Privacy
Your data stays yours.
What we collect on this site, what we do with it, and how we handle client data in our projects.
This policy explains how Extrace treats personal data in two places: on this website, and in the projects we run for clients. We wrote it to be read, so it is short and specific.
Who we are
Extrace is the trade name of 21X Ventures Consultoria em TI Ltda., CNPJ 66.894.941/0001-24, with offices in Rio de Janeiro and São Paulo, Brazil. For the data described here, we are the controller under Brazil's General Data Protection Law (Lei 13.709/2018, the LGPD).
What we collect on this site
- The contact form: your name, work email, company, where you would like to start and your message. Nothing else is sent.
- Emails you send us, at hello@extrace.ai or hiring@extrace.ai, including any CV you attach.
- Your browser keeps two small preferences on your own device: the language you chose, and where you were on the page so a reload returns you there. They never reach us.
We do not use advertising or analytics cookies, and we do not track you across other sites.
Why we use it
- To reply to your message and prepare a first conversation. The legal basis is the steps you asked for before a possible contract (LGPD, art. 7, V) and our legitimate interest in answering you (art. 7, IX).
- To assess job applications. We use a CV only for hiring at Extrace.
We do not sell personal data, and we do not use it to train AI models.
Who processes it with us
The site is served by Cloudflare. The contact form goes to our own server and reaches us as an email in hello@extrace.ai, through our email provider. These providers act on our instructions, and some of them may process data outside Brazil, under the safeguards the LGPD requires for international transfers (art. 33).
How long we keep it
We keep contact messages while the conversation or the business relationship lasts, and applications while the hiring process they belong to is open. After that, or earlier if you ask, we delete them, except where the law requires us to keep a record.
Client data in our projects
When we work inside a client's business, the client's data is governed by our contract, and these practices apply to every project:
- We sign an NDA before the discovery starts.
- What we build runs in the client's own cloud or tenant, and the data does not leave it.
- We use AI models through APIs under enterprise terms that rule out training on the client's data.
- Access is set by role, every step an agent takes is logged, and a person approves before anything goes out.
- We work within the LGPD and sign a data processing agreement (DPA) when the client asks for one.
- When the engagement ends, we delete the client's data from our environments.
Your rights
Under article 18 of the LGPD you can ask us to confirm whether we hold data about you, see it, correct it, have it deleted or anonymized, take a copy to another provider, learn who we shared it with, and withdraw a consent you gave. Write to hello@extrace.ai and we will answer within 15 days. You can also complain to the ANPD, Brazil's data protection authority.
Changes
If we change how we treat data, we will update this page and the date at the top.