companies to help us operate our business — for example, cloud hosting providers, email delivery services, and analytics platforms. These parties process data strictly on our behalf and under written data-processing agreements that prohibit them from using your data for their own purposes.
• Google LLC. Through Google Analytics and Google Ads, anonymised behavioural and conversion data may be transferred to Google's servers, which may be located outside Brazil or the EU. Google LLC participates in the EU–US Data Privacy Framework and provides appropriate safeguards for international data transfers under both LGPD and GDPR.
• Professional advisers. We may share information with lawyers, accountants, or insurers to the extent necessary to obtain professional advice or manage business operations.
• Legal and regulatory authorities. If required by Brazilian law, court order, or regulatory request, we may disclose information to the relevant authority. Where legally permitted, we will notify you before doing so.
• Business transfers. In the event of a merger, acquisition, or sale of all or part of our business, personal data held by DEVSKIN may be transferred to the relevant third party. You would be notified beforehand and this Policy would continue to govern your data.

We do not share personal data collected through inquiry forms with third-party marketing platforms or data brokers under any circumstances.

We keep personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by law. Our specific retention periods are as follows:

• Contact and inquiry data. Records of messages and project discussions are retained for up to 5 years from the date of last contact. This period enables us to respond to follow-up questions, reference past discussions if a new project begins, and fulfil any applicable statute of limitations.
• Active client data. Data relating to ongoing or completed project engagements is retained for 10 years after the conclusion of the contract, in line with Brazilian commercial and tax law (particularly the requirements of the Brazilian Civil Code and Federal Revenue Service regulations).
• Marketing communications. If you consented to receiving our updates, we retain your email address and consent record until you withdraw your subscription. Consent records themselves are kept for 5 years after withdrawal as evidence of prior consent.
• Website analytics data. Aggregated, anonymised analytics data collected via GA4 is retained for 14 months at the property level, in line with Google Analytics' default data-retention settings. Raw IP addresses are never stored.
• Cookie preferences. Your consent choices are stored for 12 months and you will be asked to confirm them again on renewal.

When retention periods expire, data is permanently deleted or irreversibly anonymised. You may request earlier deletion — subject to any overriding legal obligations — using the contact details in Section 11.

As a software development company, information security is central to how we work — not an afterthought. We implement a combination of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction.

• All data transmitted between your browser and our Website is encrypted using TLS 1.2 or higher. Our site enforces HTTPS on every page.
• Contact form submissions are transmitted directly to a secured mailbox and are not stored in unencrypted logs or databases accessible via the public internet.
• Access to personal data within our organisation is limited to team members who need it to perform their role. Access controls are reviewed regularly.
• Our infrastructure is hosted on reputable cloud providers that maintain ISO 27001 certification and SOC 2 Type II compliance.
• We conduct periodic internal security reviews and follow secure development practices for any code or configuration related to data handling on the Website.

Under the LGPD and, where applicable, the GDPR, you have a meaningful set of rights over your personal data. We take these rights seriously and will respond to any valid request within 15 business days (or within any shorter period required by law).

To exercise any of the above rights, please send a written request to contato@devskin.site with the subject line "Data Rights Request" and sufficient information for us to verify your identity and locate your data. We will not charge a fee for reasonable requests and we will not discriminate against you for exercising your rights.

Our Website and services are directed exclusively at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18, and our contact forms and service offers are not designed for or targeted at minors.

If you are a parent or guardian and believe your child has submitted personal data to us without your knowledge, please contact us immediately at contato@devskin.site. We will promptly delete any such data from our records upon verification. We will cooperate fully with parental requests in this regard.

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable legal requirements. When we make material changes — those that significantly affect how we use your data or your rights — we will take reasonable steps to notify you. Depending on the nature of the change and how we hold your data, this may include:

• Placing a prominent notice on the Website homepage for at least 30 days after the update is published
• Sending an email notification to individuals who have previously contacted us or subscribed to our communications
• Requesting renewed consent where the change involves new purposes that require it

The "Last updated" date at the top of this page always reflects when the most recent version was published. We encourage you to review this page periodically. Your continued use of the Website after an updated Policy has been posted constitutes your acknowledgment of the changes for processing activities where consent is not the applicable legal basis.

We maintain an internal version history of this Policy. If you would like to review a previous version, please contact us and we will provide it on request.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to report a concern about how we have handled your personal information, please get in touch. We are committed to addressing privacy matters thoughtfully and without delay.