Privacy
Policy

SYNEX is a digital agency that creates, hosts and manages professional websites for small and medium businesses on the Wix platform. For the purposes of this Policy, we are the Controller of the personal data collected through the website synexstudio.com.br and our official channels.

2.1 Data you provide directly

When you fill out a form on our site (preview request, builder briefing or contact), we collect:

• Name (so we can refer to you)
• E-mail (for proposals and formal communication)
• WhatsApp number with country code (for service)
• Type of business (commerce, services, restaurant, etc.)
• Briefing information when applicable (design preferences, desired content, references)

2.2 Data collected automatically

When you browse our site, we automatically collect:

• IP address — used only for approximate city-level geolocation shown in the welcome banner (we do not store your IP)
• Browser, OS and device type (for compatibility)
• Pages visited, time spent and clicks (via Google Analytics 4)
• Traffic source (URL that brought you here)
• Language preference (stored locally in your browser)

2.3 Data we do NOT collect

We never request or store financial information (credit card, bank account), identity documents or sensitive data such as health, sexual orientation or political opinions. Payments, when applicable, are processed by external intermediaries whose own policies apply.

The data collected is used exclusively for:

• Responding to preview, quote or contact requests
• Delivering the free site preview via WhatsApp or e-mail
• Conducting commercial negotiations and preparing custom proposals
• Providing the contracted service (creation, maintenance and updates of your website)
• Communicating relevant updates about your plan
• Personalizing your site experience (language, geolocated banner)
• Analyzing site performance and improving user experience (aggregated, via Google Analytics)
• Managing the commercial relationship and contact history inside our CRM tools (Wix CRM)
• Complying with legal, tax and regulatory obligations

We do not sell your data. We do not send mass newsletters or marketing without your prior consent.

We process your personal data based on the lawful grounds in Art. 7 of the LGPD:

Legal basis	When we apply it
Consent (Art. 7, I)	When you fill out a form on the site or message us on WhatsApp.
Performance of a contract (Art. 7, V)	After contracting any plan, to provide the agreed service.
Legitimate interest (Art. 7, IX)	Statistical analysis of navigation, fraud prevention and site improvement.
Legal obligation (Art. 7, II)	Keeping invoices and accounting records required by law.

To operate our service we share strictly necessary data with sub-processors (operators). All of them have their own privacy policies adequate to the LGPD or the European GDPR:

Operator	What for	Location
Wix.com Ltd.	Core platform of our operation: hosting and editor for the websites we build for clients, lead management, CRM, contact history and operational tools used by SYNEX.	Israel / United States
Supabase Inc.	Initial database that receives the forms submitted on synexstudio.com.br before the data flows into our Wix-based CRM.	United States (AWS)
Cloudflare, Inc.	Hosting and content delivery network (CDN) for the synexstudio.com.br site.	Global
Google LLC	Google Analytics 4 (usage statistics) and Google Fonts.	United States
Meta Platforms, Inc.	Meta Pixel (campaign measurement) and WhatsApp Business (direct communication).	United States

Any additional sharing — such as with public authorities under judicial or administrative orders — will be done strictly within legal limits.

Because several of our sub-processors process data on servers outside Brazil — mainly in the United States and Israel (Wix) — your personal data is transferred internationally.

These transfers are made under standard contractual clauses with these providers and/or based on the consent you provide when submitting your data, always observing Art. 33 of the LGPD and ensuring a level of protection equivalent to the Brazilian standard.

Data type	Retention period
Leads that did not become clients	Up to 24 months from the last contact
Active client data	Throughout the contract + 5 years (legal/tax requirement)
Quote briefings without conversion	Up to 12 months
Anonymous navigation data (Google Analytics)	14 months (GA4 default)
Invoices and accounting records	As required by tax law (minimum 5 years)

You may request early deletion of your data at any time (see section 9), except where retention is required by law.

Article 18 of the LGPD grants you, as the data subject, the following rights:

• Confirmation of the existence of processing of your data
• Access to your personal data we hold
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary, excessive or non-compliant data
• Portability of your data to another service provider, upon express request
• Deletion of personal data processed with consent
• Information about public and private entities with which we share your data
• Information about the option to withhold consent and the consequences
• Withdrawal of consent at any time

To exercise any of the rights above — or to clarify any question about how we handle your data — contact us through the channels below. We respond within 15 business days.

Please include in your request: your full name, the e-mail you used in previous contact and the specific right you want to exercise. We may ask for additional identity verification for your security.

We adopt reasonable technical and administrative measures to protect your data from unauthorized access, alteration, disclosure or destruction:

• HTTPS/TLS on all pages of the site
• Row-Level Security (RLS) on the Supabase database that initially receives form data, restricting access by authentication
• Security and access controls of the Wix platform for ongoing CRM, lead management and client site operations
• Admin panel protected by JWT authentication, with tokens stored only in session (not persistent)
• Principle of least privilege: our team accesses only what is strictly needed to provide the service
• Regular backups with encryption at rest

Despite all care, no internet transmission is 100% secure. In case of a security incident that compromises your data, we will notify you and the ANPD (Brazilian Data Protection Authority) as required by the LGPD.

We use three categories of cookies and similar technologies:

Category	Function	Can disable?
Essential	Remembering language preference (localStorage)	Yes, in your browser settings
Analytics	Google Analytics 4 — understanding how the site is used	Yes, via blocker or Google opt-out
Marketing	Meta Pixel — measuring campaigns and remarketing	Yes, via your Meta settings or blocker

You can block cookies at any time in your browser settings or use privacy extensions. Disabling them may impair some functionality but does not prevent navigation.

Our site and services are intended for users 18 years of age or older. We do not intentionally collect data from minors. If you are the legal guardian of a minor whose data has been submitted to us, please contact us immediately so we can delete that information.

This Policy may be revised to reflect changes in our services, applicable legislation or recommendations from the ANPD. The current version is always available at this URL and the update date appears at the top of this document. Material changes will be communicated via banner on the site or e-mail to active clients.

For any question or request related to the processing of your personal data, the official channel is: