This policy explains what personal data KISS processes when you visit this website, request a proposal, talk to us or authorise our reporting app to read data from your Google account. It follows Brazil's General Data Protection Law (LGPD) and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The controller is KISS, a brand operated under Brazilian CNPJ no. 64.855.834/0001-61. KISS decides how data from this website, proposal requests and its own business relationships is processed.
Privacy questions and requests: privacidade@keepitsimplestupid.com.br. Sales and support: contato@keepitsimplestupid.com.br.
2. What data we process
- Proposal requests: name and email (required), WhatsApp, service of interest and message (optional). Without name and email we cannot reply through the form.
- Support: whatever you send us by email or WhatsApp, such as phone number, profile name and messages.
- Contracts: representative and contact details, company and tax information, proposals, agreements, invoices and support history.
- Technical operation: logs generated by our hosting provider to deliver and protect the site, such as IP address, date and time, page accessed, browser and errors.
- Data from clients’ Google accounts, only when a client authorises our reporting app (see section 6).
Data comes from you, from whoever represents your company in a negotiation, from your browser and from the providers listed below. We do not ask for sensitive data in the form. Do not send passwords, bank details or customer databases through it: if a project needs that, we agree on an appropriate channel.
3. Why we use it and on what legal basis
Each use has its own legal basis. There is no blanket authorisation.
| Use | Purpose | LGPD | GDPR, where applicable |
|---|---|---|---|
| Proposal you request | Reply and prepare the requested proposal | Pre-contractual steps (art. 7(V)) | Art. 6(1)(b) |
| Contact with a company representative | Talk to the company and negotiate services | Legitimate interests (arts. 7(IX) and 10) | Art. 6(1)(f) |
| Performing a contract | Deliver and manage contracted services | Performance of contract (art. 7(V)) | Art. 6(1)(b) |
| Legal obligations | Meet tax, accounting and lawful orders | Legal obligation (art. 7(II)) | Art. 6(1)(c), where the obligation is recognised under EU or Member State law |
| Security and abuse prevention | Protect the site, systems and people | Legitimate interests | Art. 6(1)(f) |
| Legal claims | Keep evidence and respond to claims | Exercise of rights (art. 7(VI)) | Art. 6(1)(f) |
| Optional marketing and measurement | Send news you chose, measure visits and campaigns | Consent (art. 7(I)) | Art. 6(1)(a) |
Where we rely on legitimate interests, we assess necessity, your reasonable expectations and safeguards, and you may object where the law allows.
Requesting a proposal does not subscribe you to any promotional list. You may refuse or withdraw consent at any time, without affecting processing carried out before withdrawal.
6. Google account data (KISS - Painel de Clientes app)
KISS operates an app called KISS - Painel de Clientes, used to track our clients’ digital performance. When a client authorises this app, they give us access to data from their own Google account, only for the accounts they choose:
| Source | What we read | Permission |
|---|---|---|
| Google Search Console | Search performance of the site: queries, clicks, impressions and position | Read only |
| Google Analytics 4 | Traffic and on-site behaviour reports | Read only |
| Google Business Profile | Business profile information and performance | Manage |
We do not access email, calendar, contacts, files or any other Google account data outside the products above.
How we use it: to build reports and track the client’s own results, and to guide the work they hired us for. Nothing else. We do not use this data for advertising, we do not sell or rent it, and we do not train artificial intelligence models with it.
Where we store it: we store only the access credential, on KISS equipment with access restricted to our team. Performance data is read when a report is generated and is not stored in any database of ours.
Who we share it with: no one. This data does not leave KISS and is not passed to third parties, partners or external tools.
How to revoke: a client can remove access at any time, without contacting us, at https://myaccount.google.com/permissions by removing the "KISS - Painel de Clientes" app. To request deletion of the stored credential, write to privacidade@keepitsimplestupid.com.br.
Limited Use: KISS’s use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
7. International transfers
Some providers, such as Vercel and Resend, process data in the United States. For these transfers we use the mechanisms provided by the LGPD and ANPD regulations and, for flows subject to the GDPR, the mechanisms in its Chapter V, such as the standard contractual clauses offered by these providers. You may ask for information about these safeguards through our privacy contact.
8. How long we keep it
We keep data only as long as necessary. After that, we delete or anonymise it.
| Data | Period |
|---|---|
| Proposal request without a contract | Up to 24 months after the last contact |
| Contracts, invoices and tax documents | For the relationship and the legal period for each document, including for legal claims |
| Marketing | Until you withdraw consent or after 24 months without interaction, whichever comes first |
| Hosting technical logs | For the hosting provider’s retention period, unless needed to investigate an incident |
| Reporting app credential | Until the client revokes access, ends the contract or asks for deletion |
If a legal obligation prevents immediate deletion, we explain why and limit use to the purpose that justifies keeping it.
9. Your rights
Under the LGPD you may request: confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, portability, information about who we share it with, information about the option not to consent, withdrawal of consent and deletion of data processed on that basis. You may also object to processing where the law allows and request review of decisions made solely by automated means.
Where the GDPR applies, you have the rights of access, rectification, erasure, restriction, portability, objection (including to direct marketing) and withdrawal of consent.
To exercise any right, write to privacidade@keepitsimplestupid.com.br stating your request and a reply contact. We will only ask for what is needed to confirm your identity. Requests are free of charge.
Under the LGPD, confirmation and access are answered immediately in simplified form or through a full statement within 15 days. Under the GDPR, we reply without undue delay and normally within one month. If we refuse a request, we explain why.
You may also complain to Brazil’s ANPD (https://www.gov.br/anpd/) or to the data protection authority of your country in Europe (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en).
10. Security
We apply risk-appropriate measures: the whole site runs over HTTPS, the form validates and cleans the data it receives, access keys are kept out of the code and access to data is restricted to the team members who need it. No system is immune to incidents. If an incident requires notification, we will inform authorities and affected people within the legal deadlines.
Suspect a problem? Write to privacidade@keepitsimplestupid.com.br.
11. Artificial intelligence and automated decisions
We do not use artificial intelligence to analyse, classify or answer data sent through this website’s form. Requests are handled by our team. We do not make solely automated decisions with legal or similarly significant effects on you.
When we process data on behalf of a client, in CRM, media, software or automation projects, we act as processor under the project agreement, and the client’s own privacy policy governs that data.
12. Children
This website presents professional services and is not directed at children. We do not knowingly collect children’s data. If that happens, contact us through our privacy channel.
13. Other countries
KISS serves clients in Brazil, the United States and Europe. This list does not limit your rights.
United Kingdom: where applicable, we follow the UK GDPR and the Data Protection Act 2018; you may complain to the ICO (https://ico.org.uk/). Switzerland: where applicable, we follow the Federal Act on Data Protection (FADP); the authority is the FDPIC (https://www.edoeb.admin.ch/en).
United States: rights vary by state of residence and may include access, correction, deletion, portability and opting out of the sale or sharing of data for advertising. To exercise them, use our privacy contact; if we refuse, you may appeal through the same channel with the subject "Privacy appeal".
14. Changes
We update this policy when our processing or the law changes, always with the new date at the top. Material changes will be communicated. A new version does not, on its own, authorise uses that require your consent.
15. Contact
Privacy and rights requests: privacidade@keepitsimplestupid.com.br. Sales and support: contato@keepitsimplestupid.com.br. KISS, CNPJ no. 64.855.834/0001-61.