Privacy policy

This policy states what samambai.com collects, why, who processes it with the studio, how long it is kept, and how to ask for access, correction, or deletion. It is effective from 3 October 2026.

It covers the site and the conversation that starts there. Data from a client project stays in the client's accounts and follows that project's contract. It is not covered here.

Who the controller is

The controller is samambai, the trade name of 19.958.088 DAVID CREIMER REICHHARDT, CNPJ 19.958.088/0001-87, in São Paulo, Brazil.

Privacy requests, and anything else in this policy, go to contato@samambai.com. No other channel is published. No street address is published. The same company facts are on about samambai.

Where the processing is related to offering the studio's services to people in the European Union, the General Data Protection Regulation, Regulation (EU) 2016/679, applies Source [1]. The Brazilian statute, Lei nº 13.709 of 14 August 2018 (LGPD), applies to processing the statute covers, including processing in Brazil Source [2]. The practical rules below are the same under both: the same data, the same processors, the same retention, the same email.

What the form collects

The contact form asks for the following, and the site records it with the visit that produced the submission:

• name
• email
• phone or WhatsApp
• the message
• how you heard about samambai
• the landing page of this visit
• the referring site
• utm parameters on the visit, when the URL has them (utm_source, utm_medium, utm_campaign, utm_content, utm_term, or any other utm parameter present)
• ad click identifiers (fbclid, gclid), when the URL has them, and the time of the first page viewed

The form does not ask for an identity document, a card number, health data, or a child's data. If a message includes that kind of information because the sender chose to write it, it is kept only for the period in this policy and only so we can reply. We do not open a separate record for it.

Why we use it

There is one purpose: to reply and to send a proposal.

Name, email, phone, and message tell us who asked and what to answer. Landing page, referring site, utm parameters, and "how you heard about samambai" let the reply match the page you read, and let the studio see which public page produced the request. We do not sell this data. We do not use the form to build an advertising profile. We do not use data received here to train public models.

If the conversation continues by email, that thread becomes part of the same record. The purpose does not change.

Legal bases

Under the GDPR, the form rests on two bases in Article 6(1) Source [1].

Article 6(1)(b) is the first. Processing is necessary to take steps you asked for before a contract exists. You asked for a reply and a proposal. Name, email, phone, and message are what make that request possible. The phone is required because that is usually where the conversation continues.

Article 6(1)(f) is the second: legitimate interests of the controller, unless your interests or fundamental rights override those interests, in particular where the person is a child. It covers the landing page, the referring site, the utm parameters, and how you heard about the studio. Those fields are not strictly required to send an email back. They are required for the reply to match the page you came from, and for us to know which page generated the conversation. The interest is answering in context. It is not a bought mailing list. The site is not directed at children.

Under the LGPD, the matching bases are Article 7, V (preliminary steps related to a contract, at the request of the person) and Article 7, IX (legitimate interest). Article 10 limits that interest to data that is strictly necessary and requires transparency Source [2]. This section is that transparency. You can object, as described under "Your rights."

We do not use consent as the basis for the form. There is no "I accept the policy" checkbox standing in for these two bases. The policy is published so you can read it before you send the form.

Who processes data with the studio

Four processors, each with one job:

They process data on samambai's behalf, for those jobs. We do not authorize any other use. There is no ad tool and no social pixel on this list, because the site does not use those products. The CRM is samambai's own and is used only to answer and follow up on the request.

Visit measurement

Visits are measured on the server. The measurement does not use a cookie and does not store the IP address. What is kept is:

• the date and time of the visit
• the page and the response code
• the country
• the referring site
• the utm parameters in the URL, when present
• the browser type, or the bot type

The purpose is to see which pages are visited. The basis is legitimate interest under GDPR Article 6(1)(f) and, where the LGPD applies, Article 7, IX Source [1] Source [2]. The record is not tied to a name. If it can still be linked to a person, the rights below apply to it.

Cookies

The site does not use a tracking cookie. The visit measurement above does not set a cookie.

That is not a promise that an infrastructure provider never sets a strictly technical security cookie at the network edge. It is the studio's rule: we do not set a cookie to follow a person across sites, we do not set an advertising cookie, and we do not measure the visit with a cookie.

International transfers

The processors above may process data on servers outside Brazil. The international transfer rests on contractual safeguards with those processors. This page does not list each server's country and does not describe each contract. What is fixed is the contractual safeguard, the short list of processors, and the purpose of each one.

How long we keep it

Form data, and the conversation that follows, is kept while a commercial relationship exists and for up to 2 years after the last contact. The last contact is the last message from you or from us in that thread. After that period we delete it or anonymize it, unless the law requires or allows a record to be kept longer Source [1] Source [2].

The visit record, which has no name and no IP address, is not kept as a file on a person. It is not kept beyond 2 years either.

If you ask for deletion sooner, we apply the request to the extent the right you are using allows. Data the law tells us to keep does not leave only because the request arrived.

Your rights

Under the GDPR you can ask for the following Source [1]:

• access to the data and to the information listed in Article 15, including the purpose, the categories, the recipients, the retention period or the criteria for it, and the existence of the other rights
• rectification of inaccurate data, under Article 16
• erasure, under Article 17, where one of that article's grounds applies
• restriction of processing, under Article 18, in the cases that article lists
• portability, under Article 20, of the data you provided, where the basis is Article 6(1)(b) and the processing is automated, in a structured, commonly used, machine-readable format
• objection, under Article 21, to processing based on legitimate interest, on grounds related to your situation

Article 15 also records the right to lodge a complaint with a supervisory authority. Article 12 requires a reply without undue delay and in any event within one month. That period may be extended by two further months where the request is complex or numerous. If we extend it, we tell you within the first month and give the reason Source [1].

Under the LGPD, Article 18 gives you the right to obtain, at any time and on request, confirmation that processing exists, access, correction of incomplete or outdated data, anonymization or deletion of data that is unnecessary or unlawful, portability under the national authority's rules, deletion of data processed on the basis of consent where that was the basis, information about who data was shared with, and withdrawal of consent where consent was the basis Source [2]. Article 18, paragraph 1, also lets you petition the national authority. Paragraph 2 lets you object to processing that does not rely on consent where the law is not being followed. Paragraph 5 says the request is handled at no cost to you. Article 19 distinguishes an immediate simple confirmation from a complete statement, which is due within 15 days Source [2].

In practice both regimes go to the same place. Email contato@samambai.com and say what you want: to know whether we process your data, to receive a copy, to correct it, to delete it, to restrict it, to take it to another provider, or to object to the use of the origin fields. We will ask for the minimum needed to confirm the request comes from the person the data is about. We do not charge for the request.

An objection to legitimate interest does not, by itself, delete the name and the message you sent so we could write a proposal. It stops or limits the use of the landing page, the referring site, and the utm parameters, unless a sufficient legal basis remains for that field. If the conversation has already become a contract, retention follows the contract and the law, not this page alone.

What this policy does not cover

Price, sprint length, and project scope are on pricing. They do not change this policy. Production data (a CRM, WhatsApp, a client's database) stays in the client's accounts, with the minimum access agreed for that work. That is not a processor of this page.

Updates

This version is effective from 3 October 2026. The date at the top of the page is the date of the current version. If the policy changes, the date changes and the text at this URL becomes the new version. We do not keep a public archive of older versions.