Privacy policy
Última atualização: October 14, 2026
This policy explains how Tumulto handles the personal data of people who visit tumulto.ai and use the forms and contact options on it. It follows Brazil's General Data Protection Law (Law 13,709/2018, the LGPD) and Brazil's Internet Civil Framework (Marco Civil da Internet, Law 12,965/2014).
It only covers what happens through the site. It doesn't cover third-party sites linked here, or data handled inside client projects, which is agreed by contract.
1. Who looks after your data
The data controller is Tumulto, the trade name of [to be defined], registered under CNPJ (Brazilian company number) [to be defined], based in [to be defined].
For anything about privacy, including reaching our data protection officer, write to hello@tumulto.ai.
2. What data we handle
2.1 Browsing and technical logs
When you open the site, the hosting server automatically logs technical data about the visit: IP address, date and time, page visited, browser and operating system. This keeps the site running and secure, and isn't used to identify who you are.
2.2 Contact form
The form on the contact page asks for your name, brand, store or Instagram link and what's holding your business back. Right now it doesn't send anything through the site: when you hit send, it opens your email app with the message ready for hello@tumulto.ai, and it only reaches us if you send it. The data stays in our inbox.
2.3 Direct email
If you write to hello@tumulto.ai, we receive your email address and whatever you choose to tell us in the message.
2.4 Newsletter
The newsletter field in the footer isn't live yet and doesn't store any email. When it launches, we'll only ask for your email, with your consent, and you'll be able to unsubscribe anytime through the link in every send. This policy will be updated then.
2.5 YouTube videos
Some videos on the site are from YouTube and use privacy-enhanced mode (youtube-nocookie.com). When these videos load and play, Google, which owns YouTube, receives technical data about your visit, such as your IP address, under its own privacy policy.
2.6 Audience measurement
To understand how the site is used and improve it, we use Google Analytics and Microsoft Clarity, loaded through Google Tag Manager. They record the pages you visit, where you came from, how long you stayed, your device, browser and approximate region. Clarity also records clicks, scrolling and mouse movement to build heatmaps and session recordings, with text fields masked. We look at this data in aggregate and don't use it to identify who you are.
2.7 Social media and external links
The site links to Tumulto's Instagram and to articles on other sites. Once you click through, that service's privacy policy applies.
2.8 Cookies
The site uses analytics cookies from Google Analytics and Microsoft Clarity to measure audience as described in 2.6, and doesn't use advertising cookies. Fonts are served by the site itself. YouTube may also set cookies or similar technologies when you play a video. You can block or delete cookies in your browser settings without losing access to the content.
3. What we use it for, and on what legal basis
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Keep the site up and secure | Technical browsing logs | Legitimate interest (art. 7, IX) and the legal duty to keep access logs (Marco Civil, art. 15) |
| Understand how the site is used and improve it | Browsing and interaction data (Google Analytics and Microsoft Clarity) | Legitimate interest (art. 7, IX) |
| Reply to your message and prepare a proposal or diagnosis | Form and email data | Pre-contractual steps at your request (art. 7, V) |
| Send the newsletter, once it's live | Consent (art. 7, I) |
4. You don't have to give us your data
You can browse the whole site without filling anything in. Contact details are only needed if you want us to reply; without them, there's no way to get back to you.
5. Who we share it with
We don't sell or rent personal data. It only goes through the providers that keep the site and contact working, each handling the data on Tumulto's behalf:
- Site hosting: Vercel.
- Email: info@tumulto.ai.
- Videos: YouTube (Google), only when a video loads.
- Audience measurement: Google Analytics and Google Tag Manager (Google) and Microsoft Clarity (Microsoft).
We may also share data when required by law or by order of a competent authority.
6. Transfers outside Brazil
Some of these providers store data on servers outside Brazil, such as in the United States. In those cases, the transfer follows what the LGPD allows (art. 33), with providers offering protection safeguards in line with Brazilian law.
7. How long we keep it
- Site access logs: 6 months, as required by the Marco Civil da Internet.
- Audience measurement data: up to 14 months, under the retention periods of Google Analytics and Microsoft Clarity.
- Contacts and messages: as long as needed to reply and follow up. If it turns into a project, for as long as we work together and for whatever periods the law requires after that.
- Newsletter: until you ask to unsubscribe.
After that, the data is deleted or anonymized.
8. Your rights
Under the LGPD (art. 18), you can ask us, at any time, to:
- confirm whether we handle your data and give you access to it;
- correct incomplete, wrong or outdated data;
- anonymize, block or delete data that's unnecessary, excessive or handled unlawfully;
- move your data to another provider (portability);
- delete data handled with your consent;
- tell you who we share your data with;
- let you know you can refuse consent and what happens if you do;
- withdraw consent whenever you want.
To exercise any of these rights, write to hello@tumulto.ai and tell us what you need. We may ask for some information to confirm it's you, and we'll reply within 15 days.
9. Complaints to the ANPD
If you think your data was handled the wrong way, you can also file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd. Before that, if you'd like, talk to us: we'd rather sort it out directly.
10. Automated decisions
We don't make decisions about you based solely on automated processing. Audience measurement data is used to understand how the site is used overall, not to build profiles of visitors.
11. Children and teenagers
The site is made for businesses and isn't aimed at anyone under 18. We don't knowingly collect data from children or teenagers.
12. Security
The site uses an encrypted connection (HTTPS), and access to contact data is limited to whoever needs it to reply. No system is 100% failure-proof; if an incident puts you at risk, we'll notify you and the ANPD, as the law requires.
13. Changes to this policy
This policy may change, for example when the newsletter goes live or if the site starts using a new tool. The last updated date is always at the top of the page.