Privacy Policy

1. What data we collect

We only collect data strictly necessary to respond to your requests and improve your experience on the site:

• User-provided data: name, email, company, phone (optional) and message — when you fill out the contact form.
• Browsing data: pages visited, time on page, device, OS and browser language — collected via Google Analytics 4, subject to your consent.
• Necessary cookies: technical storage required for the site to work (theme and language preferences).
• Fraud prevention data: IP and browser fingerprint analyzed by Cloudflare Turnstile to identify and block automated traffic (bots).

2. Why we use your data

• To respond to your inquiry and propose suitable solutions.
• To send commercial communications only when you request them.
• To measure website performance and understand aggregate visitor behavior (anonymous statistics via Google Analytics 4).
• To protect the website against abuse, spam and automated attacks.
• To comply with legal, regulatory and contractual obligations.

3. Legal basis (LGPD / GDPR)

Processing of your data is based on the following legal grounds:

• Consent — for marketing communications and for analytics cookies where prior consent is required by law (EEA, United Kingdom and Switzerland).
• Legitimate interest — for audience measurement via Google Analytics 4 in Brazil (with the right to object) and for site security (anti-fraud/anti-bot).
• Performance of a contract or pre-contractual steps — when you contact us to discuss a project.

4. Who we share data with

T4Tech relies on strategic providers acting as data processors. Each one handles only the data strictly necessary for the specific purpose:

• Postmark (Wildbit, LLC) — transactional delivery of contact form messages. Receives name, email, phone, company, subject and message.
• Cloudflare, Inc. — CDN, DDoS protection, AI chatbot hosting (Workers AI) and anti-bot validation (Turnstile).
• Google LLC — Google Analytics 4 and Google Tag Manager, for anonymous website usage metrics.
• LinkedIn Corporation — only when you access our profile through the link in the footer.

5. Data retention

• Contact form data: stored for up to 24 months after the last contact, unless required to be kept longer by law.
• Google Analytics 4 data: up to 14 months for user-/event-level data; aggregated reports (non-identifying) may be retained longer.
• Technical cookies (language, theme): persist until you clear your browser.

6. Cookies

The website uses three categories of cookies:

• Necessary: essential for the site to function (language, dark/light theme). No consent required.
• Analytics: Google Analytics 4 (via GTM). In Brazil they run on the legitimate interest basis and you can disable them at any time; in the EEA, UK and Switzerland they only load after you accept on the banner. See the “Google Analytics 4” section below.
• Performance: Cloudflare (cache, anti-bot). Considered necessary for service security.

7. Google Analytics 4 (audience measurement)

We use Google Analytics 4 (GA4), from Google LLC, to understand in aggregate how the site is used and to keep improving it. This specific processing is detailed below.

• Data collected: pages visited, events, session duration, traffic source, device type, operating system, browser and approximate location (country/region/city). A first-party pseudonymous identifier distinguishes visits.
• What we do NOT collect: GA4 is configured without storing your IP address, without Google Signals, without demographic or interest data, and without cross-device identification. The data is not used for targeted advertising.
• Legal basis: legitimate interest (LGPD, art. 7, IX) for visitors in Brazil, with the right to object (opt-out) at any time. For visitors in the European Economic Area, the United Kingdom and Switzerland, the basis is prior consent (GDPR), and measurement only occurs after you accept on the banner.
• Consent Mode v2: we respect your choice by region. Where consent is required, nothing is measured until you accept; in other regions, you may object at any time.
• Retention: user- and event-level data is kept for 14 months and automatically deleted afterwards. Aggregated reports, which do not identify you, may be retained longer.
• International transfer: data may be processed by Google on servers outside Brazil, supported by contractual safeguards and the conditions of LGPD art. 33.
• How to opt out: click “Manage cookies” in the footer and choose “Necessary only”, or email [email protected].

8. Your rights

You may, at any time and free of charge:

• Confirm that T4Tech is processing your data.
• Access your data and request an electronic copy.
• Correct incomplete, inaccurate or outdated data.
• Request anonymization, blocking or deletion of unnecessary data.
• Withdraw consent and request data deletion, subject to legal obligations.
• Lodge a complaint with the ANPD (Brazilian Data Protection Authority) or your local data protection authority in the EU.

9. Security

We adopt enterprise-grade technical and organizational measures to protect your data, including: HTTPS/TLS communication, role-based access control, environment segregation (dev/qa/prod), audit logs, DDoS and automated-attack mitigation via Cloudflare and periodic security reviews.

10. Changes to this policy

This policy may be updated to reflect changes in our services or legal requirements. When a significant change is made, we will communicate it through the website. We recommend reviewing this document periodically.

How to contact T4Tech

To exercise your rights, clarify questions about this policy, or request the deletion of your data, contact us at [email protected]