This Privacy Policy governs the processing of personal data across the digital platform https://www.psymatrix.com.br/, operated by Guilherme Oliveira. It demonstrates our commitment to the Brazilian General Data Protection Law (LGPD - Law No. 13,709/2018), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014), and international data privacy principles.
1. Data Controller & Data Protection Officer (DPO)
2. Privacy by Design & Data Minimization
We build with data minimization and privacy by default principles:
- We collect strictly the data essential for delivering digital services, technical maintenance, and proposal generation.
- We do not sell, rent, license, or transfer personal data to third-party data brokers or programmatic marketing networks.
- The site operates without invasive third-party tracking scripts.
3. Scope of Covered Digital Services
This policy covers all digital services under the domain psymatrix.com.br:
- Institutional & Case Pages: Showcase of services, case studies, and engineering practices.
- Official Blog (`/blog`): Articles on UX, GEO, AI, and Front-End engineering with Markdown capabilities.
- Restricted Administration (`/admin`): Secure publishing area with Argon2id hashing, secure sessions, and anti-CSRF protection.
- AI Protocols & Content Negotiation: Endpoints for
acceptmarkdown.com,llms.txt, andAGENTS.mddelivering pure Markdown to AI agents without behavioral profiling. - Direct Channels: Encrypted communications via WhatsApp and commercial email.
4. Categories of Data Collected and Legal Bases
A. Voluntary Communications
Information provided directly by you when reaching out via WhatsApp or email (name, corporate email, phone, and project description).
Legal Basis (LGPD): Article 7, V (pre-contractual procedures at the request of the data subject).
B. Audience Analytics (Google Analytics 4)
We use Google Analytics 4 (Measurement ID: G-X1PC05843R) to measure traffic volume and popular content. Data is anonymized with IP masking (anonymize_ip: true). Furthermore, under Google Consent Mode v2, analytics cookies remain disabled until the visitor explicitly clicks "Accept All" in our Cookie Banner.
Legal Basis (LGPD): Article 7, I (free, informed, and unambiguous consent).
C. Server Connection Logs (Apache)
The web server records connection logs containing public IP, date, time, requested URL, and User-Agent strings.
Legal Basis: Mandatory legal compliance under Article 15 of Brazilian Federal Law No. 12,965/2014 (Marco Civil da Internet), requiring 6-month confidential log retention, combined with LGPD Article 7, IX (legitimate interest in cybersecurity defense).
5. Cookie Directory & Local Storage
| Cookie / Key | Category | Purpose | Duration |
|---|---|---|---|
psymatrix_cookie_consent |
Technical / Essential | Stores visitor privacy choices selected in the Cookie Banner. | 12 months |
PSYMATRIXSESSID |
Technical / Essential | Encrypted session identifier (HttpOnly, Secure, SameSite=Strict) for administrators. | Session / 2h |
csrf_token |
Security / Essential | Protects forms against Cross-Site Request Forgery attacks. | Session |
_ga |
Analytical (Google LLC) | Distinguishes unique anonymous visitors for aggregated audience reporting. | Up to 2 years |
_ga_X1PC05843R |
Analytical (Google LLC) | Maintains analytical session state in Google Analytics 4. | Up to 2 years |
6. Implemented Information Security Measures
We maintain a multi-layered security architecture to ensure data integrity and prevent unauthorized access:
- TLS/HTTPS Encryption: All communications operate over strong TLS encryption with forced redirection from unencrypted HTTP.
- HSTS Preload: Enforced via
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. - Content Security Policy (CSP): Strict security policy preventing cross-site scripting (XSS) and rogue resource injection.
- X-Content-Type-Options: nosniff: Eliminates browser MIME-type sniffing vulnerabilities.
- X-Frame-Options: SAMEORIGIN & CSP frame-ancestors: Robust defense against clickjacking attacks.
- Cross-Origin Security:
Cross-Origin-Resource-Policy: same-originandCross-Origin-Opener-Policy: same-origin. - Subresource Integrity (SRI): Cryptographic SHA-384 integrity verification for external vendor libraries.
- Argon2id Password Hashing: State-of-the-art password security resistant to specialized GPU cracking hardware.
7. Data Subject Rights (LGPD Article 18 & GDPR)
You may at any time exercise your statutory rights: confirmation of data processing, full access, rectification of inaccurate records, anonymization, blocking, deletion, and effortless revocation of consent.
To revoke analytical cookie consent, click Manage Cookie Preferences. For all other data inquiries, contact contato@psymatrix.com.br.