Privacy policy

Last updated 2 November 2026.

Who we are

Ithaca Builders Ltda is the controller of the personal data processed on this site. That means we decide how this data is used.

CNPJ (Brazilian company ID): 66.942.594/0001-68
Address: Avenida Doutor Arnaldo, 2194, Sumaré, São Paulo/SP, 01255-000, Brazil
Email: contato@ithaca.builders
Data protection officer (encarregado): Yugo Miyahara (contato@ithaca.builders)

Browsing the site (Google Analytics)

We only use Google Analytics 4 if you accept cookies. The legal basis is your consent (LGPD, art. 7, I).

If you accept, Google Analytics stores a random identifier in two cookies (_ga and _ga_HYX4DD3KD1) and records:

the pages you view and how long you spend on each;
how you reached the site;
whether you submitted the "Book a demo" form, but not anything you wrote in it;
your device and browser type;
your approximate location (city).

To estimate your location, Google receives your IP address. According to Google, GA4 does not store IP addresses.

We use this data only to understand how the site is used and to improve it.

If you decline, Google Analytics is not loaded and nothing is sent to Google.

Data linked to the identifier is deleted from Google Analytics after 2 months. Aggregated reports, which only show totals and not individual people, may be kept longer. The cookies expire after 13 months.

The "Book a demo" form

If you fill in the form, we receive your name, email address and phone number. Your request reaches the company's Google Workspace inbox by email. If you accepted cookies, Google Analytics also records that the form was sent, but not the details you entered.

We use this data only to reply to your request and discuss a possible deployment.

The legal basis is taking steps at your request before a contract (LGPD, art. 7, V). If you write on behalf of a company, the legal basis is our legitimate interest in replying to people who contact us (LGPD, art. 7, IX).

If the conversation doesn't lead to a contract, we delete your details within 2 years, or sooner if you ask. If it does, we keep them for the length of the contract and for any period the law requires.

Hosting and security

The site is hosted by Netlify. Like any website host, Netlify receives technical data from each visit: IP address, browser, page requested, date and time.

We use these records only to keep the site running and protect it from abuse. The legal basis is our legitimate interest (LGPD, art. 7, IX).

These records are visible to us in our hosting dashboard for 24 hours. Netlify keeps its own security logs for the period set in its own policy.

Cookies

Besides the Google Analytics cookies, which only exist if you accept, we store your cookie choice in your browser so we don't ask again on every page. We don't use advertising cookies.

You can change your choice at any time under "Cookie preferences" in the footer. You can also delete or block cookies in your browser settings.

Who we share data with

These providers process data on our behalf:

Google (United States and other countries): Google Analytics, if you accept cookies, and the Google Workspace inbox that receives the form.
Resend (United States): sends the form email and keeps a copy for 30 days.
Netlify (United States): hosts the site and processes form submissions.

Apart from these providers, we only share data with other people or companies if the law or a court order requires it. We don't sell data or use it for advertising.

Transfers outside Brazil

Google, Netlify and Resend may process your data outside Brazil, including in the United States, under each provider's own contracts and terms. If you'd like to know more about these transfers, write to contato@ithaca.builders.

How long we keep data

Google Analytics data linked to the identifier: 2 months. Aggregated reports may be kept longer.
Google Analytics cookies: expire after 13 months.
Form data, if the conversation doesn't lead to a contract: up to 2 years, or sooner if you ask.
Form data, if it does: for the length of the contract and any period the law requires.
Copy of the form email at Resend: 30 days.
Visit records in our hosting dashboard: 24 hours. Netlify's own security logs follow its own policy.

Your rights

At any time, you can ask us for:

confirmation that we process your data;
access to your data;
correction of data that is incomplete, inaccurate or out of date;
anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD;
portability of your data to another provider;
deletion of data processed with your consent;
a list of the companies and public bodies we share your data with;
information about your option not to consent and what happens if you don't. For Google Analytics, nothing changes on the site.

You can also:

withdraw your consent at any time under "Cookie preferences" in the footer;
object to processing based on our legitimate interest.

For any request, write to contato@ithaca.builders.

You can also file a complaint with Brazil's data protection authority (ANPD): https://www.gov.br/anpd/pt-br/canais_atendimento/cidadao-titular-de-dados

Changes to this policy

If we change this policy, we update the date at the top. If a change affects something you agreed to, we'll ask for your consent again.