Privacy Policy

CGRabbit · Last updated: October 7, 2026

This policy explains what personal information CGRabbit collects through our websites and our business outreach, why we collect it, who we share it with, and the choices you have. The short version comes first. The details follow.

The short version

• Our websites have no login and no advertising cookies. The only form is the short "Get a free assessment" request, used just to reply to you.
• We only get your name and email if you book a call with us or write to us.
• We do not sell or share your personal information, and we do not use it for targeted advertising.
• We use a few service providers to run our websites and our business (hosting, scheduling, email). They handle information for us under their own data protection terms.
• If we email you about our services and you want us to stop, reply "stop". We remove you from every channel we use, not only email.
• In the ordering systems we build for restaurants, their customers' data belongs to the restaurant. We handle it only on the restaurant's behalf, with confidentiality, under a written agreement signed with each client.
• Questions or requests: hello@cgrabbit.com.br.

1. Who we are

CGRABBIT LTDA ("CGRabbit", "we", "us") is a limited liability company organized under the laws of Brazil, CNPJ 52.035.198/0001-42, with registered address at Rua Doutor Reynaldo Machado, 1336, Prado Velho, Curitiba, PR, 80215-242, Brazil. Our team is based in Florianópolis, Brazil.

Contact: hello@cgrabbit.com.br

2. What this policy covers

This policy covers:

• our websites at cgrabbitstudio.com, www.cgrabbitstudio.com, cgrabbit.com.br and www.cgrabbit.com.br (the "Sites");
• emails and messages you exchange with us; and
• our business outreach to companies (see section 8).

This policy does not cover:

• systems we build or run for our clients, such as ordering websites, dashboards and driver apps. Those follow the client's own privacy policy and our agreement with that client (see section 9);
• other websites or subdomains that use the cgrabbitstudio.com or cgrabbit.com.br names to host client projects, demos or our client portal. Those have their own terms or are governed by contract ; and
• websites run by others that we link to, such as Calendly, Instagram, Behance or our clients' sites. They have their own policies.

3. What we collect and where it comes from

What we don't collect. We don't ask for sensitive information (such as health data, government ID numbers, financial account numbers or precise location) through our Sites, and we ask that you don't send it. Our Sites don't collect payment card numbers.

4. How we use it

We use personal information to:

• run, protect and improve the Sites (fix errors, block attacks and abuse, and understand in aggregate which pages are useful);
• answer your messages and hold the calls you book;
• prepare proposals and contracts when you ask for them;
• contact businesses that may benefit from our services, and keep a record of who asked not to be contacted;
• keep accurate notes of our calls;
• keep business and tax records, comply with the law, and protect or defend our rights.

We do not use personal information to sell it, for targeted (cross-context behavioral) advertising, or for automated decisions that produce legal or similarly significant effects about you.

5. Software and AI tools

We use software tools, including AI-assisted tools, to research businesses, organize our contact list, take notes, and prepare and send messages. Where the provider allows it, we configure these tools so that our data is not used to train their models. These tools act as our service providers.

6. Who we share it with

We share personal information only with the following.

Service providers that help us run the Sites and the business and handle information on our behalf:

You can ask us for the current list of the specific providers we use.

Others, only when needed:

• Professional advisors, such as our accountants and lawyers, under confidentiality.
• Authorities, when the law requires it, or when needed to protect our rights, our users or the public.
• A successor business, if CGRabbit is involved in a merger, acquisition or sale of assets. The information would remain protected by this policy.

When we message you on LinkedIn, Instagram or WhatsApp, those platforms also process the message under their own policies.

We do not sell or share personal information. We have not sold or shared personal information in the past 12 months, and we do not disclose personal information to third parties for their own direct marketing.

7. Cookies, Do Not Track and Global Privacy Control

Cookies. Our Sites don't use advertising or marketing cookies, and our visitor statistics tool (Cloudflare Web Analytics) works without cookies and without storing anything on your device. Our security provider, Cloudflare, may set a strictly necessary cookie (such as __cf_bm or cf_clearance) to tell people apart from bots and protect the Sites from attacks. Calendly and other sites we link to set their own cookies on their own pages.

