Who is responsible for processing
Gabriel Brito, individual who operates under the professional brand Integração Financeira, determines the purposes and means of processing business contacts and requests received through this website. For these activities, he acts as the personal data controller.
Privacy inquiries are handled through the Privacy Channel, available without login and directed to the person responsible for the website. You can use this channel to request processing information, exercise rights and report a problem.
This policy covers the institutional website, forms, website management and technical portal access features. Clients' business and employment data have specific responsibilities, explained in the section Client portals.
Data used and its purposes
We process information provided by you, by the company authorizing your access and through interactions necessary for system operation.
| Situation and data | Purpose and legal basis |
|---|---|
| Project requestName, email, request profile (individual or company), company name where applicable, solution of interest and optional message. Date, request reference and record of the permission given. | Confirm receipt, respond to and follow up on the requested project with your specific consent (LGPD, Article 7(I)). This permission does not include newsletters or advertising unrelated to the request. |
| Privacy ChannelName, email, subject, context, message, reference number, dates, notice version and request status. | Receive, verify and address privacy rights and communications in compliance with LGPD obligations (Article 7(II)). Exercising rights does not depend on marketing consent. |
| Account and accessName, email, role, department, employee relationship, account status, hashed password and session records. | Identify users, apply permissions and provide authorized access. In the portals, the applicable basis is defined by the controller company according to its relationship with the user and its obligations. |
| Technical protectionTechnical connection data, attempt counters and identifiers derived from IP or email, depending on the operation. | Limit abuse, protect authentication and maintain availability. Legitimate interest in service security (Article 7(IX)), limited to what is necessary and balanced against the data subject's rights. |
Aggregated access counts: to monitor website reach, we record daily public page totals by traffic source and device category. This count stores no IP addresses, names, emails, visitor identifiers, full referrer URLs or link parameters, and creates no individual profiles. Reports are accessible only to the owner. Restricted areas and browsing with a portal session are excluded.
The public personal finance demo uses fictional values. Simulated transactions stay only in page memory, are not sent to the server and disappear on reload. Use examples only in this demo.
The project form is optional. Without contact permission, the request is not sent; you can still browse the website and use the Privacy Channel.
Public forms do not request CPF tax IDs, documents, passwords, banking details or sensitive data. Avoid including this information in the message field. Additional identity verification information should only be requested when necessary and through an appropriate channel.
If a request proceeds to contracting, data needed for the proposal and contract performance may be processed for that purpose at the data subject's request, under Article 7(V). Legal obligations and the regular exercise of rights may justify retaining specific records where actually applicable.
Data in client portals
In the DB Portal, the client company determines the use of employee information, authorized users and administrative purposes. It acts as the controller of these records. Integração Financeira provides the technology and, when processing data on the company's behalf, follows legitimate instructions and contracted conditions.
Records may include name, employee ID, role, department, salary, payroll period, remuneration, deductions, FGTS, payroll charges, budgets and financial entries. The system also keeps operation records with author, date and change history, depending on the feature.
Access is limited by role and company affiliation. Authorized users may export reports. Real portal data is not used in public portfolio demos.
For employment information or corrections to a company record, contact HR or the DB Portal administrator. The Privacy Channel also receives portal requests for review and referral to the appropriate responsible person. Legal bases and retention periods depend on the controller company's obligations.
Who has access and which providers are involved
Business contacts and Privacy Channel requests are viewed in management through the website owner account. Portal data is accessible to authorized company personnel within their assigned permissions.
The operation uses Sites by OpenAI, and infrastructure from Cloudflare for hosting, processing, storage and security. Hostinger manages domain and DNS records. Domain management does not mean that forms and financial records are stored at Hostinger.
When automatic request confirmation is enabled, the email service configured by the owner — Twilio SendGrid or Resend — receives the recipient's email, sender, request reference and thank-you text needed for delivery. This confirmation does not include name, company, project description or portal data. The website records the attempt status to track follow-up.
Technical providers may process data to the extent necessary for operation and support. Information may also be disclosed to comply with a legal obligation or valid order from a competent authority, subject to legal requirements.
The infrastructure uses internationally operating services. We do not assume processing occurs exclusively in Brazil. For each operation, the responsible person must verify the applicable location, provider roles and transfer mechanism permitted by the LGPD and ANPD regulations. Information about recipients and applicable safeguards can be requested through the Privacy Channel.
