Privacy Policy — Chancela
Version: 1.0 · In force since: October 21, 2026
Controller: Today Consultoria de Negócios LTDA (Gomio), CNPJ 05.017.814/0001-52, Salvador, Bahia, Brazil Data protection officer (art. 41 of the LGPD): Pedro Gomes, contato@gomio.com.br
Chancela is a Gomio product. Gomio is the brand under which Today Consultoria de Negócios LTDA (CNPJ 05.017.814/0001-52, Salvador, Brazil) offers its services. In this policy, "we" means that company.
Chancela measures whether a business shows up in the answers of AI assistants when someone asks about its category and city. This policy explains which data that involves, how long we keep it and where it goes.
1. What we process
Free audit
To run the free audit, we store what you enter in the form: the business name, the website (if any), the city, the category and the competitors you name. This is business data, not personal data.
The database does not store the IP address of whoever requests the audit. We keep only a derived code (a cryptographic digest with a secret of ours), used to limit how many audits come from the same place and to prevent abuse. That code is deleted after 2 days.
Human verification
The site's forms (the free audit form and the contact form) use Cloudflare Turnstile to check that the sender is a person and not a bot. To decide, Cloudflare receives your IP address and technical signals from your browser. We do not receive those signals; we receive only a "passed" or "did not pass" answer.
Where the visit came from
If you arrived through a link with campaign parameters (utm_source,
utm_medium, utm_campaign, utm_content) or with the video episode
identifier (ep), we store those values with the test you ran and the contact
you left. Only those five fields are accepted, each cut to 100 characters; any
other parameter in the address is discarded, including ad click identifiers
(such as gclid and fbclid). During the visit, the value stays in the
browser's session storage (sessionStorage), for this site only, and is gone
when the tab is closed. We do not use third-party cookies or another company's
tracking tool for this.
Contact left in the free test
At the end of the free test, or when it cannot finish (usage limit, full queue, lost connection), you can leave a contact so we can talk about the result. We store the WhatsApp number and/or email you type, the business name, city and category you entered, the test the request refers to, the version of the consent text you were shown and the date and time you ticked it. The consent box starts unticked: without ticking it, nothing is sent or stored.
The contact is forwarded by email to Gomio's sales team, so that someone replies. If you left an email, we send the link to the report of the test the request refers to, once, to that address.
Data about audited companies, for prospecting
Legal name, trade name, CNPJ, CNAE, size, registration status, address, municipality, website and line of business.
This is firmographic data about legal entities, taken from the public database of the Brazilian Federal Revenue Service (Receita Federal) and from the company's own website.
We do not use the shareholder register (QSA). It is data about natural persons and is outside the scope of this processing, by recorded decision.
Professional contact data
Name and professional email of whoever is responsible for the business, taken from a public source (the company's website). When you contact us, also what you write.
Service usage data
For clients: the monitored questions, the competitors named, the answers the AI engines returned and the pages they cited as sources.
Account access data
Besides the link sent by email, you can sign in with a password or with your Google account. For that we keep:
- Password: only a cryptographic digest of it (argon2id), never the text. Not even we can read it.
- Google account: when you sign in with Google, Google sends us your
Google account identifier (the
sub), your email, whether Google confirmed that email, and your name. We keep only the identifier, to recognize the same Google account on later sign-ins. The email is used to find your Chancela account and is not stored again; the name is not stored. You can unlink Google in the dashboard, under "Account security", and the identifier is deleted. - Sessions: a code derived from each open session (not the session itself), when it was opened and by which path (link, password or Google).
- Wrong password attempts: counted by a code derived from the email (not the email itself), to block for a few minutes whoever gets it wrong too often.
Security notices by email
When the account password is set or changed, or a Google account is linked or unlinked, we send a notice to the account's email, in the account's language. The notice carries a "this wasn't me" link, single-use and valid for 7 days, that ends every access to the account: open sessions, the password and the linked Google account. We keep only a code derived from that link, never the link. The notice goes out even to people who asked not to receive offer emails: it is about account security, not advertising.
Clients: weekly summary
The subscription's weekly summary goes by email, to the account's address.
Google Business Profile data
For clients who authorize us to manage their Google Business Profile: the Profile's performance numbers (views, calls, direction requests, website clicks and bookings), per month, exported from Google's interface by our team or typed from it.
The source is the client's own Google Business Profile. The data belongs to the client; we (Today Consultoria de Negócios LTDA, Gomio) process it as a processor, on the client's instructions, only for the client's report. It is shown apart from the other numbers and is never compared with another client's or shown to another client.
We also keep the proof of authorization: who ticked each consent box, when, and from which session (a code derived from it, not the session itself).
We do not keep the text, name or photo of reviewers. Rating and review count come from Google's public map, through Serper.
Payment
Signing up happens through a conversation, and Gomio issues the charge by Pix or boleto (Brazilian bank slip). The site does not collect CPF, CNPJ or card numbers.
Language preference cookie
The NEXT_LOCALE cookie stores the language you chose in the site's language
selector, for up to one year. It is written only when you choose: opening a
link in Portuguese or in English writes nothing. It is a functional cookie: it
does not identify the person, does not follow browsing outside the site and
does not feed advertising. Deleting it in the browser makes the site go back
to deciding by the language set in the browser itself.
Access cookies
The __Host-citavel_sessao cookie keeps you signed in for up to 30 days
after you sign in. The __Host-citavel_google_fluxo cookie exists only during
"Sign in with Google": for up to 10 minutes it keeps a code that ties
Google's return to the request that left this browser, and it is deleted when
Google sends you back to the site. Both are functional cookies, like the
language one: they work only on this site, do not follow browsing outside it
and do not feed advertising.
