Documents
Privacy Policy
This policy covers the ghact.com website. The GH Potens application has a policy of its own, because the data there is different — your work, your account and your subscription.
This is a courtesy translation. The Portuguese version is the one that decides in case of any divergence.
Controller: GH Act Ltda, company number (CNPJ) 42.478.342/0001-61, Rua Campo Alegre, 284, Glória, Joinville/SC, Brazil, postcode 89216-280. To talk about your data: admin@ghact.com — the contact is Fábio Andrade, a partner, who answers for this in the company.
The essentials in four lines
- The site uses no cookies and has no analytics tool: while you are only reading, nothing about you is collected.
- If you write through a form, we keep what you typed so we can reply — and nothing beyond that.
- Nothing is sold, rented or handed to third parties, under any circumstances.
- You can ask us to delete everything, and we delete it.
What we collect, and only when you send it
The site’s two forms — contact and affiliate application — send our server:
| Data | Why |
|---|---|
| Name | so we know what to call you |
| so we can reply | |
| Phone or WhatsApp | optional, when you would rather be called |
| Your message | that is the subject |
| How you work today | affiliate form only, to prepare the right material |
| Language and the page you came from | to reply in your language and know where the contact came from |
Nothing is filled in automatically: only what you typed reaches us.
What we do not collect
We use no cookies, pixels, heat maps, session recording or analytics tools. We do not know which pages you visited, how long you stayed or where you came from. We do not buy lists, do not enrich your record with data from other sources, and do not cross-reference your contact details with social networks.
The server records, as any server does, the address and time of requests, for security and for finding faults. That log is built not to contain personal data — name, email and phone are kept out of it by design, and an automated check refuses publication if any of them appears there.
Where the data lives, and who processes it
What you send is kept in a database hosted in Brazil (São Paulo region), with a daily encrypted backup. Besides us, only the services that make the site work touch this data:
- Vercel — hosting for the site and the application (United States and Brazil).
- Supabase — the database, in the São Paulo region.
- Brevo — sending the notification email that someone wrote (European Union).
All of them process the data on our behalf and on our instructions, and do not use it for their own purposes. Where data crosses a border, it does so under the safeguards Brazilian data protection law (LGPD) provides for international transfers.
For how long
- Contact messages: up to 24 months after the last exchange, unless the conversation becomes a contract — then the legal retention period applies.
- Affiliate applications: up to 24 months, so we can resume the conversation when the programme opens a new round.
- Server technical log: 12 months, as required by Brazil’s Internet Civil Framework.
After that, we delete it. If you ask sooner, we delete it sooner.
Your rights
Brazilian data protection law (LGPD, Law 13.709/2018) grants you: confirmation that we process your data, access, correction, anonymisation, portability, deletion, and information about who we share it with. If you are in the European Union, the GDPR grants equivalent rights.
To exercise any of them, write to admin@ghact.com. We answer within 15 days. We do not ask for identity documents to find your record — it is found by the email address you used — and we charge nothing for this.
If our answer does not resolve it, you may complain to the ANPD (Brazil’s data protection authority) or, in the European Union, to your country’s supervisory authority.
Security
The site is always delivered over an encrypted connection. Database access is restricted, and backups are encrypted. Administrative access requires an authorised account, and the forms have a per-origin rate limit to contain automated abuse.
No system is impenetrable. If an incident occurs with relevant risk to you, we notify you and the ANPD, with what happened and what we did.
Children and teenagers
The site and the application are made for people running a business. They are not directed at anyone under 18, and we do not knowingly collect data from children or teenagers.
Changes to this policy
The version in force is always the one published here, with the update date at the end. A relevant change is announced on the page itself before it takes effect.
Version 1.0 · in force since 22 September 2026. GH Act Ltda · CNPJ 42.478.342/0001-61 · Rua Campo Alegre, 284, Glória, Joinville/SC, 89216-280, Brazil · admin@ghact.com