Last updated:
Privacy Policy
Vestígio — Digital Investigation
This Privacy Policy explains clearly what personal data Vestígio processes, for what purposes, with whom it may be shared, how long it is kept and what your rights are. It was drafted in accordance with Brazil’s General Data Protection Law (LGPD — Lei nº 13.709/2018), the Brazilian Internet Civil Rights Framework (Marco Civil da Internet — Lei nº 12.965/2014) and Lei nº 13.432/2017, which regulates private investigation in Brazil.
By browsing this site or contacting Vestígio, you acknowledge that you are aware of the practices described below.
01Who is responsible for your data
A Vestígio, operating in Recife (Pernambuco) and serving clients across Brazil, is the controller of the personal data processed through its website and its digital investigation services.
Privacy channel (Data Protection Officer): contato@
This is the official channel for questions, requests and complaints about personal data.
Back to top02Who this policy applies to
This policy applies to:
- Visitors to the site;
- People who contact Vestígio by WhatsApp, email or social media;
- Clients, individuals or companies, who hire our services;
- Third parties whose data may be processed during a commissioned investigation.
03What data we process
3.1. When you browse the site
The site has no forms and does not collect personal data directly. Even so, some technical data is generated automatically just by browsing:
- Access logs: IP address, date and time of access, browser and operating system. These logs are processed by our hosting provider to keep the site running and secure.
- Theme and language preferences: your choice of light or dark theme and of language is saved only in your own browser and is not sent to Vestígio.
3.2. When you contact us
When you reach us by WhatsApp, email or social media, we process the data you choose to send us, such as:
- name, phone number and email;
- a description of the situation or case;
- documents, screenshots, receipts, links and other files you share.
3.3. When you hire a service
To formalize and provide the service, we may process:
- the client’s identification and contact details (name, CPF or CNPJ — Brazilian individual or company taxpayer ID, address, phone number and email);
- data needed for the contract, billing and issuing tax documents;
- information and materials provided by the client about the case;
- records of communications related to the service.
3.4. During the investigation
The nature of the investigation service may involve processing data of third parties related to the case (for example, the person or profile being investigated). This data is obtained exclusively by lawful means, such as open and public sources, information provided by the client and lawfully accessible records, and processed only to the extent needed for the purpose of the case.
Back to top04What we use the data for, and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Replying to contacts and questions and preparing quotes | Pre-contractual steps at the data subject’s request (art. 7, V) |
| Entering into and performing the service contract | Performance of a contract (art. 7, V) |
| Carrying out the commissioned investigation and preparing the report | Regular exercise of rights in judicial, administrative or arbitration proceedings (art. 7, VI) and legitimate interest (art. 7, IX) |
| Meeting tax, accounting and legal obligations | Compliance with a legal or regulatory obligation (art. 7, II) |
| Keeping the site secure and running | Legitimate interest (art. 7, IX) |
| Defending Vestígio in any legal proceedings | Regular exercise of rights (art. 7, VI) |
Whenever we rely on legitimate interest, we assess whether the processing is necessary, proportionate and compatible with the rights and expectations of the data subjects involved.
Back to top05Sensitive personal data
In some cases, the information sent by the client or related to the investigation may contain sensitive data, such as health data, racial or ethnic origin, religious beliefs or sex life. This data is processed only when strictly necessary for the case and on the grounds set out in art. 11 of the LGPD, mainly the regular exercise of rights. We recommend that you send only the information that is truly relevant to your case.
Back to top06Who we share the data with
Vestígio does not sell, rent or trade personal data. Data is shared only when necessary, in the following situations:
- Essential service providers: website hosting, email, messaging apps, cloud storage and accounting, which process the data only to enable our operations;
- The client’s lawyers or legal partners, when authorized by the client or necessary for the case;
- Public authorities, such as the police, the Public Prosecutor’s Office (Ministério Público) and the courts, upon a lawful request or court order, or when the client chooses to use the report to file a police report or support a lawsuit;
- Defense of rights, when necessary to protect Vestígio in judicial, administrative or arbitration proceedings.
