Privacy Policy

1. Who we are

A&B Hub (“A&B Hub”, “we”, “us”) is a web development agency operated from Belo Horizonte, Minas Gerais, Brazil, serving small businesses in the United States. We are the controller of the personal information described in this policy.

This policy covers aebhub.com and the email correspondence that follows from it. It does not cover websites we build for clients — those are governed by each client's own policy.

Contact for any privacy matter: contact@aebhub.com.

2. What we collect

Information you give us

When you complete the scoping form, we receive:

• Your name and email address — required, so we can reply.
• Your phone number — optional. The form works without it.
• What you tell us about your project — the type of project, your timeline, the budget range you selected, and anything you write in the description field.

If you email us directly, we receive whatever you put in that email. Please do not send us passwords, payment card numbers, government identification numbers, health information or anything else sensitive through the form or by email. We do not ask for any of it and we have no use for it.

Information collected automatically

Our server logs and analytics record ordinary technical data: IP address, browser and device type, pages viewed, referring page, and timestamps. We also record the IP address of form submissions for a short period to enforce a rate limit against automated abuse.

What we do not collect

We do not build advertising profiles, we do not buy personal information from data brokers, we do not use tracking pixels that follow you to other websites, and we do not knowingly collect anything from children.

3. Why we use it, and on what legal basis

To answer your enquiry

The whole point of the form. Legal basis: performance of a contract, or steps taken at your request before entering into one.

To provide services if you become a client

Legal basis: performance of a contract.

To keep the site working and free of abuse

Rate limiting, spam filtering, security logging. Legal basis: our legitimate interest in operating a functioning website.

To understand how the site is used

Aggregate analytics, so we know which pages are read. Legal basis: legitimate interest, or your consent where consent is required.

To meet legal and accounting obligations

Legal basis: compliance with a legal obligation.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you.

4. Marketing email

We do not run a newsletter and we do not add form submissions to a marketing list. If we ever start sending marketing email, it will be to people who asked for it, every message will carry a working unsubscribe link and our physical address, and we will honour opt-outs promptly — as required by the CAN-SPAM Act.

Replies to your enquiry, project updates and invoices are transactional, not marketing.

5. Who else sees your information

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not trade or rent it to anyone.

We do rely on a small number of service providers who process data on our behalf, under contract, and only for the purposes we specify:

Google (Google Workspace)

Hosts our email. Anything you send us, and our replies, sit in that mailbox. Google also provides the analytics described below.

Vercel

Hosts this website and processes the request logs that come with serving it.

Meta

Only if and when advertising measurement is enabled — see section 7. It is not enabled today.

We may also disclose information if the law requires it, to establish or defend a legal claim, or to protect the rights and safety of people. If our business is ever transferred, personal information would move with it, and we would say so here first.

6. International data transfer

Brazil has a comprehensive data protection law — the Lei Geral de Proteção de Dados (LGPD) — and we are subject to it. Where the GDPR applies to a transfer, we rely on the European Commission's adequacy framework for Brazil or on standard contractual clauses, as appropriate.

We are telling you this plainly because you deserve to know where your information goes before you type it, not after.

7. Cookies, analytics and advertising

This site sets no advertising cookies and shows no third-party ads.

Analytics

When enabled, we use Google Tag Manager and Google Analytics to count visits and see which pages are read. This uses cookies or similar identifiers. We do not use analytics to identify you personally, and we do not combine it with your form submission.

Advertising measurement

We may enable the Meta Pixel to measure whether our own advertising works. If we do, that counts as “sharing” personal information for cross-context behavioural advertising under California law, and we will publish a “Do Not Sell or Share My Personal Information” control before switching it on, together with an updated version of this policy.

Your controls

Most browsers let you block or delete cookies. Blocking them will not stop the site from working. We honour the Global Privacy Control (GPC) signal as a valid opt-out of sale or sharing where the law recognises it.

8. How long we keep it

Enquiries that do not become projects

Up to 24 months, then deleted. Ask us and we will delete them sooner.

Client records

For the duration of the engagement and up to 5 years afterwards, to meet contractual, tax and accounting obligations.

Rate-limiting records

Minutes. They exist only to stop automated abuse and are not stored durably.

Analytics

According to the retention period configured in the analytics tool, at most 14 months.

9. Your privacy rights

We extend the rights below to every resident of the United States, regardless of which state you live in and regardless of whether a particular state law applies to a company our size. We would rather give you the right than argue about thresholds.

• Know and access — what personal information we hold about you, where we got it, why we have it and who we disclosed it to.
• Correct — fix information that is wrong.
• Delete — have us erase it, subject to narrow legal exceptions such as records we must keep for tax purposes.
• Portability — receive a copy in a usable, machine-readable format.
• Opt out — of sale, of sharing for cross-context behavioural advertising, and of profiling with legal or similarly significant effects. We do none of these today, so there is presently nothing to opt out of.
• Limit the use of sensitive personal information — we do not collect any, so this does not arise.
• Non-discrimination — exercising any right will never get you a worse price, a worse service, or a slower reply.
• Appeal — if we refuse a request, you may appeal by replying to our decision. We will respond to the appeal in writing within 45 days and explain our reasoning. Several state laws require this; we offer it to everyone.

If you are in the European Economic Area or the United Kingdom

You additionally have the right to object to processing based on legitimate interests, to request restriction of processing, to withdraw consent at any time without affecting processing already carried out, and to lodge a complaint with your supervisory authority.

If you are in Brazil

The LGPD gives you the rights above along with the right to confirm the existence of processing, to request anonymisation or blocking of unnecessary data, and to information about the entities we share data with.

How to exercise them

Email contact@aebhub.com and tell us what you want. There is no form to fill in.

We will confirm receipt within 10 days and respond substantively within 45 days. If a request is genuinely complex we may take a further 45 days, and we will tell you why before the first period expires. Requests are free unless they are manifestly unfounded or repetitive.

We will need to verify that the request comes from you — usually by replying from the email address involved. An authorised agent may act on your behalf with written proof of authority. We only ask for the minimum needed to be confident we are not handing your data to a stranger.

10. Security

The site is served over HTTPS. Form submissions are validated and rate-limited. Access to the mailbox holding enquiries is restricted to the two of us and protected by two-factor authentication. Credentials are never stored in our source code.

No method of transmission over the internet is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

11. Children

This is a business-to-business site and it is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email us and we will delete it.

12. Changes to this policy

If we change this policy we will update the date at the top. If the change is material — for example, if we begin advertising measurement, or start sending marketing email — we will say so prominently on this page before the change takes effect.

13. Contact

A&B Hub
1395 Curitiba St., Lourdes
Belo Horizonte, MG, Brazil
contact@aebhub.com