Privacy Policy

1. Who the data controller is

The controller of your personal data is Yuri Chiba, a natural person, a freelance developer operating under the Chibo Dev brand, in São Paulo/SP, Brazil. There is no company behind the brand: the person who processes your data is me, and the responsibility is mine.

As a small-scale processing agent — a natural person, with no employees and low-risk processing — I do not appoint a formal Data Protection Officer, as permitted by ANPD Resolution CD/ANPD No. 2/2022. That does not take away your channel: requests, questions and complaints about personal data go to chibo.developer@gmail.com and are read and answered by me, with no intermediary.

2. Data we collect

Data you provide to us

We collect the data you voluntarily send us when filling in the contact form, writing to us by email or messaging us on WhatsApp. This generally includes:

• Name (required);
• WhatsApp number (required);
• Project type, chosen from a list (required);
• Email address (optional);
• A message about the project (optional).

If you write to me directly by email or on WhatsApp, I also receive whatever you choose to tell me in the conversation. I do not ask for your tax ID (CPF), address, payment details or sensitive data. The site has no sign-up, no login, no newsletter and no billing — there is nothing else to collect.

Data collected automatically

When you browse the site, some technical data may be collected automatically, such as IP address, browser and device type, pages visited and date/time of access. This data comes from the hosting service logs and, if you allow it, from traffic analytics tools. Cookies and similar technologies are covered in our Cookie Policy.

3. How we use your data

We use the data collected for specific and legitimate purposes:

• Replying to your message and answering questions;
• Preparing and sending proposals and quotes;
• Delivering and supporting the services you hire;
• Understanding how the site is used and improving your experience;
• Complying with legal and regulatory obligations.

4. Legal bases for processing

Each purpose has its own legal basis. Straight to the point:

• Replying to you, quoting and negotiating the project — data: name, WhatsApp, project type, email and message. Basis: preliminary procedures related to a contract, at the data subject's request (art. 7, V). You wrote to me to talk about a project; I reply on that basis.
• Delivering the service you hired and supporting it — data: the same, plus whatever delivery requires. Basis: performance of a contract (art. 7, V).
• Keeping the site online and secure — data: server access logs (IP, browser, date and time). Basis: legitimate interest (art. 7, IX), limited to what is necessary to operate and protect the site, without cross-referencing that data with you.
• Measuring the site's audience — in aggregate form. Basis: your consent (art. 7, I), given in the cookie notice and revocable at any time.
• Keeping documents from projects under contract — Basis: legal and tax obligation (art. 7, II) and the regular exercise of rights in legal proceedings (art. 7, VI).

5. Data sharing

Chibo Dev does not sell your personal data. Sharing only happens when necessary, with service providers that support the operation of the site, such as:

• Web3Forms (United States) — receives the content of the contact form and forwards it to my email. Every form submission goes through it.
• Google (Gmail) — where I receive and keep contact messages.
• Meta (WhatsApp) — when you talk to me on WhatsApp, the conversation happens on their platform.
• Hosting provider — hosts the site and keeps the server access logs.
• Audience measurement tool — I do not use one today. If I start to, I will say here which one it is before switching it on.

These providers process data only according to our instructions and to the extent necessary for the service. We may also share data with public authorities when required by law or court order.

6. Cookies and tracking

The site uses local storage in your browser (localStorage) in three categories: essential, which only keeps the record of your consent choice; measurement and functionality, which are empty today and would only be switched on with your permission.

On your first visit you can accept all, reject the non-essential ones or choose category by category, and you can revisit that decision at any time through the Cookie preferences link in the footer. Your choice lasts 12 months; after that, I ask again. The details are in our Cookie Policy.

7. Storage and security

I adopt reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration. Even so, no system is completely secure, and absolute security cannot be guaranteed when transmitting information over the internet.

I keep each piece of data only for as long as the purpose justifies:

• Contact messages that did not become a project — up to 12 months after the last contact. After that, I delete them.
• Client data and project communications — 5 years counted from the end of the contract, the period in which the service delivered can still be disputed (art. 206, §5, I of the Brazilian Civil Code).
• Server access logs — the hosting provider's retention period.
• The record of your cookie consent — 12 months; after that the notice asks again.

Once the period expires or the purpose is fulfilled, the data is deleted (arts. 15 and 16 of the LGPD). The exception is whatever the law requires me to keep, or whatever I need in order to defend a right in legal proceedings — and in that case the data is blocked from any other use.

8. International data transfers

Some of the services we use — such as hosting, form delivery and traffic analytics — are operated by companies based outside Brazil, mainly in the United States. Chibo Dev also serves clients in Brazil and abroad. Because of that, your data may be processed or stored outside the country.

These transfers rely on the following grounds under art. 33 of the LGPD:

• art. 33, IX, "b" — transfer necessary for preliminary procedures of a contract, at your request. That is the case with the form and with WhatsApp: you reach out to talk about a project, and the message has to get to me.
• art. 33, II — providers that offer guarantees of compliance with the LGPD through contractual clauses, along the lines of the ANPD standard clauses (Resolution CD/ANPD No. 19/2024).
• art. 33, VIII — specific and highlighted consent, in the case of audience measurement: it only switches on if you allow it, and this is the prior notice.

If you would rather not use the form, you can write to me directly — but for the record, to be honest about it: email and WhatsApp also run on servers outside the country.

9. Your rights as a data subject

The LGPD grants you, as the data subject, a set of rights. At any time you may request:

• Confirmation that I process your data (item I);
• Access to the data (item II);
• Correction of incomplete, inaccurate or outdated data (item III);
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law (item IV);
• Portability to another provider, upon express request (item V);
• Deletion of data processed on the basis of your consent, except in the retention cases of art. 16 (item VI);
• Information about who I have shared your data with (item VII);
• Information about the possibility of withholding consent and about what happens if you refuse (item VIII). In practice: name, WhatsApp and project type are needed for me to be able to reply — without them, I cannot; measurement and functionality cookies, on the other hand, are optional, and refusing them changes nothing in how you use the site;
• Withdrawal of consent, at any time (item IX);
• Objection to processing carried out without consent, when you believe it breaches the LGPD (art. 18, §2).

You may also complain directly to the Brazilian Data Protection Authority (ANPD) if you feel I have not resolved the matter (art. 18, §1).

Withdrawing consent is possible at any time, free of charge and with no justification, through the Cookie preferences link in the footer (art. 8, §5). Withdrawal applies from that moment forward: it does not make unlawful the processing carried out while consent was in force.

10. How to exercise your rights

To exercise any of these rights, write to me at chibo.developer@gmail.com. I may ask for information to confirm it is really you — that is the only reason I would ever ask you for extra data.

The deadlines are the ones set by law: confirmation that I process your data and access to it are provided in simplified form immediately, or in a clear and complete statement within 15 days of the request (art. 19, I and II). The rest I answer as soon as I can, and I always answer: if I cannot comply, I say why and on what legal basis.

There is no charge. I do not charge anything for you to exercise a right of yours.

11. Changes to this Policy

This Privacy Policy may be updated at any time to reflect changes in legislation, technology or in how we process data. The version in force is always the one published on this page, with the last-updated date shown at the top. Significant changes may be announced through our channels.