How we handle your data.

The controller of the personal data processed on this site is Forward Factory, registered under CNPJ 62.987.097/0001-25. The decisions about data processing described in this policy are the controller's responsibility.

The Data Protection Officer (DPO) can be reached at contato@forwardfactory.xyz, the channel through which data subjects exercise their rights and clarify privacy questions.

We collect only the data necessary to respond to a business inquiry and operate the site:

• Data you provide in the contact form: name, email, company, asset type, estimated volume (optional) and your message.
• Technical submission data: the browser's user-agent, recorded with the lead for security and diagnostics.
• Browsing data via cookies and similar technologies, only when you consent to the analytics and/or marketing categories (see the cookies section).

We do not collect sensitive data and do not request personal documents through the site. KYC/AML procedures, when applicable to a structured operation, take place outside the site, under their own process.

We process form data to respond to your inquiry and assess a potential business relationship, with the legal basis of legitimate interest for the B2B relationship (LGPD art. 7, IX) and the execution of preliminary procedures at your request (art. 7, V).

Analytics and marketing cookies are processed exclusively on the basis of your consent (art. 7, I), collected freely, informedly and unequivocally through the cookie banner, and revocable at any time.

We do not sell personal data. We share data only with processors that handle information on our behalf, to the extent necessary to operate the site:

• Vercel: hosting and delivery of the site.
• Resend: sending the lead notification email to our institutional inbox.
• Supabase: lead storage, when that destination is enabled.
• Plausible: cookie-free audience metrics with no personal data (always loads, as it is privacy-first).
• Cloudflare Turnstile: anti-bot verification on the form (a challenge without tracking cookies).
• Google (Analytics), Meta and LinkedIn: only if you consent to analytics/marketing cookies; they receive browsing data for measurement and advertising.

We classify cookies into three categories. Necessary cookies keep the site functional and record your own consent choice, and are always active. Analytics cookies measure how the site is used and marketing cookies support advertising and remarketing; both only load after your explicit consent.

Before consent, no analytics or marketing cookie is installed. You can accept, refuse or adjust the categories at any time, and withdrawal is as simple as consent.

Some processors (Vercel, Resend, Cloudflare, Google, Meta and LinkedIn) process data on servers outside Brazil. In those cases, the international transfer observes the LGPD's hypotheses and safeguards (arts. 33 to 36), including contractual clauses and protection standards adopted by those providers.

We keep lead data for the period necessary for the business relationship and, in the absence of interaction, for up to 24 months, after which it is deleted or anonymized. Legal or regulatory obligations may require retention for a different period; in those cases, the data is kept only for that purpose.

Under art. 18 of the LGPD, you may, at any time, request:

• confirmation that processing exists and access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data;
• portability of the data to another provider, upon request;
• information about the entities with which we share data;
• withdrawal of consent and objection to processing based on it.

To exercise any of these rights, write to contato@forwardfactory.xyz. We will respond within the legal deadline. You may also petition the Brazilian National Data Protection Authority (ANPD).

We adopt technical and organizational measures compatible with the nature of the data: traffic over HTTPS/HSTS, security headers, validation and anti-bot verification on the form, and restricted access to storage systems. No method is infallible, but we work to mitigate risks of unauthorized access, loss or improper alteration.

We may update this policy to reflect legal, technical or business changes. The date of the last revision appears at the top of this page. Relevant changes will be flagged on the site itself.