Tessera Privacy Policy

Tessera is a Sciensa product. The party that decides what is collected on this website, and for what purpose, is Sciensa — Sciensa Inovação e Estratégia Digital LTDA, a Brazilian limited liability company (sociedade empresária limitada) registered with the CNPJ (Brazilian National Registry of Legal Entities) under no. 16.559.315/0001-03, headquartered at Alameda Campinas, 802, 12º andar, conjunto 122, Jardim Paulista, São Paulo/SP, CEP 01404-200, Brazil. It is the controller, in the terms of the Brazilian General Data Protection Law (Law No. 13,709/2018, the LGPD).

For any privacy matter — a question, request or complaint — write to contato@sciensa.com. This is also the channel for our Data Protection Officer (encarregado): [DATA PROTECTION OFFICER NAME].

About the scope of this document. This policy describes this website's data processing under Brazilian law — the LGPD and the Brazilian Internet Civil Framework (Marco Civil da Internet). The website is read outside Brazil, and visitors from other countries are welcome: if you would like to know how these practices relate to the law where you are, or to exercise a right provided under it, write to contato@sciensa.com and we will respond.

This is a corporate website. There is no logged-in area, no purchasing and no user profile. It is intended for professionals evaluating Tessera for the company they work for, not for anyone under 18, and we do not collect sensitive personal data. We also do not make any automated decision with legal effects concerning you. Data comes from three sources.

2.1. The contact form

On the /en/contact page we ask for the fields below. We mark which ones are required because the website only submits the form when they are filled in.

• Work email — required.
• First and last name — required.
• Phone — required.
• Company — required.
• Country — required.
• Job title, industry and company size — optional.

We only accept work email addresses. Addresses from personal providers (Gmail, Hotmail, Outlook, Yahoo, iCloud and others on the same list) are rejected immediately, before anything is sent. The reason is not a judgment: the contact goes into a business-to-business sales pipeline, and a personal address does not tell us which company the person represents.

The form also has an invisible, off-screen field that no person fills in. It is a trap for spam bots: if it comes back filled in, the submission is silently discarded and nothing goes any further.

Along with what you type, we send the context of your visit — the page the form was submitted from, the first page you opened in the session, the site that brought you here (referrer), the campaign parameters in the URL (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the Google Analytics identifier, if you have accepted analytics cookies. This tells us how you found us.

Purpose: to respond to your contact request, schedule the demo and carry out the sales conversation. If you entered your email in the newsletter field in the footer before completing the form, we also record that opt-in in order to send you marketing communications — and only in that case.

2.2. Browsing analytics

With your consent, we measure browsing through Google Tag Manager (container GTM-WJMVG8LZ) and Google Analytics 4 (property G-4N3N4JD63P). The website sends four events: page view, form start, accepted submission and failed submission.

Nothing you type goes into analytics. This is a rule written into the code, not a preference: email, first name, last name, phone, company and job title are never sent to Google Analytics or Tag Manager. What is sent is visit metadata — route, page title, campaign parameters and referring site. When a submission fails, we record the error type and the message the website displayed, never what you entered.

Purpose: to understand which pages are read, where people come in and where the form gets stuck — in order to improve the website.

Measurement that does not depend on your consent. In addition to Google, we measure the website's audience and performance through Vercel itself, which hosts these pages (Web Analytics and Speed Insights). This measurement works without writing or reading anything in your browser: no cookies, no storage. What is sent is the route visited, the referring page, the campaign parameters in the URL, country, region, approximate city, browser, operating system, device type and page load times. Nothing you type is included here either — before anything is sent, the page address is trimmed and only the campaign parameters remain.

To count visits without cookies, Vercel computes a code on its own server from the request that already reaches it, using a key that changes every day; the code is discarded within 24 hours and cannot be used to recognize you tomorrow or on another website. Because Vercel is the host, it already received this data with every page you opened — including from visitors who decline cookies. What changes here is the purpose, not the recipient. If you would prefer that even this not happen, section 6 explains how to object.

