Transparency about how your data is handled.

Who processes your data

NOVIDARO MENTORIA E CONSULTORIA LTDA, CNPJ 67.020.452/0001-06, with registered office in Barueri, São Paulo, Brazil. For any matter concerning personal data, the channel is [email protected]. Under the Brazilian General Personal Data Protection Law (Lei Geral de Proteção de Dados Pessoais, Law 13,709/2018, the LGPD), NOVIDARO is the controller of the data described here.

That address is the channel for communication with the data subject provided for in article 41, § 2, I, of the LGPD. It is how you reach NOVIDARO about any personal data matter, including exercising the rights listed below. We respond within the period set by law.

What this document covers

Two different situations, and the distinction matters because the data involved is of a very different nature.

Part 1, you visit the website or reach NOVIDARO on Instagram. You fill in the contact form, simply browse, or comment on or message the @novidaro profile. This is what the previous version of this document already described.

Part 2, you are a mentee. You have signed up for a cycle and the sessions are taking place. This is where session recording, transcription, the use of artificial intelligence tools in preparing your report, the messaging channel between sessions, and payment come in. None of this happens before you sign up, and none of it happens without your knowledge and, where the law requires it, without your written authorization.

If you are deciding whether to sign up, Part 2 is written to be read now, beforehand, and not after you sign.

Part 1 · When you visit the website or reach NOVIDARO on Instagram

What data this website collects

What you type into the form on the contact page: name, email, your career stage, chosen from a closed list, and, if you want, a message. Only name, email, and career stage are required.

Your IP address. It is recorded automatically on every visit, not only when you submit the form. It is recorded by Cloudflare, which delivers this website's content, together with the page you opened and the time; the platform hosting the website also records it at the moment the form is submitted. These records are visible to NOVIDARO in the Cloudflare dashboard. We do not ask for this data, we do not use it to identify you commercially and we do not combine it with any other database; it exists as a technical record and as support for abuse prevention.

Technical verification signals. The contact page uses Cloudflare Turnstile to tell people from robots. It analyzes browser characteristics and interaction signals while the form is being filled in.

In this form we neither ask for nor want sensitive data: nothing about health, political opinion, religious belief, sex life, trade union membership, or racial origin. The career stage field is a closed list precisely so it doesn't invite that. If you write something of that nature in the open field, it will be treated with the same confidentiality as the rest, but that's not what the field is for.

This website has no login area and receives no payments. Payment, when there is an engagement, takes place outside the website and is described in Part 2.

What we use it for

What we do not do. We do not use your data for advertising. We do not build behavioral profiles for commercial purposes. We do not make automated decisions about you. We do not sell, rent or transfer your data to third parties.

The analysis performed by Cloudflare Turnstile serves only to separate people from robots. It is not used to identify, classify or profile you, and its result does not influence our reply to your inquiry.

On what legal basis

To reply to your inquiry and carry on the discussion that may lead to a contract: the carrying out of preliminary procedures related to a contract, at the request of the data subject (article 7, V, of the LGPD). The message field is filled in on your own initiative.

For the IP record, the technical cookie and the anti-robot verification: legitimate interest in the security of the service and in preventing fraud and abuse (article 7, IX, of the LGPD), limited to what is strictly necessary for that purpose.

For website audience measurement: legitimate interest in knowing, in aggregate, which pages are visited and where visits come from, so we can improve the website (article 7, IX, of the LGPD), limited to data that does not identify you.

To reply to comments and messages on Instagram and carry on the conversation that may lead to a contract: the carrying out of preliminary procedures related to a contract, at the request of the data subject (article 7, V, of the LGPD). To moderate public comments on the profile: legitimate interest (article 7, IX, of the LGPD).

Who else has access to website data

The suppliers below act as processors:

Webflow, Inc. (United States), which hosts this website, receives form submissions and stores them.

Cloudflare, Inc. (United States), which delivers the website's content, runs the anti-robot verification on the contact page and measures the website's audience.

Google LLC (Google Workspace), where NOVIDARO's mailbox receives the submission notification and where the email conversation takes place.

Google LLC (United States), which operates Google Analytics, receiving browsing data to provide aggregate statistics on audience measurement and website behavior.

CookieYes Limited (United Kingdom), which runs the website's cookie notice and keeps the record of your choice: consent identifier, date and time, country, categories accepted or refused, and masked IP address. According to the provider's list of subprocessors, this record is stored in Ireland.

Those suppliers in turn use their own infrastructure providers, such as cloud services and content delivery networks. Webflow's list of subprocessors is public and can be consulted at webflow.com/legal/subprocessors.

No other third party receives data collected on this website.

Cookies and similar technologies

This website uses technical and analytical cookies, managed by a Consent Management Platform (CookieYes) that allows you to choose your preferences as soon as you enter the site. Strictly necessary cookies include _cfuvid, operated by Cloudflare to tell apart visitors under the same IP and protect against abuse, and CookieYes's own technical cookie, which solely safely remembers whether you accepted or rejected tracking.

