privacy.

The data controller for this tool is Rosa Opaco, under the responsibility of Carl Theodor Dreyer, reachable at contact@rosaopaco.com.br. This Policy follows Brazil's General Data Protection Law (Law 13,709/2018, "LGPD").

To understand how the calculator is used, we record a few events:

• Visit to the page, with date, language and page;
• Simulation: selected country, message volumes, category split, currency and estimated cost;
• Report generated, with the same simulation data;
• CSV list loaded: only the number of contacts and countries. The file content never leaves your browser.

With each event we store the country of access, provided by our hosting based on your connection, and the visit source: the link's campaign parameters (UTM, such as "utm_source=instagram") and only the domain of the site you came from (for example, "google.com").

Without your consent, we do not store your IP address or any identifier, and nothing is saved in your browser, so these records cannot tell who you are.

If you click "Accept" on the privacy notice, we also keep:

• a random visitor ID, created and stored in your browser, to recognize repeat visits;
• your IP address and browser type;
• the full address of the page you came from;
• ad click IDs, when present: Meta (fbclid), Google (gclid) and TikTok (ttclid);
• the source of your first and most recent visit (campaign and domain), to understand what brought you and what brought you back.

We use this data to understand where visitors come from and, in the future, to measure and optimize marketing campaigns, which may include sending it to advertising platforms such as Meta (Facebook and Instagram). Today no data is sent to advertising platforms. Before we start, we will update this Policy.

If you click "Decline", none of this is stored. You can change your choice at any time using the "Privacy preferences" link in the calculator footer.

The values you type (volumes, budget, order value, conversion and tax rates) stay in your browser's memory and are only recorded in the summarized form described in section 2. The CSV file is processed locally: no row is transmitted or stored. Only the country column (country_code) is used; all other columns are ignored.

We do not use cookies. We keep your privacy choice in your browser's local storage (localStorage) and, only if you accept, the visitor ID and the source of your first and latest visit.

• Hosting (Vercel Inc.): processes IP, date, page and browser to serve the site and protect it from abuse, and provides the country of access.
• Database (Supabase Inc.): stores the events described in sections 2 and 3.
• Fonts (Google Fonts) and flags (jsDelivr): your browser downloads these files directly from these services, which receive your IP address and browser data.
• Exchange rate (frankfurter.dev): fetched by our server without sending any of your data.

These providers' servers may be located outside Brazil. Such transfers take place to deliver the service (LGPD art. 33), and each provider follows its own privacy policy. We do not sell personal data.

• Anonymous usage data, campaign source and hosting technical data: legitimate interest in running and improving the tool (LGPD art. 7, IX).
• Identification and visit source data: your consent (LGPD art. 7, I), which you may withdraw at any time.

Identifiers (IP, browser, visitor ID, source address, ad click IDs and first-visit source) are deleted automatically after 12 months. Usage events, including UTMs and source domain, are deleted after 24 months. Hosting logs follow the period set by Vercel.

Under the LGPD (art. 18), and similar laws such as the GDPR, you may request confirmation of processing, access, correction, anonymization, deletion, information about sharing and withdrawal of consent, among other rights. To withdraw consent, use "Privacy preferences" in the footer. For other requests, write to contact@rosaopaco.com.br. You may also file a complaint with Brazil's National Data Protection Authority (ANPD) or the authority in your country.

The page is served over an encrypted connection (HTTPS), and the database can only be accessed by our server. Since your contact list never leaves your device, keeping the file safe also depends on the security of your computer and browser.

This Policy may be updated, for example when we start sending data to advertising platforms. The date at the top shows the current version.