Investigation reports are delivered exclusively to the client who commissioned them or to whomever the client formally designates.
Back to top07International data transfers
Some tools we use, such as email, messaging and hosting services, may store data on servers located outside Brazil. In those cases, the transfer takes place in accordance with art. 33 of the LGPD, with providers that adopt adequate data protection standards.
Back to top08How long we keep the data
Data is kept only for as long as necessary for the purposes described in this policy:
- Contacts that do not lead to a contract: deleted within 6 months of the last contact;
- Client data and case materials: kept while the service is provided and, after it ends, for the period needed to meet legal obligations and for the regular exercise of rights, as a rule up to 5 years;
- Tax and accounting documents: for the period required by tax law;
- Site access logs: for the period set by the hosting provider and by the Marco Civil da Internet (Brazilian Internet Civil Rights Framework).
At the end of these periods, the data is securely deleted or anonymized.
Back to top09How we protect the data
We adopt technical and administrative measures to protect the data against unauthorized access, loss, alteration or improper disclosure, including:
- access to the data restricted to the people involved in the service;
- a duty of professional confidentiality over all case information, under Lei nº 13.432/2017;
- two-factor authentication and strong passwords on the accounts the company uses;
- protected storage of case materials;
- a secure connection (HTTPS) across the whole site.
No system is completely immune to incidents. If a security incident occurs that may create a significant risk or harm to data subjects, Vestígio will notify those affected and the ANPD (Brazil’s National Data Protection Authority), as required by law.
Back to top10Our ethical commitments
Vestígio operates within the law. That is why:
- we do not hack accounts, devices, systems or networks, nor do we carry out any unauthorized access;
- we do not intercept private communications;
- we do not obtain data through fraud, deception or breach of legally protected confidentiality;
- we never ask for passwords, verification codes or access to your accounts.
If anyone contacts you on behalf of Vestígio asking for this kind of information, do not reply and let us know through the official channel.
Back to top11Cookies and similar technologies
This site does not use advertising cookies or tracking tools to build visitor profiles. Only the following are used:
- the browser’s local storage, to remember your light or dark theme preference and your language;
- strictly necessary cookies that the hosting provider may use to protect the site against attacks and automated access.
You can clear or block this data in your browser settings; the only effect is that the site may forget your theme and language preferences.
Back to top12Your rights as a data subject
Under art. 18 of the LGPD, you may request at any time:
- confirmation that we process your data;
- access to the data we hold about you;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
- portability of the data to another provider, where applicable;
- deletion of data processed based on your consent;
- information about who your data has been shared with;
- review of decisions made solely on the basis of automated processing;
- objection to processing carried out in breach of the law.
Some requests may be limited when there is a legal obligation to retain data, a need for the regular exercise of rights or a duty of confidentiality toward third parties and the client.
Back to top13How to exercise your rights
Send your request to contato@
We respond to requests within 15 days, in accordance with the LGPD. If you are not satisfied with the response, you can also file a complaint with the ANPD (Brazil’s National Data Protection Authority) through the website gov.br/anpd.
Back to top14Children and teenagers
Vestígio’s services are hired by people aged 18 or over or by companies. Data about children and teenagers is processed only when necessary for a case, always in their best interest and with the involvement of at least one parent or legal guardian, in accordance with art. 14 of the LGPD.
Back to top15Links to other websites
The site may contain links to third-party services, such as WhatsApp and Instagram. When you access them, you are subject to those platforms’ privacy policies, for which Vestígio is not responsible.
Back to top16Changes to this policy
This policy may be updated to reflect changes in our services or in the law. The date of the last update will always be shown at the top of this document. We recommend checking this page from time to time.
Back to top17Contact
Questions about this policy or about how your data is processed:
- contato@
vestigio.app.br - @vestigio.br
- Where we operate
- Recife (Pernambuco), serving clients across Brazil