Courtesy translation. This is an English translation of the Portuguese original, provided for convenience. The Portuguese version is the only binding one: if the two differ, the Portuguese text prevails. Read the original in Portuguese.
Version 1.0 · Last updated: October 7, 2026 · Translation of version 1.0 of the Portuguese text
This policy explains which personal data AUNAVO processes when you visit aunavo.com, subscribe to follow the company as it is built, or use the ISO 9001 Readiness Diagnostic, why it processes them, and what your rights are. It follows Brazil's General Data Protection Law (Lei nº 13.709/2018, the LGPD).
1. Who is responsible
AUNAVO INOVA SIMPLES (I.S.), registered in Brazil under CNPJ 69.464.666/0001-05, with its registered office at Rua Almirante Teotônio Carvalho, 1050, complemento 635, Tirol, Natal/RN, CEP 59015-100, Brazil, is the data controller. In this policy, “AUNAVO”.
To talk about privacy, write to privacidade@aunavo.com. This channel is answered by our Data Protection Officer.
2. Which data we process
When you only visit the site: our hosting provider technically logs the request, including the IP address, to deliver the page and protect the site against attacks.
When you subscribe:
- your email;
- the version of this policy and of the text you consented to;
- the dates on which you subscribed, confirmed and, if applicable, cancelled;
- an irreversible code derived from your IP address (a salted hash). We do not keep the IP itself. It is used to contain abuse of the form;
- your browser and device type.
When you use the ISO 9001 Readiness Diagnostic, at app.aunavo.com, which requires no sign-up:
- the answers you give, the time spent on each question and whether you finished;
- the address through which you reached the tool, such as the link in a post.
This record starts when you begin the diagnostic and is kept even if you do not finish it. It carries neither your name, nor your email, nor your IP address.
If you ask for the result by email, we also keep your email and, if you provide it, your name. From then on, the answers of that diagnostic are linked to you. We also keep the date of the request, the version of the text you agreed to and, if you tick that option, that you accept being contacted for a conversation.
We do not use advertising cookies, audience analytics tools or tracking pixels. The messages we send do not track whether you opened them.
3. What we use it for, and on what legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Sending the subscription confirmation email and, after it, content, tools and invitations | Consent (I) |
| Keeping proof that you consented, and that you cancelled | Compliance with a legal obligation (II): art. 8, §2 places on the controller the burden of proving consent |
| Limiting abuse of the form and protecting the site | Legitimate interest (IX) |
| Calculating and showing the diagnostic result and, by adding up the answers of many companies, understanding where organizations struggle most | Legitimate interest (IX) |
| Sending the diagnostic result to your email and, if you ask, contacting you for a conversation | Consent (I) |
When you subscribe, we only send anything after you click the link in the confirmation email. Without the click, nothing is sent, and the unconfirmed address is deleted in 30 days.
In the diagnostic, we only write to you with the result you asked for and, if you ticked that option, to arrange the conversation.
We may publish statistics made from diagnostic answers. We never publish the individual result of a company.
4. Who we share it with
We do not sell or hand over your data. We use providers that process data on our behalf, under contract:
- Cloudflare: hosting, security and anti-bot verification (Turnstile);
- Supabase: database, on a server in Brazil (São Paulo). The diagnostic database is separate from the subscriber list database;
- Resend: email delivery, on a server in Brazil (São Paulo).
Cloudflare operates infrastructure in several countries. When this involves an international transfer of data, it takes place with the safeguards required by the LGPD and by the regulations of the ANPD, Brazil's National Data Protection Authority.
We may also disclose data by order of a competent authority.
5. How long we keep it
- unconfirmed subscription: 30 days;
- confirmed subscription: for as long as you remain subscribed. We review the list once a year;
- after cancellation: we keep only the email and the cancellation date, on a suppression list, so as not to write to you again. If you would rather have this deleted too, ask at privacidade@aunavo.com. In that case, you may receive messages again if you subscribe again;
- diagnostic answers without identification: 5 years. After that, only the aggregated numbers remain;
- diagnostic answers linked to your email: 12 months. After that we delete your name and your email, and the answers are kept like the others, without identification.
6. Your rights
You may, at any time and free of charge: confirm that we process your data; access them; correct them; request the deletion of data processed on the basis of consent; request portability; know with whom we share them; withdraw consent; and complain to the ANPD, Brazil's National Data Protection Authority.
To cancel your subscription, just click the link in the footer of any message: it takes one click, with no password and no justification.
To confirm that we process your data or to access them, we answer within 15 days, the period required by law (LGPD, art. 19). For other requests (correction, deletion, portability, withdrawal of consent), the ANPD has not yet published the regulation that would set a deadline; we adopt 15 days as our own commitment. Write to privacidade@aunavo.com.
A diagnostic answered without providing an email cannot be located on request, because nothing links it to you.
7. Security
Access to the databases is restricted to AUNAVO's servers; browsers do not access them directly. We do not keep your IP address in clear text, and communication with the site is encrypted (HTTPS). No system is infallible: if an incident occurs that may cause you relevant risk or harm, we will notify you and the ANPD, as the law requires.
8. Children and adolescents
The site and the tools are aimed at professionals and organizations and are not directed at anyone under 18.
9. Changes
When this policy changes in a relevant way, we will publish the new version here, with the date. If the change alters what you consented to, we will ask for new consent.
10. Governing law and jurisdiction
This policy is governed by the laws of Brazil. The courts of the judicial district of Natal, State of Rio Grande do Norte, Brazil, are chosen to settle questions about it.