Technical logs
The operating logs of our services rotate by size: each service keeps at most three 10 MB files, and the oldest is overwritten. When an email fails to send, the log shows the address masked. The server's proxy, which receives visits before the site does, records for each access the IP address, date and time, page requested and browser. It is used for security and diagnosis. Today the proxy log has no automatic deletion: its retention period is being defined, and this policy will be updated when it is.
What we do NOT collect
CPF · credit card · data about natural persons outside their professional role · sensitive data (Art. 5, II) · device location · data about minors.
When checking third-party pages that the AI cited, our system deliberately discards the names of natural persons found on those pages: only company name, aggregate rating and review count are recorded.
2. Why we process data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Producing the audit and delivering it | Legitimate interest (Art. 7, IX) until signing up; performance of contract (Art. 7, V) afterwards |
| Professional contact by email with an offer | Legitimate interest (Art. 7, IX) — documented and filed assessment |
| Talking to you about the free test result (WhatsApp or email), forwarding your contact to the sales team and, if you left an email, sending the report link | Consent (Art. 7, I), through the unticked consent box, with date, time and text version recorded |
| Measuring which video or campaign brought each test and each contact | Legitimate interest (Art. 7, IX): first-party data, no third-party cookie, limited to five fields |
| Sending clients the weekly summary by email | Performance of contract (Art. 7, V) |
| Billing and tax invoicing | Performance of contract and legal obligation (Art. 7, II and V) |
| Managing the Google Business Profile and reporting its performance | Performance of contract (Art. 7, V), with the express consent Google's policy requires; here we act as the client's processor |
| Signing in (link, password or Google) and notifying when access changes | Performance of contract (Art. 7, V) and legitimate interest in account security |
| Security and abuse prevention, including human verification and the usage limit by IP-derived code | Legitimate interest (Art. 7, IX) |
You can object to processing based on legitimate interest at any time — see section 6. It is a request, not a negotiation: it is honored right away.
3. Who we share data with
We do not sell, rent or give away data. We share it with those needed for the service to work:
| Processor | What for | Where it processes |
|---|---|---|
| OpenRouter | Taking the questions to the AI models. Behind it, the model providers (OpenAI, Google and Perplexity) receive the question text and run the web search | USA |
| Serper | Reading the Google map: category and city and, on the paid plan, also the business name | USA |
| Cloudflare (Turnstile) | Human verification on the site's forms; receives the IP and browser signals | USA |
| Resend | Delivering emails: sign-in link, report link, security notices, weekly summary and the contact notice to the sales team | USA |
| "Sign in with Google", when you choose that path | USA | |
| Hostinger | Server that holds the site, the database and the engines' raw answers | Europe |
International transfer
Part of the processing happens outside Brazil. The transfers rely on the grounds of Art. 33 of the LGPD and are limited to what the service needs to work, under each processor's contractual clauses and security commitments.
What goes to the AI models is the question text ("what is the best pizzeria in Salvador?") and, in some steps of the paid plan, the name of the monitored company — not personal data about consumers.
4. How long we keep data
| Data | Period |
|---|---|
| Contact left in the free test, and the visit origin stored with it | 12 months from the request, deleted automatically; before that, at any time, at your request |
| Audit progress shown on screen while it runs | 7 days |
| IP-derived code used for the usage limit | 2 days |
| Free audits, the engines' raw answers and the visit origin stored with a test (no contact) | No automatic deletion today. This is business data, deleted on request |
| Clients' audits and measurement history | For the contract and 5 years after it, for historical comparison and defense in any dispute |
| Contact of whoever asked to unsubscribe | Permanently, in a suppression list — this is what keeps the deletion from being undone by a database re-import |
| Prospect contact with no reply | 12 months from the last contact |
| Linked Google account identifier | While the link exists; deleted on unlinking or by "this wasn't me" |
| Access sessions | 7 days after they expire |
| Wrong password attempts | 7 days after the last one |
| "This wasn't me" link code | 30 days after the link expires |
| Technical logs | Service logs rotate by size; the proxy log has no defined period yet (section 1, "Technical logs") |
| Tax and payment records | For the period required by tax law |
The suppression list is a deliberate exception in the data subject's favor: we keep the minimum needed (an identifier) so that we do not contact you again.
5. Security
Encryption in transit (TLS) for all communication; access restricted to those who operate the service; third-party credentials never written to debug logs — an automated check prevents it; raw answers stored separately from the main database.
No measure removes risk entirely. In case of an incident with relevant risk, we notify you and the ANPD under Art. 48.
6. Your rights
You can, at any time: confirm that processing exists · access your data · correct it · ask for anonymization, blocking or deletion · ask for portability · learn who we share it with · object to processing · withdraw consent.
How to exercise them: write to contato@gomio.com.br. We reply within 15 days.
To leave the email list: just reply to any message of ours asking to be removed. No sign-up, login or reason needed.
You can also complain directly to the ANPD, the Brazilian data protection authority (gov.br/anpd).
7. About the measurement — what it is and what it is not
This is not a disclaimer hidden in the footer; it is how the product holds up.
We query AI assistants through their API. The answer a person sees in the app can differ from the one we receive, because the app has the device's location, account memory and interface tests that the API does not. In local search this difference tends to be larger, not smaller.
That is why we hand you the literal questions to check on your own phone, we record the exact version of each model queried, and mention detection is deterministic — exact name matching, never an AI estimate.
That is also why we do not promise a position. What we promise and what we do not is in the Terms of Use.
8. Changes
Relevant changes are announced to clients by email and published at https://chancela.gomio.com.br/pt-BR/privacidade (Portuguese, binding) and https://chancela.gomio.com.br/en/privacidade (this translation), with a new version and date. Earlier versions are available on request.
This text is a convenience translation. If it differs from the Portuguese version, the Portuguese version prevails.