Privacy policy

Browsing

Only if you accept browsing cookies, we record how you browse: the pages you visit and in what order, the headings that reach your screen, the links and buttons you click, how far you scroll, how long you pay attention to each page, and whether you open a conversation or leave a contact. We also record where the visit came from (the referring site and campaign parameters in the address), your IP address, browser, operating system, device type, screen size, language and time zone. We never record what you type in any field.

Two first-party cookies make this possible: one keeps your choice, the other a random identifier that recognises a return visit. The purpose is to understand what brings people here and what they look for, and, if you start a conversation or leave a contact, to answer with that context. When you open the conversation, the assistant receives a summary of your browsing so it understands what you are looking for: the sections you read and for how long, where the visit came from, and whether you came back, talked to us or left a contact before. The summary never carries your IP address, browser or the identifier. If you leave a contact, it is linked to your browsing record through that identifier. The legal basis is your consent (article 7(I) of the LGPD). Browsing data is deleted automatically 395 days after the last visit, and it is never sold or shared for advertising.

With the same consent we also use Google Analytics, by Google, to measure the audience in aggregate: pages visited, where the visit came from, device type and approximate region. It sets the _ga cookies in your browser and sends this data to Google, which processes it on our behalf, including outside Brazil. Google signals and ad personalisation are turned off, and this data is not used for advertising. It is kept for the period set in Google Analytics, at most 14 months.

You can change your choice at any time. Declining stops the collection, removes the identifier from your browser and switches off Google Analytics, deleting its cookies.

What we handle

Your messages or speech are sent to OpenAI to generate replies. From your first message, the conversation is recorded in Firestore: what you type, the transcript of what is said by voice, the assistant's replies and the language. The audio of your voice is not recorded, only the transcribed text. If you accepted browsing cookies, the summary of your browsing described above goes to OpenAI with the conversation. If you ask us to get back to you, the assistant also requests your name and email address, and a phone number if you want to give one, confirms them with you, and stores them as a contact with a short summary of your request and what you told it about your role, urgency and situation, linked to the conversation. If you accepted browsing cookies, the contact is also linked to your browsing record, so whoever answers you knows what you read.

Avoid sharing sensitive data in the conversation, such as health information, documents or passwords. It is not needed to answer your request.

Purpose and legal basis

We use these details to answer the request you initiated, with the full context of the conversation, and to take steps toward a possible contract, under article 7(V) of Brazil’s LGPD. We also read recorded conversations to review and improve the assistant’s answers, based on our legitimate interest (article 7(IX)). Technical connection data may be used to limit abuse of the public chat. We do not use the conversation to send marketing messages, and we do not use it to train artificial intelligence models.

We also use AI (OpenAI) to classify contact messages and conversations internally by topic, urgency and tone, so we can organise how we respond. Before anything is sent, we remove email addresses, phone numbers and links from the text, and your name and contact details are never sent. The result is stored in Firestore for the same 180 days as the conversation and is seen only by the people who respond. Legal basis: legitimate interest (article 7(IX)).

Services and retention

OpenAI processes the conversation to produce replies. Google Cloud Firestore, in Brazil, stores the conversation and, after confirmation, the contact details. Each conversation is deleted automatically 180 days after it starts. We keep contact records for the time needed to handle the request and applicable legal obligations. Access to both is restricted, with a password, to the people responsible for responding.

Your rights and contact

You can ask about your data, request correction or deletion when applicable, including deleting a conversation before its term, and exercise other rights under the LGPD by writing to contact@giu.so.