A short, literal list, not generic legal text. If something here doesn't answer your question, ask through the contact form.
What you type into the contact form: name, email, phone, and what you write about your operation. This data is sent by email to the NexaModus team, through a server-to-server call. Beyond that, the site reads which country your connection comes from in order to choose the page language; it is explained just below, under "Page language".
There is no tracking cookie, social network pixel, or behavioral analytics on this site — no advertising or remarketing tool is loaded here.
When you log in, this site writes a session cookie to your browser with your email and an account identifier. It lasts 14 days without use, and every time you come back that clock restarts — but there is an absolute limit of 90 days from the login itself, and that one never moves: once it is reached, you log in again. This cookie is not for tracking or advertising: it exists only so the site knows it's you, and its legal basis is carrying out the access you requested, not a separate consent choice. When you click "Sign out", your email is also sent, once, to auth.nexamodus.com — NexaModus's own login system — to end your session there too. When you sign out — here or in another product that uses the same login — this site is notified and the cookie stops working on the next page you open, without waiting for the deadline. One honest caveat: asking to delete your account does not, on its own, drop a cookie that was already issued; if that is your case, also ask to be signed out of every device, or wait for the 90-day maximum.
When you open an address on this site that does not state a language, it reads which country your connection comes from to decide whether to show the page in Portuguese, Spanish or English. That reading is done by the hosting provider, and all that reaches us is the country code — your IP address is never seen or stored by this site, and the country is not recorded on any server. A language cookie called NEXT_LOCALE stays in your browser for one year, and it can only hold three values: pt, en or es. It does not identify you, no third party reads it, and no part of the site uses it to decide what you can access. Switching language in the selector at the top overrides it, and your choice always beats the country. The legal basis here is legitimate interest (art. 7, IX of Brazil's LGPD): showing the page in the language the visitor is likely to read. Because legitimate interest gives you the right to object, we keep that right one click away — the language selector at the top is how you exercise it, with no form and no request.
If you arrived through a link with a campaign parameter and authorized "Allow measurement" in the consent banner, that source data may travel with your contact form submission, but the server neither records it nor includes it in the email sent to the team. Without that explicit authorization, no attribution data leaves your browser.
Source attribution data, when recorded under consent, is kept for up to 180 days. The message from the contact form stays in the team's mailbox while the sales conversation is open, like any commercial relationship record. When you sign out, the server keeps a receipt of it — who signed out, when, and which site the notice was delivered to; never the contents of anything. That receipt is kept for 90 days, the same maximum lifetime as the session cookie, and deleted afterwards: deleting it sooner would bring back a session that had already been dropped.
What you type into the contact form is sent by email to the NexaModus team, through a server-to-server call. No data from the form is sent to an ad provider, social network, or third-party tool. The email sending provider, described in the next item, only delivers the message: it acts as the operator of the sending.
The emails this site sends you — signup confirmation, verification resend and, once it is switched on, the password reset link — go out through a contracted sending provider, not from our own server. What it receives is your email address and the message's content; nothing beyond that. The message you write in the contact form also passes through this provider on its way to the NexaModus team. For the reset link, that content includes a link valid for 30 minutes and a single use — anyone with access to your inbox in that window can use it, which is why it is short and disappears on first use. To find out which provider, under which contract, and how long it keeps the message, contact the data officer through the channel below.
The officer in charge of personal data (art. 41 of the Brazilian LGPD) is NexaModus Technologies itself, through dpo@nexamodus.com. That is the channel for exercising your rights as a data subject — access, correction, deletion and portability — and to get an answer to any privacy question.
Two channels, same destination: the /contact form or the e-mail dpo@nexamodus.com. Describe your request (access, correction, deletion or portability) and it reaches the team that manages the data.