We use Google Analytics 4 and Google Ads, from Google, and SYNQi³, the ATUO group intelligence platform. They tell us which content is useful and whether one of our ads led to a contact. With your consent, the ad click identifier travels with the contact you send, and nothing beyond it. Without it, Google measures without a cookie and SYNQi³ only receives a form you send yourself. No remarketing, no custom audiences and no ad personalization, in any case. Read the policy
This document explains how we handle data, protect information, and preserve ecosystem integrity.
ATUO, Code and Soul, and SYNQi³ operate with responsibility, precision, and ethics in how we collect, use, and protect data. Privacy is not a technical requirement: it is a principle of engineering, experience, and trust. This policy describes how we handle personal and corporate information within the ecosystem.
The processing described in this policy is carried out by Code and Soul LTDA, based in Itapetininga, São Paulo, Brazil, and by Code and Soul LLC, in the United States. Both are part of the ATUO group.
This section exists because the site asks for your consent to measure navigation, and consent is given to someone. Without the legal entity named, you would have no one to address to access, correct, export or erase your data, or to withdraw what you accepted.
To exercise any of these rights, write to legal@codeandsoul.com or privacy@atuo.com.br. We answer through the same channel.
Navigation data, including analytics, events, metrics, and interaction patterns with our products and services.
Voluntarily provided data, information submitted through contact forms, onboarding processes, and direct communications.
Technical metadata, system logs, requests, telemetry, and diagnostic information necessary for operation and continuous improvement.
Operational data, information required for SYNQi³ platform operation and integrated environments, including configurations, preferences, and system states.
This site uses three tools: Google Analytics 4 and Google Ads, both from Google LLC, and SYNQi³, the intelligence platform of the ATUO group itself. Google Ads is there for one reason only: to know whether one of our ads led to a contact, and what that contact became afterwards. We do no remarketing, we build no custom audiences, we record no sessions and no heatmaps.
Google Analytics 4 and Google Ads write cookies in your browser. From Google Ads only the record that a form submission happened leaves this site, without what you wrote in it: your name, email, company and message go to SYNQi³ and not to the advertising platform. With your acceptance, the personal-data-for-advertising key becomes granted, and it is what authorises the click identifier to travel with the conversion. The ad-personalization key stays denied in every case, including after acceptance: we build no audiences, we do no remarketing, and enhanced conversions, which would send your email or phone to Google, stay off. SYNQi³ writes no cookie at all: it keeps an anonymous visitor identifier and a session identifier in local storage, and records pages viewed, clicks, scrolling and time on page.
If you accepted measurement and arrived through one of our ads, the click identifier (the gclid, gbraid or wbraid parameters Google puts in the address) and the campaign parameters (the UTMs) are associated with the contact you send. They serve one purpose: when that contact becomes something (a scheduled conversation, an opportunity, a customer), we report that outcome to Google Ads, and we report it by that identifier alone. Your name, your email, your company and your message do not go, nor anything derived from them. The identifier does not say who you are, it says which click that was. If you did not accept measurement, no click identifier is associated with your contact.
Navigation measurement is pseudonymous. When you fill in a form, what you typed travels with that submission; your browsing before and after stays tied only to the anonymous identifier. We do not associate your browsing trail with the email you gave us.
If your browser sends the Global Privacy Control signal, or Do Not Track, SYNQi³ measures nothing and writes no identifier.
Submitting a form is a different matter, and it does not depend on your acceptance. Measuring your browsing is something we do to whoever passes by; pressing send is you asking us for contact. So what you typed is delivered through SYNQi³ either way, because that is the path by which the message reaches us. When you have not accepted measurement, that submission writes nothing in your browser and creates no profile. It carries what you wrote and the address of the page you were on, without the campaign parameters at the end of the address, because that page is what says what your request is about. It carries no referrer and no browser data. The legal basis here is your own request (art. 7, V of the Brazilian LGPD, preliminary procedures at the data subject request), and it holds the same if you declined measurement or if your browser sends Global Privacy Control.
The legal basis for measurement is your consent (art. 7, I of the Brazilian LGPD), asked on your first visit. Until you accept, Google measures without writing a cookie and SYNQi³ only receives a form you submit. You can change your mind at any time through the Consent link in the footer: the choice is erased, measurement stops immediately without reloading the page, and the SYNQi³ identifiers and Google cookies are removed from your browser. Nothing the site offers stops working if you decline.
Google data is processed under its own policy. SYNQi³ data is processed on the platform AWS infrastructure, in the United States.
To improve products, digital experiences, and the quality of delivered services.
To train intelligence models and calibrate contextual rules in the SYNQi³ ecosystem, always respecting privacy and governance boundaries.
For secure personalization, guided by behavior and declared preferences.
For operational communication when explicitly authorized by the user.
For abuse prevention, system security, and ecosystem integrity monitoring.
We never sell, rent, or commercialize data. We share only when strictly necessary for ecosystem operation, with infrastructure partners, cloud providers, operational tools, and previously authorized integrations.
We apply encryption in transit and at rest for sensitive data protection.
We maintain governance policies and access controls based on least privilege principle.
Audit logs are kept for traceability and compliance.
Anti-abuse mechanisms and continuous monitoring protect ecosystem integrity.
Engineering best practices are applied throughout the development and operation cycle.
Access your personal data maintained in our systems.
Request correction of incorrect or outdated information.
Request data deletion when applicable and permitted by law.
Revoke previously granted consents.
Export your data in portable format when technically feasible.
Data is retained only as long as necessary for the purposes described in this policy, or as required by legal, regulatory, or contractual obligations. After this period, information is anonymized or securely deleted.
This policy may be revised periodically to reflect changes in our practices, technologies, or legal requirements. We will communicate significant changes through appropriate channels.
For questions about privacy, data use, or governance, please contact: