Privacy Policy

UPDATED ON 2026-10-15

1. In a few lines

• You can use the whole site without telling us who you are. We only ask for your email if you want to join a front's waitlist.
• We use no tracking cookies, ads, pixels or third-party analytics. Fonts, images and scripts come from our own server.
• We don't sell, rent or give away your data.
• Every email we send has a link to leave the waitlist. One click and your email is deleted from that list.

2. Who looks after the data

Primal Enterprises is the controller of the personal data processed on primalent.com.br, under Brazil's General Data Protection Law (Law No. 13,709/2018, the LGPD). It decides what is collected and why.

This policy covers this site only. Each Primal front (Primal Studio, Simetrya, Denarion, Simias, Archaeon, Synthos, Primal Academy and Primal Platform) will have its own policy when it opens, which you can read before creating your account.

The data subject channel, which acts as our data protection officer, is in the Contact section at the end of this page.

3. What we collect, why, and on what legal basis

Waitlist

• Data: your email, the front you chose, the page language, the dates of signup, of the confirmation email and of confirmation, and a random code that identifies the links in the email.
• Why: to confirm the email is yours, let you know when the front opens and send news about that front. We use your email for nothing else.
• Legal basis: your consent (LGPD art. 7, I). It is given in two steps: when you join the waitlist and when you click the confirmation link. Until you confirm, the signup does not count and gets no other email.

Page counts

• Data: the address of the page opened and the day. For each page we keep only a daily total.
• Why: to know which pages are read, so we can improve the site.
• This is not personal data: we keep no IP, cookie, browser or anything that identifies the visitor. Bots and prefetches are not even counted.

Technical access logs

• Data: as on almost every site, our hosting records each request made to the server, with IP address, date and time, the address requested, the response and the browser identification.
• Why: to keep the site running, investigate failures, prevent abuse and attacks, and meet legal obligations.
• Legal basis: our legitimate interest in keeping the site safe and working (art. 7, IX) and compliance with legal obligations (art. 7, II). These logs are never used to profile anyone.
• To stop mass signups, the server keeps in memory, for one hour, a hashed digest of the IP that sent the form. The digest never goes to the database and disappears on its own.

Simias assistant

• The site's assistant works with ready-made questions. You pick a question, and nothing you click is stored.

Messages you send us

• If you write to us, we use your email and what you tell us only to reply and resolve your request. The legal basis is handling your request and, where applicable, the exercise of your rights.

Admin area

• People who run the site sign in with a username and password. The password is stored hashed, in a way not even we can read.

4. What we don't do

• We don't use Google Analytics, Meta Pixel, heatmap tools or anything like them.
• We load no fonts, scripts or images from other sites, so no third party learns that you visited this page.
• We show no ads and build no behavioral profiles.
• We make no automated decisions about you.
• We ask for no sensitive data, documents or payment details.

5. Cookies

We use only strictly necessary cookies, which need no consent because the site cannot work securely without them:

• csrftoken: on pages with a form. It stops another site from submitting forms in your name. It lasts up to one year and does not identify you.
• sessionid: only for people who sign in to the admin area. It keeps them signed in and lasts up to two weeks.

You can delete or block cookies in your browser. If you block csrftoken, the waitlist form stops working.

6. Who we share with

Only with those who need the data for the site to work, as processors that follow our instructions:

• Railway: hosts the site and the database and keeps the technical access logs.
• Resend: sends our emails. It receives your address and the content of the message.

Beyond that, we hand data to authorities only when the law or a court order requires it. If Primal ever goes through a merger, sale or reorganization, the data goes with the successor company, which is bound by this policy.

7. Data outside Brazil

Railway and Resend store and process data on servers outside Brazil, mainly in the United States. This international transfer follows LGPD art. 33: we choose providers that offer security and confidentiality guarantees compatible with the law, and they use the data only to provide the contracted service.

8. How long

• Unconfirmed signup: deleted automatically 30 days after signing up.
• Confirmed signup: kept while you are on the waitlist. It goes as soon as you use the leave link. When the front opens and the notice is sent, we delete that front's waitlist within 90 days.
• Technical access logs: kept by the hosting for as long as it retains logs, then deleted by it. We may keep a log longer when it is tied to a security incident or a court order.
• Page counts: kept indefinitely, because they identify no one.
• Messages you send us: as long as needed to resolve the request and to defend ourselves if there is a dispute.

9. Security

• Every visit to the site is encrypted (HTTPS), and browsers are told never to use an unencrypted connection.
• Pages accept content only from our own origin, which makes code injection by third parties harder.
• Access to waitlist data is limited to the people who run the site, each with their own password and separate permissions.
• Email links use a random code unique to each signup, and leaving the waitlist requires a confirmation on the page.

No system is unbreakable. If a security incident could bring you relevant risk or harm, we will notify you and Brazil's National Data Protection Authority (ANPD), as LGPD art. 48 requires.

10. Your rights

Under LGPD art. 18 you can, at any time and free of charge:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• ask for anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• ask for your data to be ported to another provider;
• ask for deletion of data processed with your consent;
• know who we share your data with;
• know what happens if you don't give consent;
• withdraw your consent;
• object to processing done without consent if it does not comply with the law.

To leave a waitlist, use the link in any email we send. For other requests, write to the contact below, preferably from the email you signed up with, so we know the request is yours. We reply within 15 days.

If you think we did not resolve your request, you can also complain to the ANPD at gov.br/anpd.

11. Children and teenagers

The site and the waitlists are for people over 18. We do not knowingly collect data from children or teenagers. If a parent or guardian finds that a minor joined a waitlist, just write to the contact below and we will delete the signup.

12. Changes to this policy

When this policy changes, the date at the top changes with it. If a change affects what we do with your data, people on the waitlist get an email notice before it takes effect.

13. Contact

Requests about your data, questions and complaints: entprimal@gmail.com. This is Primal Enterprises' data subject channel.