legal
Privacy Policy
This policy explains which data we process when you visit murmur.marketing, why we process it and what rights you have over it. It is written for the LGPD (Brazil's General Data Protection Law, Law 13,709/2018). A note for visitors from the European Union and the United Kingdom appears at the end.
Who we are
murmur operates murmur.marketing and is the controller of the data processed here. For anything related to this policy, contact account@murmur.marketing.
The short version
- We never sell your personal data.
- No analytics or advertising cookies are stored before you accept. Without your consent, Google still receives cookieless measurement data that does not identify you, and the Meta Pixel does not load at all.
- The WhatsApp contact option stores nothing: the buttons open a prepared message, which reaches us only if you choose to send it. What you provide for the diagnostic — your domain and, if you request the complete report or a place in the queue, the contact details you supply — is stored as described in the diagnostic section.
- We host our own fonts, so your IP address is not sent to any font network.
What we collect
Technical access data
Like any website, our server records technical data for each visit: your IP address, browser and operating system, the page accessed, and the date and time. We use this for security and troubleshooting, on the legal basis of legitimate interests.
Site languages
The homepage opens in Portuguese. The English version is available at /en/. You can choose a language using the PT-BR and EN links. We do not use the approximate country associated with your IP address to choose for you, and we do not store your choice in a cookie.
Contact through WhatsApp
The site's contact buttons open a WhatsApp conversation with a prewritten message. Here is exactly what that means:
- Nothing in this contact flow passes through our servers. This applies to the WhatsApp contact flow: the site collects no form fields here. The button simply opens a conversation with a message ready to send. The public diagnostic at /en/diagnostic/ and the complete diagnostic request at the bottom of the home page work differently: they use a server and store what you provide, as described in their own sectionbelow.
- Whether to send the message is up to you. If you close the conversation without sending, nothing reaches us and nothing is recorded anywhere.
- If you send a message, we process what the conversation contains to respond to your enquiry and discuss our services. The legal bases are your consent and steps taken before entering into a contract.
Usage analytics
We use Google Analytics to understand how the site is used. Here is exactly what happens in each case, because this is not a simple on/off switch:
- If you reject analytics cookies, Google's library still loads and sends measurement data without cookies or an identifier that tracks you: it records that a page was viewed, along with your browser, screen size and the IP address carried by every internet request. Google states that it does not store this IP address. This measurement does not recognize you on a later visit or connect two pages to the same person.
- If you accept, cookies are stored in your browser and full measurement begins: the pages you open are grouped into a session, and you are recognized as the same visitor across visits.
Processing that depends on your acceptance is based on your consent, which you may withdraw at any time. The cookieless measurement described above relies on our legitimate interest in knowing how many people visit the site.
Advertising
If, and only if, you accept advertising cookies, we load the Meta Pixel (Facebook and Instagram). It records your visit so murmur can show you ads later on Meta's platforms. The legal basis is your consent.
Your hashed email. If you provide your email on the site and accept advertising cookies, we also send a scrambled version of it, a hash , so Meta can recognize that the visit and email belong to the same person. Hashing hides the email from direct view, but it is still your personal data: its purpose is to identify you, and we treat it accordingly. It leaves our systems only with your consent.
If you do not accept, none of this happens. The Pixel does not load, no browsing activity here is recorded for Meta, and no email, hashed or otherwise, is sent to it. To change your mind after accepting, click Cookies in the footer and reject the advertising category. The Pixel will then stop loading. Withdrawing consent applies going forward; it does not undo information already sent.
The public diagnostic (/en/diagnostic/)
In one sentence: you enter a domain, we read its public pages and ask third-party AI models about that market; the report is emailed only if you request it and consent; and you can request deletion of your record and diagnostic runs by writing to account@murmur.marketing.
What we collect. The domain you enter and, if you request the complete report, your email address, name and the phone number you provide — along with the exact consent text you accepted, the date and the brand you confirmed as yours. There is a waiting list with two entry points: the complete diagnostic request on the homepage and the availability notice when demand is high. There is also a contact option during the analysis. We store your email address, domain, consent and the date; the name and phone number you provide accompany the contact notification our team receives. Joining the queue records your interest for when capacity becomes available — there is no guaranteed timeframe: an operator opens the queue.
Consent is recorded word for word. We do not store a bare "yes". We store the exact sentence displayed when you checked the box. That sentence is the evidence of what you agreed to, including in any claim against us.
Why we collect it. To generate the report, send it by email and, where relevant, discuss it with you. We do not sell your data. We use hosting, processing, email delivery and internal communication providers to fulfill your request; they may process the data needed for those functions.