The website does not sell contact lists or use clients' financial records for advertising. External services have their own rules. Fonts and images in this version are served by the website itself.
How long data is retained
Retention must follow each activity's purpose and applicable obligations. Closing a contact, deactivating an account or marking a request as completed does not mean its records have been deleted.
- Project contacts: during handling and follow-up of the request. When the purpose ends or permission is withdrawn, retention needs must be assessed, keeping only records supported by another actually applicable legal justification.
- Privacy requests: during review and for the period needed to demonstrate handling and meet applicable obligations, with restricted access.
- Portal data: according to the instructions and legal, contractual and administrative periods defined by the controller company.
- Sessions: valid for up to 8 hours, with authorization ending after 30 minutes of inactivity; expired sessions are rejected and removed by authentication routines.
- Anti-abuse counters: have technical expiry periods and are cleared by control routines. They are not used to create advertising profiles.
- Public page view totals: the dashboard provides up to the latest 365 days. Older totals are removed when new views are recorded or the dashboard is queried. First and last record dates are retained to indicate collection coverage without identifying visitors.
- Cookie notice preference: remembered in this browser for up to 180 days, according to the Cookie Policy.
Deletion, anonymization or retention must consider the LGPD, especially Articles 15 and 16, and other applicable obligations. If a deletion request cannot be fully met, the data subject must be informed of the reason and which data must remain. Ending a login session does not automatically delete portal data.
How data is protected
The system uses HTTPS, email and password authentication, active-account checks, role-based permissions and separation of business contacts from financial records. Passwords are stored using cryptographic transformation, not readable text.
The session cookie has protections for secure transmission and restricted script access. Access operations and forms use input validation and controls against abusive attempts. These measures reduce risks but do not guarantee that incidents will never occur.
If you suspect data exposure, notify the responsible person through the Privacy Channel. Incidents must be assessed and, when required, reported to the ANPD and data subjects under applicable laws and regulations.
What are your rights?
Under the LGPD and subject to each situation's requirements, you may request:
- Confirmation of processing and access to your data.
- Correction of incomplete, inaccurate or outdated information.
- Anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data.
- Deletion of data processed with consent, subject to statutory retention exceptions.
- Portability, according to applicable regulations and commercial and industrial secrets.
- Information about sharing, the option not to consent and its consequences.
- Withdrawal of consent and objection to unlawful processing carried out without consent.
- Review of solely automated decisions affecting your interests, where applicable.
This version does not use solely automated decisions to determine credit, hiring or remuneration. Dashboards organize information for human analysis.
You may also submit a petition to the ANPD and seek other protections provided by law.
How to exercise a right or withdraw permission
Complete the Privacy Channel, providing a contact email, request type and a concise description. Submission is free, requires no login and generates a reference number when registered. Keep this number.
The responsible person reviews the request and replies to the email provided. Before providing data, changing records or carrying out deletions, they may verify your identity and any representation, proportionately to the information involved. Submitting the form alone does not prove ownership or authorize data disclosure.
For confirmation or access, the LGPD provides for an immediate simplified response or a complete statement within 15 days of the request. Other actions follow applicable deadlines and rules; when they cannot be taken immediately, reasons must be provided. Requests about data controlled by a client company will involve the appropriate responsible person.
To withdraw contact permission about a project, choose “Withdraw permission”. Withdrawal stops future processing based on that permission, without invalidating lawful prior processing or overriding legal retention obligations.
Cookies, minors and browsing
We use necessary access cookies, a cookie to remember your chosen language and a local record to remember that you have read the notice. This version implements no behavioral advertising tools or browsing analytics cookies. Aggregated page counts use no cookies or visitor identifiers and respect the browser's “Do Not Track” and “Global Privacy Control” signals. See names, purposes and retention periods in the Cookie Policy.
The institutional website presents business and personal finance projects for adults and does not offer public registration for children. Any minors' data needed in a client operation requires specific assessment and processing by the responsible company, observing their best interests and applicable rules.
Updates and references
This policy may be updated to reflect changes in features and processing practices. The version and date are available on this page. Material changes must be communicated appropriately; new consent-based purposes require specific authorization.
The main references are Law No. 13,709/2018 — LGPD and ANPD regulations. Questions about this document can be sent to the Privacy Channel.
Your data. Your rights.
Submit a request or ask a privacy question. The channel is free and does not require a portal account.
Open the Privacy Channel