Privacy Policy.

Last updated: September 17, 2026. Whoever audits other people's reality would have no authority at all if careless with its own visitors. This policy describes, without runaround, what this site collects and what it does with it — in accordance with Brazil's General Data Protection Law (Lei nº 13.709/2018 — LGPD).

Who processes your data

Valida Auditoria is a trademark of InnCorporate (InnCorporate Desenvolvimento Imobiliário Participações Ltda., CNPJ 67.606.802/0001-10), the controller of the data processed on this site. For any matter concerning personal data, including the exercise of your rights, write to [email protected] with the subject "LGPD".

What this site collects

Two fronts, and nothing beyond them.

• The "Request an audit" form: name, email, company and the message. No field is requested beyond what is necessary to respond. Along with it, we record the context of the contact — the referring page, referrer, campaign parameters and device type — and the IP address, always in cryptographic hash format (sha256): we never store the IP as plain text, and from the hash it is not possible to recover the original address.
• The free signature tool (/assinatura): described in detail in its own section, just below — it is the front that processes the most personal data on this site, and for that reason deserves a separate explanation.

Free digital signature tool (/assinatura)

We provide, at validaauditoria.com.br/assinatura, a free electronic document signature tool, open to any visitor. It is a service provided free of charge (pro bono), but that does not change its nature: we process real personal data to provide it, and this section describes that processing specifically.

Data collected by this tool:

• From whoever sends the document: legal name, CNPJ, contact name and email
• From each signatory named: name and email (used to send the signature link)
• The PDF file itself sent for signature, with whatever content it contains
• Audit trail of every step of the signature (viewing and signing by each signatory) — date, time and IP address, recorded automatically by our electronic signature infrastructure to prove the authenticity of the process

Purpose and legal basis: this data is processed exclusively to carry out the requested signature — generate the document, notify each signatory, collect each one's signature and form the audit trail that gives validity to the process (see the legal grounds described on the tool's own page). The legal basis is the execution of a preparatory procedure at the data subject's request (whoever sends the document) and the consent of each signatory, given upon signing.

Documents and the audit trail live on the same infrastructure that supports the signing of InnConta contracts (see "Who we share with", below) — we do not share this data outside the group, except when the sender or signatory themself requests the signed document, which is, by definition, the delivery of the service.

Who we share with

With no one, for commercial purposes. We never sell, transfer or rent out data, and we do not feed a mailing list. For the site to function, two providers process data on our behalf and instructions:

• Cloudflare: hosting and page delivery — this site is served only over an encrypted connection (HTTPS), with a restrictive content security policy and mandatory strict transport (HSTS). Cloudflare also runs the site's audience measurement (Web Analytics), which uses no cookies and does not identify the visitor, and forwards messages sent to @validaauditoria.com.br addresses to the responsible inbox (Email Routing).
• Supabase: the database where the contact form is kept and, when you use the signature tool, the document and the audit trail. The instance that stores the signed documents runs in the São Paulo region (sa-east-1) — this data does not leave Brazil.

The electronic signature engine (DocuSeal) runs on the InnCorporate group's own infrastructure — it is not a third-party service, and documents do not pass through any external signature platform.

For how long

Contacts made through the form that do not evolve into contracted work are deleted within 24 months. A document sent for signature, once the process is complete, is kept for the retention period the document itself requires — the audit trail accompanies the document and cannot be removed in isolation without invalidating the signature proof.

Your rights

The LGPD guarantees your right to confirm whether we process your data, access it, correct it, request anonymization, blocking or deletion, know who we share it with, request portability and object to processing based on legitimate interest (LGPD, art. 18). Just write to the controller's email with the subject "LGPD": we respond within 15 days, with no signup or justification required.

Security

The site is served only over an encrypted connection, with a restrictive content security policy and protection against framing on other sites. The contact form has a limit on submissions per hour against automated abuse. What is stored in our database is only what is described in this policy, with access restricted to the Valida team.

Minors and sensitive data

This site is not directed at minors and does not request sensitive data. We ask that health data, biometric data or any sensitive information not strictly necessary to the document in question not be included in the contact form or in the documents sent for signature.

Cookies

We use only what is essential to the site's operation and the preference recorded in the consent bar. We do not install advertising cookies, social network pixels or third-party trackers.

About the images on this site

The photographs illustrating these pages are stock images, chosen by subject — never the record of a real development, client or opinion. An audit site would have no credibility if it were careless about the origin of what it publishes, including its photography.

Image credits

Every photograph (and the home page's hero video) carries a discreet number in the corner. Below is each number, with author, license and source — the same evidence trail we require of any statement applies to what illustrates this site.

No image on this site depicts a real development, client or audit object.

If the policy changes

The version in force is always this page. A material change is flagged here, with a new date — what has already been collected remains governed by what was in force at the time of collection.