Privacy Policy.

The controller responsible for processing the personal data described in this policy is NorthStar Works Ltda., registered under CNPJ No. 64.651.542/0001-07, based in Xanxerê, SC, Brazil.

For anything related to privacy and data protection — including to reach our Data Protection Officer (DPO) — use: studio@northstarworks.com.br.

This policy applies to the website northstarworks.com.br and to the personal data we collect when you browse it, submit the contact form, or reach us through the listed channels. It does not cover systems operated inside a client’s own environment under a specific contract, which have their own terms.

a) Data you provide. When you submit the contact form, we collect: name, email, company (optional) and the message you write. If you choose to reach us by email or WhatsApp, we collect the content of that conversation and the data you decide to share.

b) Data collected automatically. For security and operational reasons, our hosting and content-delivery (CDN) providers may log technical access data such as IP address, browser and device type, and request date/time. Loading the typefaces (Google Fonts) may also log the visitor’s IP.

c) What we do NOT do. We do not collect sensitive personal data, we do not target collection at children, and we do not use tracking, profiling or advertising cookies, nor third-party analytics tools to monitor your behavior.

We process your data only for legitimate, specific purposes, under the following LGPD legal bases:

• To respond to your contact and pursue the business relationship you requested — bases: consent (art. 7, I), pre-contractual steps at your request (art. 7, V) and legitimate interest (art. 7, IX).
• Security, fraud and abuse prevention (including anti-spam) and the technical operation of the site — basis: legitimate interest (art. 7, IX).
• Compliance with legal or regulatory obligations, where applicable — basis: art. 7, II.

We use the data to: contact you and respond to your request; assess and conduct any business relationship you initiated; keep a record of the contact history; and protect the site and its users against abuse. We do not use your data for advertising and we do not make automated decisions that affect you.

We do not sell your personal data. We share data only with service providers (processors) that support the site’s infrastructure, strictly for the purposes above and under confidentiality and security obligations:

• Vercel Inc. — website hosting and delivery (CDN).
• Supabase Inc. — database where contact-form messages are stored.
• Google LLC — delivery of the typefaces (Google Fonts).
• Meta Platforms / WhatsApp — only if you choose to contact us via WhatsApp.

We may also disclose data where required by law, court order or a competent authority.

Some of our processors may process or store data on servers located outside Brazil (for example, in the United States). In those cases, we select providers with recognized security standards and adopt contractual safeguards, under arts. 33–36 of the LGPD, to ensure equivalent protection for your data.

We keep your contact data only as long as needed to respond and conduct the relationship you initiated, and for the period required to meet legal obligations. Once the purpose ends, we delete or anonymize the data. You may request deletion earlier, at any time (see section 10).

We adopt technical and organizational measures aligned with industry best practices, including:

• Encryption in transit (HTTPS/TLS) across the whole site;
• Database access restricted by Row Level Security — the site can only insert messages; reading is limited to authorized NorthStar Works staff;
• Browser security headers (Content-Security-Policy, HSTS, clickjacking protection);
• Anti-spam mechanisms on the form.

No system is entirely immune to incidents, but we work continuously to mitigate risk. In the event of a relevant incident, we will take the measures and send the notifications required by the LGPD.

Under art. 18 of the LGPD, you may, at any time, request:

• confirmation that processing exists and access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or non-compliant data;
• data portability;
• information about whom we share your data with;
• information about the option not to consent and its consequences;
• withdrawal of consent and deletion of data processed on that basis.

To exercise any right, write to studio@northstarworks.com.br. We will respond within the legal deadlines. You may also file a complaint with Brazil’s National Data Protection Authority (ANPD).

This site does not use tracking, profiling or advertising cookies. There may be strictly technical cookies set by the hosting/CDN infrastructure for security and content delivery, with no marketing or profiling purpose.

This site is intended for professionals and companies and is not directed at anyone under 18. We do not knowingly collect personal data from children. If we identify inadvertent collection, we will delete the data.

Our site contains links to third-party services (such as WhatsApp, LinkedIn and Reddit). Once you access them, you are governed by those platforms’ privacy policies, for which we are not responsible.

We may update this policy to reflect changes in our practices or in the law. The “last updated” date at the top indicates the current version. Material changes will be flagged on this site.

For questions, requests, or to exercise your rights, contact our Data Protection Officer (DPO): studio@northstarworks.com.br.