--- title: "Privacy policy | WIP" description: "How WIP handles diagnosis form data and the visit origin cookie under Brazil’s data protection law (LGPD), and how to exercise your rights." url: https://workinprogress.company/privacy updated: 2026-10-27 lang: en --- Privacy # Privacy policy This policy explains what personal data the WIP website collects, why, on what legal basis, where it is stored, for how long, and how you can exercise the rights provided for in Brazil’s data protection law, the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018, the LGPD). Updated on October 27, 2026 This English version is a translation provided for convenience. If there is any discrepancy between this translation and the original, the [Portuguese version of this policy](https://workinprogress.company/pt/privacidade) prevails. ## Who is the data controller? The controller of the personal data processed on this website is WIP (Work in Progress), which decides how and for what purposes this data is used. - **Legal name:** PENDING: legal name of the controller. - **CNPJ (Brazilian company registration number):** PENDING: CNPJ of the controller. - **Address:** PENDING: address of the controller. - **Privacy contact:** [contato@workinprogress.company](mailto:contato@workinprogress.company) ## What data does the site collect? The site collects personal data only when you fill out the diagnosis request form. Browsing the pages does not require registration. | Form data | What it is for | | --- | --- | | Name | Knowing who we are talking to | | Email | Replying to your request | | Company or website | Understanding the system’s context | | Segment | Steering the conversation: creator, business or technical team | | Need | Understanding the problem to be solved | | Urgency | Prioritizing the reply | | Whether the software was built with AI | Preparing the right analysis | | How you heard about WIP | Learning which channels bring in contacts | | Message | Recording any details you want to share | Please do not include passwords, access keys, sensitive personal data (such as health, religious or biometric data) or other people’s data in the message. If the diagnosis requires access to systems, that is arranged later, through a secure channel. Besides the form, the site uses a first-party visit origin cookie and a limit on submissions per IP address, both described below. The infrastructure providers that host the site may also log technical data about each access, such as IP address, date, time and browser, for security and to keep the service running. The site also measures visits with the infrastructure provider’s analytics tool, which does not use cookies or identify you: it records aggregate data, such as the page visited, referring site, country, device type and load time. ## What is the data used for, and on what legal basis? The form data is used to respond to your request and prepare a proposal. The legal basis is carrying out preliminary procedures related to a contract, at the request of the data subject (Article 7, item V, of the LGPD): you ask for the diagnosis, and we need this data to provide it. - We do not sell your data. - We do not use the form data for advertising. - We do not send marketing communications without your consent. The visit origin category, the visit measurement and the per-IP submission limit are processed on the basis of WIP’s legitimate interest (Article 7, item IX, of the LGPD): understanding which channels and pages bring in requests and protecting the form against abuse. All three were designed not to store data that directly identifies you. ## Does the site use cookies? Yes, one first-party cookie called `wip_origem`. It stores only the origin category of your first visit and expires after 30 days. Direct visits, with no external origin, do not create the cookie. | Cookie | What it stores | Duration | | --- | --- | --- | | `wip_origem` | One origin category: search, AI assistant, social media or referral | 30 days | The cookie does not store your name, email, IP address or any unique identifier, and it is not used for advertising. If you submit the form, the category is sent along with the request, so we know which channels bring in contacts. The site does not use advertising cookies or advertising trackers, and visit measurement does not use cookies. Infrastructure and security providers may set strictly necessary technical cookies, for example to tell people apart from bots; WIP does not use these cookies to identify you. You can delete or block cookies in your browser settings. The site keeps working without `wip_origem`. ## Who is the data shared with? The data is shared only with the providers that make the site work, acting as processors: hosting, storage of requests and email delivery. They process the data on WIP’s behalf and for the purposes described in this policy. The data may also be provided to public authorities when there is a legal obligation or a court order. ## Is the data transferred outside Brazil? It may be. The cloud providers used by the site may store and process data on servers outside Brazil, which constitutes an international data transfer. This transfer takes place under the cases permitted by Article 33 of the LGPD, in particular when it is necessary to fulfill your request (Article 33, item IX, in conjunction with Article 7, item V). ## How is the data protected? - The site uses HTTPS, and the form data is encrypted in transit. - Access to the requests is restricted to the people who need them to respond. - To prevent abuse, the site limits the number of form submissions per IP address. The address itself is not stored: the site keeps only a hash (a cryptographic digest) of the IP that changes every day, which prevents linking submissions made on different days. No security measure is absolute. If a security incident occurs that may cause you significant risk or harm, WIP will notify you and Brazil’s data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD), as required by Article 48 of the LGPD. ## How long is the data kept? | Data | Retention period | | --- | --- | | Diagnosis request (form data) | 12 months after the last contact | | `wip_origem` cookie | 30 days, in your browser | | Daily IP hash | Used only on the day of submission and automatically deleted over the following days | If the request turns into a contract, the data then follows the contract and the applicable legal obligations, such as tax obligations. Once the period ends, the data is deleted or anonymized. ## What are your rights? Under the LGPD (Article 18), you may request, at any time: - confirmation that we process your data; - access to the data; - correction of incomplete, inaccurate or outdated data; - anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in noncompliance with the law; - portability of the data to another provider, in accordance with ANPD regulations; - deletion of data processed with your consent, in the cases provided for by law; - information about the public and private entities with which we share data; - information about the possibility of not giving consent and about the consequences of refusing; - revocation of consent, when consent is the basis for the processing. You may also object to processing carried out without consent if it does not comply with the law (Article 18, paragraph 2), and file a petition with the ANPD (Article 18, paragraph 1). To exercise your rights, write to [contato@workinprogress.company](mailto:contato@workinprogress.company). Requests are handled free of charge (Article 18, paragraph 5). ## Who is the data protection officer? The data protection officer (the encarregado, under the LGPD) is the person appointed by WIP to serve as the point of contact for data subjects and the ANPD (Article 41 of the LGPD). - **Data protection officer:** PENDING: name of the data protection officer. - **Contact:** [contato@workinprogress.company](mailto:contato@workinprogress.company) ## Can this policy change? Yes. When there is a material change, the new version will be published on this page, with the date of the update. ## Frequently asked questions ### Does the WIP website use cookies? Yes. The site sets a first-party cookie called wip\_origem, which stores only the category of where the visit came from (such as search, AI assistant or referral) for 30 days. It does not identify you and is not used for advertising. ### What does WIP use the diagnosis form data for? To respond to your request and prepare a proposal. The legal basis is carrying out preliminary procedures related to a contract, at the request of the data subject, under Article 7, item V, of Brazil’s data protection law (LGPD). ### Is the form data transferred outside Brazil? It may be. The cloud providers that host the site, store the requests and send emails may process data outside Brazil. The international transfer follows the cases allowed by Article 33 of Brazil’s data protection law (LGPD). ### How do I request access to, correction or deletion of my data? Write to contato@workinprogress.company stating your request. You can ask for confirmation of processing, access, correction, deletion and the other rights under Article 18 of Brazil’s data protection law (LGPD), free of charge.