Governance & Data Protection

Privacy Policy

Effective Date: October 16, 2026 · Saper Vedere (sapervedere.com.br)

1. Overview and Data Controller

This Privacy Policy explains how personal and corporate data is collected, processed, and protected on sapervedere.com.br and its associated advisory and diagnostic funnels, operated by Saper Vedere, an executive advisory and operational partnership initiative led by Cesar Werlich (Fractional COO & Operating Partner for B2B SaaS founders).

Saper Vedere acts as the Data Controller responsible for your personal data. We are committed to rigorous data privacy standards in compliance with the European Union's General Data Protection Regulation (GDPR - Regulation EU 2016/679) and the Brazilian General Personal Data Protection Law (LGPD - Law No. 13,709/2018).

2. Data We Collect

We collect only the minimum necessary information required to evaluate B2B advisory fit, schedule discovery sessions, and maintain a secure browsing experience:

A. Information You Voluntarily Provide (Diagnostic & Contact Forms)

When you submit an inquiry through our pre-qualification diagnostic forms or contact page (available at /contato or campaign landing pages /lp/[slug]), we may collect:

Full Name: to personalize communication and identify you during discovery calls.
Work / Business Email: primary channel for professional correspondence and calendar invites.
Business Phone / WhatsApp: for urgent scheduling adjustments and direct founder coordination.
Company Name & URL: to review the business model and market context before our discussion.
Company Stage & Operating Metrics: fundraising stage (e.g., Bootstrapped, Pre-seed, Seed, Series A), ARR bracket, or team size, to verify whether our Fractional COO engagement model matches your operational needs.
Operational & GTM Challenges: optional qualitative context regarding outbound machinery, organizational cadence, or fundraising readiness.

B. Technical and Telemetry Data Collected Automatically

When you browse our website, limited technical and telemetry data may be recorded automatically:

IP address (with anonymization masks applied in analytics tooling).
Marketing attribution and campaign parameters (utm_source, utm_campaign, utm_medium).
Device, operating system, browser type, and display resolution.
Page visits, time spent per section, and engagement with call-to-action buttons.

3. Cookies and Tracking Technologies

We utilize cookies, session identifiers, and conversion pixels to monitor site performance, measure the efficacy of B2B advertising, and defend against automated abuse:

Google Analytics 4 (GA4) & Google Tag Manager (GTM): Used to aggregate anonymous session telemetry, evaluate content engagement, and optimize site structure.
Google Ads Conversion Tracking: Measures the efficiency of acquisition campaigns across Google search and partner networks.
Meta Pixel & Conversions API (CAPI): Measures conversion performance and B2B engagement from Meta advertising platforms (Instagram and Facebook).
PostHog: Client and funnel analytics. PostHog is served via our first-party reverse proxy (/ingest/*) to protect user telemetry integrity and avoid cross-site tracking contamination.

You can configure your browser to reject cookies or install privacy extensions to block tracking scripts. Basic informational pages will remain accessible without cookies.

4. Purposes and Legal Bases for Processing

We process personal data only when an applicable legal basis exists under GDPR Article 6 and LGPD Article 7:

Purpose	Categories of Data	Legal Basis (GDPR / LGPD)
B2B lead qualification and advisory fit assessment	Name, business email, company, stage, metrics	Pre-contractual measures (GDPR 6(1)(b) / LGPD 7(V))
Scheduling diagnostic meetings & discovery calls	Name, business email, phone/WhatsApp	Pre-contractual measures (GDPR 6(1)(b) / LGPD 7(V))
Fraud prevention, security, and anti-bot defense	IP address, request headers, security tokens	Legitimate interests (GDPR 6(1)(f) / LGPD 7(IX))
Aggregated analytics and website optimization	Aggregated telemetry, analytics cookies, UTMs	Legitimate interests / Consent (GDPR 6(1)(a)/(f) / LGPD 7(I)/(IX))

5. Data Sharing, Sub-processors, and Bot Security

We maintain a strict no-sale policy: we never sell, rent, or trade your personal data to third parties. We share data solely with trusted technical service providers essential for platform operations:

Cloudflare Turnstile: Intelligent, privacy-preserving anti-bot verification ensuring our forms remain protected from automated abuse without intrusive captcha friction.
Hosting & Cloud Infrastructure: Industry-standard cloud providers (such as Vercel and secure database/webhook infrastructure) featuring modern end-to-end TLS 1.3 encryption in transit and AES-256 encryption at rest.
Calendar & Scheduling Systems: Google Calendar or Cal.com to manage booked discovery appointments selected directly by you.

6. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the specific purposes for which it was collected, or to comply with applicable statutory retention requirements:

Inquiries that do not proceed to an advisory engagement or mutual commercial relationship are periodically pruned or permanently anonymized.
Web server connection logs are retained for statutory periods (such as the 6-month log retention requirement under Brazilian Internet law) to guarantee forensic security.

7. Your Rights as a Data Subject (GDPR & LGPD)

Under both the GDPR (Articles 15-22) and LGPD (Article 18), you possess explicit statutory rights regarding your personal data:

Right of Access: Obtain confirmation on whether your data is being processed and receive a copy.
Right to Rectification: Request correction of inaccurate, incomplete, or outdated information.
Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where statutory grounds exist.
Right to Restriction of Processing: Limit the scope of data processing in designated situations.
Right to Data Portability: Receive your data in a structured, commonly used machine-readable format.
Right to Object: Object to processing based on legitimate interests or direct communication.
Withdrawal of Consent: Revoke any previously granted consent at any time without penalty.

Exercising Your Rights

To submit any data rights request or ask questions about our compliance program, please reach out through our Contact page (/contato). We will review and fulfill your request within the statutory timeframe.

8. Changes to This Policy

We may revise this Privacy Policy periodically to reflect technological adjustments or legal updates. The “Effective Date” at the top of this document indicates when changes take effect. Continued use of our site following updates indicates acknowledgement of the modified terms.