Privacy Policy

Last updated: September 22, 2026

This Policy describes how the Infusion site collects, uses and protects your personal data, in line with Brazil's General Data Protection Law (Law 13.709/2018, LGPD). By using the site, you agree to the practices described here. The product (app.infusion.cloud) has its own policy, presented at sign-up.

1. Who is the data controller

The party responsible for processing your data is Infusion, operator of this site. Contact for privacy matters: [email protected].

2. What data we collect

• Site usage data (pages viewed, scrolling, visit source, device type), collected by Google Analytics only while the Metrics category is on (see items 4 and 6).
• Campaign measurement data (an ad click identifier such as gclid, and the visit's origin/UTM), used by Google Ads to know whether an ad brought visits, only while the Campaign measurement category is on (see items 4 and 6).
• Personalized advertising data (a browser identifier used by Google Ads and Meta to show Infusion ads to people who already visited the site, on other sites and networks), collected only while the Personalized advertising category is on, which always depends on your acceptance (see items 4 and 6).
• Our own anonymous statistics (page viewed, scroll depth, button clicks, language, country/region and the campaign that brought the visit), recorded on our own infrastructure, without cookies and without any identifier that persists across visits. The session identifier is temporary and disappears when you close the tab (see item 6).
• Your visit's journey, while the Metrics category is on: where you arrived from (campaign, ad click identifier and the referring site), the path you took here (pages viewed, sections reached, button clicks, scroll depth and reading time), the date of your first visit and how many visits you have made, the country reported by our infrastructure, your time zone and browser language, and your device's characteristics (browser and version, operating system, device type, screen and window size, light or dark theme). It is kept in the infusion_journey cookie for up to 90 days and shared with the product (app.infusion.cloud), so we can understand the full path from arriving at the site to creating an account (items 3, 5 and 6). What it does not include: the text you type in the box on the home page, which travels only in the address, so the product can open the conversation with it, and is not stored in that cookie; your IP address; precise location; and any browser fingerprinting technique.
• Technical data (browser/device type and the country you are visiting from, inferred by our infrastructure from the connection) processed transiently for security, abuse prevention, choosing the page's default language and the cookie banner's default (item 6). Outside your visit's journey described above, which only exists while the Metrics category is on, the country is not stored or linked to you.

This site has no sign-up. The only form is the contact form for the Teams plan ("Talk to us", in the pricing section). If you send it, we collect what you type: name, work email, company, team size and, optionally, a description of what your team wants to build. Along with the request we keep the page language, the country you visited from and the campaign that brought the visit (the same data as the infusion_attrib cookie, item 6), to know how the contact reached us. Outside that form we do not collect your name, e-mail or phone number, and in no case do we store your IP address.

3. Why we use the data

• Understand how the site is used and improve the product.
• Reply to your contact request about the Teams plan.
• Prevent spam, fraud and abuse.

4. Legal basis

Visits from Brazil. We process Google Analytics metrics and Google Ads campaign measurement based on legitimate interest (art. 7, IX, read with art. 10 of the LGPD) in measuring how the site is used and how our campaigns perform. For that reason, for visits from Brazil the Metrics and Campaign measurement categories are on from the first visit, with a notice on screen. You have the right to object at any time (art. 18, §2): turn off one or both via the notice's "Customize" button or the "Cookies" link in the footer. From then on the processing stops, and the cookies that category had already set are deleted from your browser (see items 6 and 7).

Personalized advertising, in any country. Google Ads remarketing and the Meta Pixel are only turned on with your consent (art. 7, I), given in the cookie banner. They are never on by default.

Teams plan form. The data you send through the form is processed to reply to your request and carry on the commercial conversation you started, based on steps preliminary to a contract (art. 7, V of the LGPD; art. 6(1)(b) of the GDPR where it applies). Sending it is always your action; without it, nothing is collected.

Visits from outside Brazil (or when we cannot identify the country): all three categories are only turned on with your consent (art. 7, I), given per category in the cookie banner. Accepting one does not accept the others, and you can withdraw consent at any time via the "Cookies" link in the footer.

Our own anonymous, aggregate statistics (item 6) and technical security data are processed, in any country, based on legitimate interest (art. 7, IX) to measure, secure and improve the site.

Visitors in the European Union and the United Kingdom (GDPR). If you access the site from the European Economic Area or the UK, processing also follows the GDPR: metrics, campaign measurement and advertising cookies only with your consent (art. 6(1)(a)), given per category and which you can withdraw at any time via the "Cookies" link in the site footer. You also have the rights of access, rectification, erasure, portability and objection, including the right to object to ad personalization at any time, and the right to lodge a complaint with your local data protection authority. Transfers to Google (US) rely on the EU-US Data Privacy Framework; transfers to Meta (US) rely on standard contractual clauses and other safeguards required by the GDPR.

5. Who we share with

We do not sell your data. We use Cloudflare as an infrastructure processor (site hosting and delivery). While the corresponding category is on (items 4 and 6), we use Google as a processor for usage metrics (Google Analytics), campaign measurement and remarketing (Google Ads), and Meta Platforms (Facebook/Instagram) as a personalized advertising processor (Meta Pixel). Meta only receives data once the Personalized advertising category is accepted. Data may be processed on servers outside Brazil, with the safeguards required by the LGPD for international transfers (standard contractual clauses and, for Google, also the EU-US Data Privacy Framework).

Sharing with our own product. While the Metrics category is on, your visit's journey (item 2) and the campaign origin live in cookies on the .infusion.cloud domain and are read by the product (app.infusion.cloud) when you go there. The purpose is a single one: understanding the full path between arriving at the site and creating an account, so we know what works. The product is ours, not a third party, but it has its own policy, which governs what happens inside it.

