B2B Infrastructure Services — Privacy Policy

1. Data We Collect

When you submit a quote request through the Infra Builder, we collect:

• Contact information: your name, email address, and optionally your studio name and website.
• Quote content: selected services, configurations, custom field inputs, preferred currency, and maintenance period.
• Technical metadata: IP address hash (anonymized), user agent, submission timestamp, and locale preference.
• Attribution data: referral parameter (e.g., from QR codes or campaign links).

2. How We Use Your Data

• To process and respond to your quote request.
• To send you the quote confirmation email and any follow-up communications related to your request.
• To create a shareable quote URL for your reference.
• For internal CRM management and business analytics.
• To detect and prevent abuse (rate limiting, honeypot verification).

3. Third-Party Processors

Your data may be processed by the following third-party services:

• Supabase (database hosting) — stores quote data. Servers in the US.
• Brevo (transactional email) — sends confirmation and response emails.
• Twenty CRM (self-hosted) — manages client relationships and opportunities.
• Discord (webhooks) — internal notifications only; no personal data is shared in public channels.
• Upstash (rate limiting) — processes anonymized request identifiers.

4. Data Retention

• Quote data is retained for 2 years from the date of submission, or until the associated business relationship concludes, whichever is later.
• Expired quotes (not responded to within 30 days) are retained for analytics but marked as expired.
• You may request deletion of your data at any time (see Section 6).

5. Cookies

The Infra Builder uses a single HTTP-only session cookie (mib_quote_session) to facilitate the post-submission redirect flow. This cookie is cleared immediately after use and does not track you across sessions.

6. Your Rights

Under the LGPD (Brazil) and GDPR (EU), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict processing.
• Request data portability.

To exercise any of these rights, contact us at hello@madeinbugs.com.br. We will respond within 15 business days.

7. Security

We implement appropriate technical measures to protect your data, including HMAC-signed URLs, encrypted database connections, and server-side-only access to sensitive operations.

8. Contact

Data controller: Made in Bugs
Contact: hello@madeinbugs.com.br