Privacy Policy

1. Who controls your data

For website visitors and people who contact or book a discovery call with us, the controller is Ailton Moreira, trading as Morabeza Services.

Legal name: Ailton Moreira, trading as Morabeza Services (personal brand)
Registered address: Braga, Portugal
Tax ID (NIF): provided on invoices / recibos verdes only (not published on this site)
Privacy contact email: privacy@morabeza-services.com

When we run an AI revenue system or ads work that processes your customers’ personal data on your instructions, you are typically the controller and Morabeza acts as a processor (see Section 8).

2. Scope

This Policy applies to:

• browsing morabeza.services (or the domain where this site is hosted);
• submitting the multi-step contact form;
• booking a time via Calendly from the contact flow;
• emails we send about your enquiry or engagement;
• personal data processed while delivering ads management or SMB AI revenue systems under a client agreement.

It does not replace the privacy policies of third-party platforms (Google, Meta, Calendly, Resend, etc.).

3. Personal data we collect

3.1 Contact form

When you use our contact form we may process:

• name and email (required);
• phone and company / business name (optional);
• service interest (ads, AI systems, both, or discovery);
• message / description of your revenue leak (optional, or required for “message only”);
• consent confirmation that we may contact you about the enquiry;
• locale preference associated with your session (for example en or pt);
• intent (book a call vs send a message only);
• technical security signals from Google reCAPTCHA v3 (token / score verification on our server—we do not store the raw token long-term beyond processing the request).

3.2 Calendly booking

If you continue to book a slot, Calendly may collect your name, email, selected time, timezone, and any answers you provide in Calendly questions (we prefill name, email, company, phone, service focus, message, and a booking-context summary where possible). That data is also processed under Calendly’s terms and privacy policy.

3.3 Email

If email delivery is configured, we may send a notification to our inbox (with reply-to set to your email) and an optional confirmation to you via our email provider (Resend).

3.4 Automatically collected technical data

• standard server / hosting logs that our host (for example Vercel) may generate (IP address, user agent, timestamps, request URLs);
• the NEXT_LOCALE cookie used to remember English or Portuguese;
• reCAPTCHA-related data processed by Google as described in Google’s privacy documentation.

3.5 Vercel Web Analytics (opt-in)

If you accept the Analytics cookie category, we load Vercel Web Analytics to measure aggregated page views and usage on this site. It is first-party via our Vercel host. It does not load when Analytics consent is off. We do not operate advertising pixels such as Google Analytics or Meta Pixel on this site.

4. Purposes of processing

• respond to enquiries and schedule discovery or service calls;
• prepare for meetings using the service and notes you share;
• send transactional email about your enquiry;
• secure the website and reduce spam/abuse (reCAPTCHA);
• remember your language preference;
• measure aggregated website usage when you opt into Analytics (Vercel Web Analytics);
• perform contracted services (ads stewardship, AI system configuration and monthly care);
• comply with legal obligations and defend our legal rights.

5. Legal bases (GDPR-friendly framing)

Where the EU/EEA GDPR or similar laws apply, we rely on:

• Consent — for example when you tick the contact consent box and submit the form, and for optional confirmation emails where consent is the appropriate basis;
• Contract / pre-contract steps — when you request a quote, book a call, or engage us to deliver services;
• Legitimate interests — securing the site, preventing fraud/spam, improving service reliability, and basic business communications related to an existing enquiry, balanced against your rights;
• Legal obligation — where we must keep records for tax, accounting, or regulatory reasons.

You may withdraw consent where processing is consent-based, without affecting prior lawful processing.

6. Cookies and similar technologies

We use a small set of cookies and similar technologies as described in our full Cookie Policy. In summary:

• NEXT_LOCALE — necessary first-party cookie for language (en / pt);
• morabeza_cookie_consent — necessary first-party cookie storing your consent choice (including Functional and Analytics), version, and date;
• Google reCAPTCHA — Functional; may set cookies when the contact form loads the script after you accept Functional cookies;
• Calendly — Functional; may set cookies when the booking embed loads after Functional consent;
• Vercel Web Analytics — Analytics; loads only after Analytics consent for aggregated page views / usage;
• Theme preference — stored in localStorage (morabeza-theme), not as a cookie.

We do not run advertising or marketing pixels. You can change Functional and Analytics choices via Cookie settings in the site footer, or through your browser. Details, inventory table, and withdrawal instructions: Cookie Policy (Portuguese: /cookies.pt.html).

7. Processors and third parties

We use trusted providers to operate the site and services:

• Vercel — website hosting, delivery, and (with Analytics consent) Web Analytics;
• Resend — transactional email delivery (when configured);
• Google — reCAPTCHA v3 for abuse prevention;
• Calendly — appointment scheduling;
• Advertising platforms (for example Google Ads, Meta) — when you engage us for ads management, you typically remain the account owner/controller of campaign and pixel data; we act under your authorisation.

These providers process data under their own terms and, where applicable, data processing agreements. We do not sell your personal data.

8. When you are the controller (client customer data)

If an AI revenue system or related workflow processes personal data about your customers or leads (lists, WhatsApp contacts, booking records, invoices metadata, etc.):

• you warrant that you have a lawful basis to collect and share that data with us;
• you act as controller;
• we act as processor and will process only on documented instructions in the SOW / DPA;
• we will not use your customer lists for our own marketing;
• sub-processors needed to run the system (hosting, messaging APIs, model providers) will be disclosed in the SOW or DPA where required.

9. Retention

• Contact / lead records — kept as long as needed to handle your enquiry and for a reasonable follow-up period, then deleted or archived according to our retention practice (typically up to 24 months for inactive leads unless a longer period is needed for an active engagement or legal claim).
• Contract and billing records — retained for the engagement and as required by accounting/tax law.
• Server logs — retained according to our host’s defaults, usually for a short operational window.
• Calendly events — retained under your Calendly / our Calendly account settings.

10. Security

We use reasonable technical and organisational measures appropriate to the risk, including HTTPS, access-limited environments, reCAPTCHA on public forms, and least-privilege access to client accounts. No method of transmission or storage is 100% secure; please use strong unique passwords for any accounts you share access to.

11. International transfers

Our providers may process data in the EU, United States, or other countries. Where GDPR applies and data leaves the EEA/UK, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses offered by those providers, together with transfer impact assessments where required.

12. Your rights

Depending on applicable law (including GDPR), you may have the right to:

• access your personal data;
• rectify inaccurate data;
• erase data in certain circumstances;
• restrict or object to processing;
• data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority (for example in your EU/EEA member state of residence, or the authority competent for our establishment once registered).

To exercise rights, contact us using Section 15. We may need to verify your identity before responding.

13. Children’s data

Our website and services are directed at businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy by posting a new version at /privacy.html (Portuguese: /privacy.pt.html) and changing the “Last updated” date. Significant changes will be highlighted where practical.

15. Contact

Privacy questions or requests: Contact form, or email privacy@morabeza-services.com / contact@morabeza-services.com.

Related: Terms and Conditions · Cookie Policy · Pricing · Home