What we do with your website. We read the public pages of the domain you entered, as a search engine would, and ask third-party AI models (OpenAI, Anthropic, Perplexity and Google) about your market. When your site provides enough material, the questions concern the market rather than you. Before leaving our systems, every question passes through a filter that blocks questions containing your domain or brand name.
The exception, stated explicitly. When your website has little readable public content, there is not enough material to write market questions. That may be the most important finding the diagnostic can offer. In that case, your domain is sent in a question through one route only: the diagnostic sends one question to a search engine: "look up the company that owns {your domain}" solely to find out what you sell. This question does not count toward the score, and its answer is not published in the report. It provides context for writing the questions. If the search returns an answer, the diagnostic questions still concern the market, and the filter applies to every one of them.
If even that search cannot find your company, the analysis stops and we explain this on screen. No question containing your name or domain is sent to the AI models, and that run does not become a report.
Before you provide an email, we do not know who you are. A run starts anonymously, with a random identifier and the domain you entered, without a name, account or email. This is why deletion requests start with an email: it is the only link between a run and a person. If you never provided an email, we cannot know which run is yours and cannot fulfil a deletion request for it. The retention period below applies instead.
How long we keep it. An anonymous run, where you did not provide an email, is stored for no more than 90 days and then discarded. If you provided an email, we keep your record and report as evidence of what we delivered to you until you ask us to delete them.
How to delete it. Write to account@murmur.marketing to request deletion. We delete your record and the files for runs linked to it: the report, captured responses and PDF. One request covers both.
What is excluded, stated explicitly. To avoid asking the same market question for every visitor, we store questions and model answers in a separate file. This file is not covered by deletion requests. For that reason, it contains only information that does not identify anyone: it never receives your email, and it contains only questions from the normal flow that already passed the brand and domain filter. What remains is a question about a market and the public answer a model gave, the same answer someone else could receive by asking the same question. The exceptional run described above, where the diagnostic searches for your company by name, is not included: that run has the shared file disabled from start to finish.
Cookies and consent
This site's cookies are split into two categories, with a separate choice for each. You can accept one and reject the other:
- Analytics means Google Analytics cookies, which connect page views within a session. None are stored without your consent. Any measurement that still takes place is described under "Usage analytics" above.
- Advertising means the Meta Pixel. It does not load without your consent, and none of your browsing here reaches Meta.
The notice appears on your first visit. Until you make a choice, no analytics cookies are stored and the Pixel does not load. Your choice is saved in your own browser, not in an account we maintain. To change your mind at any time, click Cookies in the footer. You can accept what you previously rejected or reject what you previously accepted, category by category.
Fonts we host ourselves
This site's fonts are served from our own servers. We do not load them from third-party font networks, so opening a page does not share your IP address with a font provider.
Who we share data with
We share data only with the providers needed to operate the site:
- Hosting provider, which stores the site and generates the access logs described above.
- Google Analytics, on every visit: the cookieless measurement described above without your consent, and full measurement with your consent. Data may be processed on Google's servers, including in the United States.
- Meta (Facebook / Instagram), advertising Pixel, only if you accept advertising cookies. It receives a record of your visit and, if you provided an email, its hashed version. Processing may take place outside Brazil, including in the United States.
- WhatsApp / Meta, only if you choose to contact us there. The conversation takes place on their platform and follows their policies.
When processing takes place outside Brazil, it is covered by safeguards offered by these providers, such as standard contractual clauses. We never sell your personal data.
How long we keep data
Server access logs are kept for a short period for security and troubleshooting, then discarded. Analytics data follows the retention settings in the tool. Data Meta receives through the Pixel is subject to Meta's retention rules and policies, not ours. Messages you send us are kept for as long as needed to handle the conversation and, if it leads to a contract, for the applicable statutory period.
Your rights
Under the LGPD, you may ask at any time to:
- confirm that we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- anonymize, block or delete unnecessary or excessive data;
- request portability of your data to another provider;
- delete data processed on the basis of your consent;
- learn who we share your data with;
- withdraw your consent.
To exercise any of these rights, write to account@murmur.marketing. You may also lodge a complaint with Brazil's ANPD.
Children and adolescents
This site is intended for a professional audience and is not directed at anyone under 18. We do not knowingly collect data from minors.
Visitors from the European Union and the United Kingdom
If you access the site from these regions, the GDPR and UK GDPR provide rights equivalent to those above: access, rectification, erasure, restriction, portability and objection, as well as withdrawal of analytics and advertising consent at any time. Our legal bases are your consent for analytics, advertising, contact and diagnostic emails, and legitimate interests for basic server logs, cookieless measurement and site security. The contact address is the same, and you may lodge a complaint with your country's data protection authority.
Changes to this policy
We may update this policy as the site evolves. When we do, the "last updated" date at the top will change.
Contact
Questions about this policy or your data: account@murmur.marketing.