Audience measurement and Analytics. The site maintains the use of Cloudflare Web Analytics, which measures basic technical data without setting cookies in your browser. Additionally, if and only if you give your prior consent in the initial banner, we use Google Analytics 4 (from Google LLC) to understand interaction with the site. This tool sets analytical cookies (such as _ga) in the browser to measure, in aggregate, the pages visited and the source of the visits. We do not use advertising cookies, and the option to share data with other Google products is disabled. The typefaces continue to be served by the website's own hosting.

Local storage. Cloudflare Turnstile writes a technical record to your browser's local storage, exclusively so that the anti-robot verification works. It does not identify you and is not used for any other purpose.

Control and consent. The use of technical cookies (Cloudflare and CookieYes) and local storage (Turnstile) does not depend on consent, as they are strictly necessary for the site to function securely, being supported by legitimate interest. Conversely, Google Analytics cookies depend exclusively on your prior authorization and are only activated if you click "Accept" in the privacy notice. You can withdraw or change this choice at any time through the "Cookie preferences" link in the footer of every page of the website. Withdrawal stops collection from that moment on.

When you reach NOVIDARO on Instagram

NOVIDARO runs the @novidaro profile on Instagram, a platform of Meta Platforms, Inc. If you comment, send a direct message or mention the profile, NOVIDARO receives your username, the public name and photo on your account, and what you wrote.

We use this to reply and, if you wish, to move the conversation to WhatsApp or email. You don't need to share details of your situation in an Instagram message, and comments are public: please avoid writing anything personal in them.

Instagram also shows NOVIDARO aggregate statistics about the profile's audience, such as age ranges and cities, which don't identify anyone.

Meta processes your account data under its own privacy policy, as an independent controller. That processing is not decided by NOVIDARO.

We don't use automated replies or any third-party tool connected to the profile. Instagram is not a mentoring channel: once you sign up, communication happens over WhatsApp and email.

Part 2 · When you are a mentee

This part describes what happens after you sign up. Each point here corresponds to a clause of the contract you sign, and the contract is the binding instrument. Where this policy and the contract differ, the provision more favorable to you prevails, and the discrepancy is our error, which we ask you to point out.

What data the mentoring processes

Registration and contact data: name, CPF (Brazilian taxpayer number), email, phone and address, to perform the contract and issue the service invoice (Nota Fiscal de Serviços).

The content of the sessions and the records of your development: what you bring, what is decided, your commitments, your path. It is the material of the service itself.

The session audio and its transcription, if and only if you authorize it. Dedicated section below.

The messages in the channel between sessions. Dedicated section below.

Payment data and, only when there is a refund by Pix, your bank details.

Professional practice records required for the mentor's accreditation, in which you are identified by initials, never by name.

Session recording and transcription

No session is recorded without your prior, specific, informed and written consent. Refusing does not prevent or impair the service in any way. Consent can be withdrawn at any time, and you can also ask that a specific session not be recorded, without giving a reason and without any loss.

Who records and transcribes, and where it is kept. The tool used is PLAUD, operated by Nicebuild LLC, a company based in the United States of America. We read this supplier's privacy policy and terms of use on September 15, 2026, and it is fair that you know exactly what they say:

What we do about it. The United States has no adequacy decision from the Brazilian National Data Protection Authority. For that reason, the transfer of your audio and your transcription depends on your specific and highlighted consent, given with prior information about the international nature of the operation, under article 33, VIII, of the LGPD. This consent is collected in a field separate from the recording consent, in Annex II of the contract. If you refuse, the mentoring takes place without recording and without transcription, and nothing else changes.

And, because the supplier's silence on training is not the same as a prohibition, we compensate with a deadline. The audio is deleted from the tool within 30 days of the delivery of that session's report, and the deletion is logged with its date in an internal record, so that compliance can be verified and does not depend on our word. If you ask, we will tell you in writing the date on which the deletion took place.

Artificial intelligence and your report

On the recorded material, we use transcription and artificial intelligence tools to organize notes and prepare your report. Three things need to be clear, and none of them is a detail:

First: the report is not produced by a machine. The mentor's observations, notes and professional judgments that make up the report are written directly by him.

Second: every word is reviewed before it reaches you. All material produced with the help of these tools is reviewed and signed by the mentor before it is sent, and responsibility for the content delivered lies entirely with him, including for any error that originates in the tool.

Third: you can refuse. Without recording, the report is prepared from the mentor's handwritten notes, and the service remains the same.

The messaging channel between sessions

The channel is WhatsApp Business, indicated in Annex I of your contract, and it is used for logistics and for following up on what was already agreed in session. It operates with end-to-end encryption, with backups protected by a key known only to the mentor, and without use of the platform's artificial intelligence features in the conversations with you.