6. Cookies and local storage

The site uses essential local storage to remember your chosen theme, language and cookie choice. The choice is also kept in the infusion_consent cookie, valid for 12 months, so the product (app.infusion.cloud) honors the same decision without asking again; it holds only the three categories and the legal basis, nothing that identifies you. To reach the product, this cookie is set on the .infusion.cloud domain, which means it is readable by any subdomain of infusion.cloud, including the apps published by people who use the platform, which live at addresses such as app-name.infusion.cloud. That is the same reach the Google and Meta cookies described below already have. If you would rather not keep this sharing, turning the categories off in the banner deletes our cookies, and you can clear the site's cookies in your browser at any time. The cookie banner has three independent categories: Metrics, Campaign measurement and Personalized advertising. Turning one on does not turn on the others. If you visit from Brazil, Metrics and Campaign measurement are on by default (legitimate interest, item 4) and the banner is a notice: you can turn either off right away. Personalized advertising only turns on if you accept it. If you visit from another country, or if we cannot identify the country, no category is on until you accept. Either way, choose via the "Customize" button on the banner and change your mind at any time via the "Cookies" link in the footer.

Usage metrics (Google Analytics). We use Google Analytics 4 to understand how the site is used (pages viewed, scrolling, visit source) and improve the product. Google Analytics only loads, and its cookies (_ga, _ga_*) are only set, while the Metrics category is on. With it off, nothing is sent to Google through this channel, and its cookies are deleted. This processing follows the Google Privacy Policy.

Your visit's journey (the infusion_journey cookie). Also while the Metrics category is on, we set our own cookie with the journey described in item 2, for up to 90 days. It is set on the .infusion.cloud domain so the product (app.infusion.cloud) receives that journey when you go on to create an account and, for the same reason, it is readable by any subdomain of infusion.cloud, including the apps published by people who use the platform. Its content is the one in item 2, without the text you typed, without your IP and without precise location. With the Metrics category off, this cookie is not created and, if it already exists, it is deleted right away.

Campaign measurement (Google Ads). While the Campaign measurement category is on, we use Google Ads to know whether an ad click led to a site visit. This sets the _gcl_au, _gcl_aw and _gac_* cookies (Google Ads) and our own infusion_attrib cookie, which keeps the campaign that brought the visit (click identifier and UTM parameters) for up to 90 days. It is also set on the .infusion.cloud domain, so the origin reaches the product (app.infusion.cloud) if you create an account there and, for the same reason, it is readable by any subdomain of infusion.cloud, including the apps published by people who use the platform. A visit without a campaign does not erase the origin already stored. This category does not include remarketing: it measures results, it does not build ad audiences. With it off, these cookies are deleted.

Personalized advertising (remarketing and Meta Pixel). Only with your acceptance, in any country. While this category is on, we use Google Ads remarketing and the Meta Pixel (Facebook/Instagram) to show Infusion ads to people who already visited the site, on other sites and networks. This sets the _fbp and _fbc cookies (Meta) and lets Google Ads personalize ads. Without that acceptance, nothing is sent to Meta and Google Ads does not personalize ads for you. This site has no sign-up (item 2): if you go on to the product (app.infusion.cloud) and create an account there, what that step shares with Google Ads and Meta follows the product's own privacy policy, presented at sign-up. Processing here on the site follows the Google Privacy Policy and the Meta Privacy Policy.

Our own measurement, without cookies. We also record, on our own infrastructure, anonymous browsing statistics: page viewed, scroll depth, button clicks, language, country/region and the campaign that brought the visit. This measurement sets no cookies, does not store your IP address and uses no identifier that persists across visits: the session identifier is stored only in your browser while the tab is open and is deleted when you close it. Advertising click identifiers (such as Google's gclid) are not recorded here. They only enter the Campaign measurement cookies described above, and only while that category is on. Of the address you came from we keep only the domain (for example, "instagram.com"), never the full address. Because this data is anonymous and aggregate, these statistics do not depend on the cookie banner and are not shared with Google or Meta.

7. Your rights

At any time, you may request:

• Confirmation that we process your data and access to it;
• Correction of incomplete or outdated data;
• Deletion of your data / withdrawal of consent;
• Objection to processing based on legitimate interest (Metrics and Campaign measurement, for visits from Brazil). You can do this directly via the "Cookies" link in the footer, no need to write to us;
• Portability and information about sharing.

To exercise any right, write to [email protected]. We will respond within the legal deadline.

8. How long we keep it

This site keeps no user accounts. Data sent through the Teams plan form is kept for as long as the commercial contact lasts and for up to 12 months after the last interaction, or until you ask for deletion (item 7). Usage metrics are retained in Google Analytics for up to 14 months and accessed in aggregate. Your visit's journey cookie (infusion_journey, item 6) lasts up to 90 days in your browser, and is deleted right away if you turn the Metrics category off. Campaign measurement and personalized advertising cookies last, in your browser, for up to 90 days, which is the standard lifetime Google Ads and Meta use for that type of cookie. They expire on their own, or sooner if you turn the category off (item 6). Our own anonymous statistics (item 6) stay on our infrastructure in detailed form for up to 180 days; after that only aggregate monthly totals remain, kept for up to 24 months. As they contain no personal identifier, they cannot be linked back to you. Local preferences (theme, language and cookie choice) live only in your browser, under your control.

9. Security

We adopt technical measures to protect your data, including encrypted connection (HTTPS) and security headers applied to every page.

10. Changes to this policy

We may update this Policy from time to time. The date at the top shows the last revision. Significant changes will be communicated through available channels.