Privacy notice.
What this site collects, why, for how long, and what you can demand of us. Written for what this site actually does, not from a template.
Last updated: August 9, 2026This site stores no cookies, runs no analytics and loads nothing from a third-party server. The only way we receive any data from you here is if you type it and send it.
That is not a promise: it was measured in a real browser, across every page of the site. No cookie was written, nothing was left in local storage, and every request the page made went to this site. The fonts are served from here, not from Google Fonts. No image comes from another domain.
This is an English rendering, provided so an international reader can follow the notice. Moonxi is a Brazilian company, it processes personal data under Brazilian law, and the binding text is the Portuguese one at moonxi.com.br/legal/privacidade. Where the two differ, the Portuguese governs.
Who the controller is
MOONXI LTDA, company registration (CNPJ) 57.732.288/0001-06, registered at Rua Cubatão, 86, suite 1804, São Paulo (SP), postcode 04013-000, Brazil.
Contact for anything about personal data: contato@moonxi.com.br.
The controller is whoever decides what is done with the data — the definition is in article 5, VI of the LGPD. Identifying the controller and providing a contact channel is required by article 9, III and IV.
What this site collects
Three forms and nothing else. Each one asks for the minimum the conversation it starts needs.
Name, email and whatever message you write. On /en/contato.
Name, company, approximate revenue, what you have already tried, email and WhatsApp. On /en/diagnostico. It is the form that asks for most, and it asks because the diagnostic is a fixed commercial proposal, not a generic enquiry.
The email address, and nothing else. On /en/blog.
Do not ask for or send sensitive personal data — health, biometrics, political opinion, religious belief, trade union membership, genetic data, racial or ethnic origin, sex life. That list comes from article 5, II of the LGPD. These forms are not the place for it, and we do not need any of it to talk about your project.
Server access logs
The site is served by a cloud provider. Any provider can log the IP address and the date and time of each request. If that logging is switched on, it contains personal data, because an IP address indirectly identifies a person.
Access logging is switched off. Moonxi neither collects nor keeps access logs for this site: not on the distribution that serves the pages, and not on the storage behind it. No visitor IP address enters any Moonxi database. Article 15 of the Marco Civil da Internet requires an application provider constituted as a legal entity, carrying out the activity in an organized and professional way for economic purposes, to keep application access logs for six months, and article 17 of the same law covers the option of not keeping them. Whether Moonxi must start keeping them, or may carry on without, is for the lawyers — what this page states is only today's position.
What we use it for, and under which legal basis
The LGPD only permits processing personal data under one of the grounds in article 7. These are the ones we use, and what for.
Purpose: to answer you, understand the problem and, if it makes sense for both sides, put together a proposal.
Legal basis: article 7, V — preliminary steps related to a contract, at the data subject's request. You asked for the contact; the processing exists to answer that request.
Purpose: to send one real case a month.
Legal basis: article 7, I — consent. You subscribe because you want to, and you unsubscribe whenever you want. Unsubscribing changes nothing in any commercial conversation under way.
We do not use data from this site for advertising, we do not sell lists, we do not enrich records with a data vendor, and we make no automated decisions about you.
Who the data is shared with
Nobody who is not needed for the message to reach us. Anyone processing data on the controller's behalf is a processor, in the definition in article 5, VII of the LGPD.
Moonxi's company email runs on Google Workspace. Every message that arrives at contato@moonxi.com.br passes through it.
Hosting and distribution of this site.
The forms do not go through a third-party service. What you send on /contato and /diagnostico goes straight to Moonxi's own infrastructure on AWS, which mails the content to Moonxi's inbox and stores the submission in a database in the same account. No form supplier receives that data. Scheduling is Cal.com: if you book a conversation there, whatever you type is processed by Cal.com as well, under its own policy. The data processing agreement with each supplier is an item in the legal review.
We may also share data when the law or a court order requires it. If that happens and we are allowed to tell you, we will.
International transfer
Google and Amazon Web Services run infrastructure outside Brazil, so part of the processing may happen abroad, which article 33 of the LGPD regulates.
Which ground in article 33 applies to each supplier, and the corresponding contractual safeguards: [ TO BE DEFINED ]. Naming a subsection here without the supplier contracts in hand would be a guess, and a guess in a legal document is worse than a gap.
How long it is kept
While the commercial conversation is alive. The test comes from article 15 of the LGPD, which ends processing once the purpose is met or the data is no longer necessary, with the retention cases in article 16. Retention is tied to the purpose, not to a fixed period counted from the last contact.
Until you unsubscribe. Consent may be withdrawn at any time, through a free and straightforward procedure — article 8, § 5 of the LGPD.
Not applicable: Moonxi keeps no access logs for this site, for the reason set out above. There is no retention period because there is no log.
Your rights
Article 18 of the LGPD gives you these rights over your data, at any time and at no cost.
How to exercise them
Write to contato@moonxi.com.br with "LGPD" in the subject line. It is Moonxi's channel of communication with data subjects and with the ANPD.
For confirmation that processing exists and for access to the data, we answer in simplified form immediately, or with a full statement within 15 days — both deadlines come from article 19 of the LGPD. Every other request is answered on the same channel.
To answer, we may need to confirm you are you. That confirmation uses the minimum necessary and is used for nothing else.
Data protection officer: Moonxi does not appoint one. Article 41 of the LGPD requires the controller to appoint an officer and publish their contact details, and article 11 of ANPD Resolution nº 2/2022 waives that appointment for small-scale processing agents, provided a channel of communication with the data subject exists. Moonxi relies on that waiver, and the channel is the one given above: contato@moonxi.com.br, with "LGPD" in the subject line. Whether Moonxi qualifies as a small-scale agent is confirmed in the legal review together with the accountant — the channel exists and answers regardless of that confirmation.
Security
The site's pages are static, with no login and no logged-in area, and are served over HTTPS only. Form submissions are stored in a database inside Moonxi's own AWS account, with restricted access. Messages from the forms live in Moonxi's email accounts and tools, with access restricted to the people who need it. No measure removes risk: if a significant security incident happens, we notify the people affected and the ANPD, as the LGPD requires.
Complaining to the ANPD
If you believe Moonxi has handled your data wrongly, talk to us first — it is faster. You can also petition the Brazilian data protection authority directly, which article 18, § 1 of the LGPD guarantees. The ANPD became a regulatory agency under Law 15.352 of February 25, 2026.
Changes to this notice
When this text changes, the date at the top changes with it. If a change alters the purpose of any processing carried out with your consent, we tell you beforehand, as article 9, § 2 of the LGPD requires.
A question about your data?
One email settles it. The same person who reads the commercial mail reads this.