Relevant content exchanged there is transferred to the mentoring records. At the end of the cycle, the mentor deletes the conversation on his side. The copy on your device is yours and outside our control, which we state plainly instead of promising what we cannot deliver.

Payment

Payments are received by Pix and credit card, into an account held by NOVIDARO at Itaú Unibanco S.A., in Brazil. There is no international transfer of this data. Card payments are made through a payment link from Rede, the Itaú group's card acquirer: card details are entered on Rede's page and never reach NOVIDARO.

When there is a refund by Pix, we need your bank details, which are collected solely to make that transfer and deleted within 30 days after it is made, keeping only the receipt, for the periods required by tax law.

Confidentiality, and the three cases in which it yields

Everything you share in the mentoring is covered by strict confidentiality, for an indefinite period, including after the cycle ends. Confidentiality covers all the material, from the audio to the report, and the messages in the channel.

There are three exceptions, they are in the contract and you acknowledge them when you sign: a legal obligation or an order from a competent authority; illegal activity; and a concrete risk of harm to you or to others. In those cases, whenever possible and lawful, we will notify you before any disclosure.

Use of situations from your mentoring in anonymized form, in NOVIDARO's case library, depends on your specific, revocable consent, and without it, it does not happen. Testimonials and mention of your name as a client are not covered by the contract and, if they are ever requested, it will be under a separate agreement, after the cycle, with text approved by you beforehand and with the right to withdraw at any time.

Common to both parts

International data transfers

This section complies with article 33 and following of the LGPD and with the International Data Transfer Regulation approved by ANPD Board Resolution 19/2024.

Who answers for this transfer. NOVIDARO MENTORIA E CONSULTORIA LTDA, CNPJ 67.020.452/0001-06, with registered office in Barueri, São Paulo, Brazil, is the designated party for the purposes of these transfers. Responsibility for publishing this section, for answering your requests and for reporting security incidents lies with NOVIDARO, not with the suppliers. The channel is [email protected].

Transfer table:

About the United States, frankly: it does not have an adequacy decision from the ANPD, verified at the official source on September 15, 2026. That is why each transfer there needs its own legal basis, and that is why the most sensitive of all, that of your session audio, depends on your consent and not on our convenience.

Shared use. The data is shared with the suppliers above exclusively for the purposes of this policy. None of them may use it for their own purposes. There is no sharing with any other third party, free of charge or paid.

Onward transfers. The suppliers above may use their own infrastructure providers, also located abroad, exclusively to make the services described here possible.

Rights and channel. You can exercise all the rights listed below by writing to [email protected], and you can petition against NOVIDARO before the Brazilian National Data Protection Authority (ANPD). On request through the same email, we make available free of charge, within 15 days, the full text of the contractual clauses relating to the international transfers, subject to commercial and industrial secrecy.

Security and responsibilities

NOVIDARO is the controller and decides the purposes and the means of processing. The suppliers listed act as processors, processing the data only in accordance with our instructions and the contractual obligations they have undertaken.

On our side, access to the data is restricted to the owner of the company. The mailbox that receives the submissions has two-step authentication. There is no credential sharing and no third-party access to the database.

On the suppliers' side, the website is served exclusively over an encrypted connection (HTTPS). Webflow states that it maintains SOC 2 Type II certification, infrastructure in ISO 27001 certified data centers, encryption of data at rest, access control with two-factor authentication, periodic penetration testing and staff training in security and privacy. Google describes the measures applicable to Workspace in the Cloud Data Processing Addendum. Nicebuild states that it uses encryption at rest, data isolation and retention of audit logs for at least twelve months.

No system is immune to risk. We aim to maintain the best practices available and, if something relevant happens, you will be informed as transparently as possible.

Security incidents

If a security incident occurs that may bring relevant risk or harm to you, we will report it to you and to the ANPD within the periods set out in ANPD Board Resolution 15/2024, stating the nature of the data affected, the risks involved and the measures adopted.

How long we keep it

You can ask for deletion before these periods, at any time, except where a legal obligation applies.

Minors

This website and NOVIDARO's services are intended for professionals over 18 years of age. We do not intentionally collect data from children or adolescents. If we identify that we have received data in that condition, we will delete it.

Your rights

Article 18 of the LGPD guarantees you, in relation to your data: confirmation that processing exists; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about who we share it with; information about the possibility of not consenting and what follows from that; and withdrawal of consent.

You may also object to processing carried out on a legal basis other than consent, where you consider that the law is not being complied with.

How to exercise them

Write to [email protected]. We respond within the period set by law. If you consider that the processing is not adequate, you may also contact the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.

Changes to this policy

If this policy changes, the date at the top changes with it. Earlier versions can be requested through the same email.

NOVIDARO MENTORIA E CONSULTORIA LTDA. CNPJ 67.020.452/0001-06.