2.3. Server logs

The website is hosted on Vercel, which keeps technical access logs — IP address, date and time, page requested, browser type. These logs exist on any website and serve operational and security purposes: keeping the service running and identifying abuse.

When a form submission fails, the function that receives it writes the content of the message to the error log so it is not lost and can be recovered manually. This log is deleted within the period set out in section 7.

Each use has its own legal basis under the LGPD.

Where the basis is legitimate interest, you may object at any time, as described in section 6. If your objection is to marketing communications, it is absolute: we stop, no questions asked.

We do not sell any data, and we do not share data for cross-site behavioral advertising. We share data with the providers that make the website and our response work, and only with them:

Each of these providers processes data on our instructions, as a processor (operador) under the LGPD, bound by a data processing agreement. We may also share data when required by law, or to exercise rights in judicial or administrative proceedings.

Without your consent, this website does not set any analytics cookies. Google's scripts load with consent denied by default, and in that state they neither write cookies nor send identifiers. Declining is as easy as accepting: both options appear side by side, with equal prominence, and nothing is pre-selected.

When you accept, the analytics cookies come into effect — the first two in the table, created by Google. The next two rows are not cookies and do not depend on your consent: they are the website's own storage in your browser, which never leaves it on its own. One stores your cookie choice; the other records how you arrived, starting with the first page you open.

Tag Manager does not, by itself, set cookies: it loads the tags configured in it. If any third-party tag is enabled in the future, it will be blocked by default until you consent.

The Vercel measurement described in section 2.2 does not appear in the table above because there is nothing to list: it does not set cookies, does not use your browser's storage and leaves no identifier on your device. That is why it does not depend on consent — and why declining cookies still leaves the website with no analytics cookies at all.

Changing your mind takes one click. Reopen the cookie notice and choose again: Review my cookie choices. Withdrawing consent is as easy as giving it, and does not affect what was measured before.

You can also delete or block cookies in your browser settings. The website keeps working without them.

The LGPD gives you the rights below over your data. They apply to everyone who writes to us.

• To know whether we process your data, and to access it.
• To correct inaccurate, incomplete or outdated data.
• To request deletion.
• To request anonymization or blocking of unnecessary data.
• To portability to another provider.
• To withdraw consent at any time.
• To object to processing based on legitimate interest.
• To object to marketing communications, without giving a reason.
• To know who we share data with.
• Not to be subject to automated decision-making.
• To lodge a complaint with the data protection authority — in Brazil, the ANPD (National Data Protection Authority).

To exercise any of these rights, write to contato@sciensa.com. We respond within 15 days. Before responding, we may ask for information confirming that the request is yours — this is what prevents someone else from requesting your data in your name. Exercising your rights is free of charge, and we do not treat anyone differently for having exercised a right.

We keep data for as long as the purpose that justified its collection lasts, and afterward for the period in which it may still be needed to comply with a legal obligation or defend our rights. After that, it is deleted or anonymized.

All traffic on this website is encrypted (HTTPS). Form submissions go from your browser to the website itself and only from there to Sciensa's API, so the service's internal address is never exposed to visitors. Access to the systems where contacts are stored is restricted to the team that needs it.

No system is immune to incidents. If one occurs that could pose a relevant risk to you, we will notify you and the ANPD.

Sciensa is based in Brazil, and some of our providers are outside it. When data leaves the country, the transfer has its own safeguard.

From Brazil to other countries. Vercel, Google and, depending on the account region, Pipedrive process data in the United States. These transfers rely on the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024, Annex II), incorporated into the contracts with each provider.

A copy of the applicable clauses can be requested at contato@sciensa.com.

This policy may change when the website changes. The date at the top of the page is always that of the latest version. If a change affects what we collect, we will ask for your cookie choice again — the notice reappears automatically.

Privacy questions, requests or complaints: contato@sciensa.com. To talk about Tessera, use the contact page.