Tracking across sites. We do not track you across other websites, and we do not allow third parties to collect information about your activity over time and across websites through our Sites for advertising.

Do Not Track. Because we don't track you across websites, our Sites work the same way whether or not your browser sends a Do Not Track signal.

Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information linked to that browser. We don't sell or share today, so nothing changes now. If our practices ever change, we will honor GPC signals.

If this changes. If we ever add advertising cookies, pixels or similar tools, we will update this policy before turning them on and, where the law requires, ask for your consent or give you a way to opt out first.

8. How we contact businesses (our outreach)

We reach out to businesses that may benefit from what we build, mainly restaurants, caterers, agencies and other operations-heavy companies.

• What we use: business contact details and public information about the business, as listed in section 3.
• Every promotional email identifies itself as an advertisement from CGRabbit, includes our postal address, and tells you how to stop receiving messages.
• To stop: reply "stop" or "unsubscribe" to any message, or write to hello@cgrabbit.com.br. We process your request within 10 business days, and we remove you from every channel we use (email, LinkedIn, Instagram, WhatsApp and phone), not only the one you replied to.
• Why we keep a record after you opt out: we keep minimal information (your email or profile link and the date) on a do-not-contact list, only to make sure we don't contact you again.
• No texts or robocalls in the US. We do not send marketing text messages, and we do not use automated, prerecorded or artificial-voice calls to reach prospects in the United States.

9. Systems we build and run for clients: confidentiality and signed agreements

We build and operate ordering websites, management dashboards and driver apps for restaurants and other businesses ("clients"). If you order from or use one of those systems, here is how it works:

• The client is in charge of your data. The restaurant decides what information its system collects and why. Under privacy law it is the "business" or "controller", and its own privacy policy applies to you.
• We work for the client, not for ourselves. CGRabbit acts as a service provider (also called a "processor"). We handle that information only to build, host, support and run the system for the client, following the client's instructions and the written agreement we sign with each client. Those agreements include confidentiality obligations.
• We don't use it for anything else. We do not sell that information, do not use it to market our own services, and do not combine it with the information described in the rest of this policy.
• Card payments. We design these systems so that card numbers are handled by the client's payment provider and are not stored on our servers.
• Requests about that data. To access, correct or delete information held in a client's system, contact the business you ordered from. If you write to us instead, we will pass your request to that client and help them respond.
• Our Sites show sample data. Screenshots of client systems on our Sites use sample data or public pages, not real customers' personal information.

10. Call recordings

With your permission, we may record and transcribe video calls so we keep accurate notes of what was agreed. We mention it when you book the call and ask again at the start of the call. We record only if everyone on the call agrees. If anyone says no, we don't record, and if someone joins later and doesn't agree, we stop. Recordings and transcripts are kept and deleted under section 11.

11. How long we keep it

You can ask us to delete your information earlier (see section 14). Information we delete may remain for a limited time in our security backups, protected and not used for anything else, until it is removed in our periodic backup cleanup.

12. How we protect it

We use reasonable safeguards for a business of our size, including encrypted connections (HTTPS), access limited to the people who need it, two-factor authentication on our main accounts , and providers with established security programs. No system is completely secure. If a security incident affects your personal information, we will notify you and the authorities as the law requires.

13. International transfers

CGRabbit is based in Brazil, and our service providers operate in the United States and other countries. If you are in the United States, your information will be transferred to and handled in Brazil and other countries whose laws may differ from those of your state. We protect it as described in this policy wherever it is handled.

Because CGRabbit is a Brazilian company, Brazil's General Data Protection Law (LGPD, Law 13.709/2018) also applies to how we handle personal information. Our Portuguese Política de Privacidade describes LGPD rights in detail, and anyone can use them.

14. Your privacy rights

Depending on where you live, state privacy laws (such as those of California, Virginia, Colorado, Connecticut, Texas and Oregon, among others) may give you rights over your personal information. Many of these laws apply only to businesses above certain size thresholds. Whether or not a specific law applies to us, we honor the following requests from anyone in the United States:

• Know and access. Ask what personal information we have about you, where it came from, why we use it and who we disclosed it to, and get a copy in a portable format.
• Correct. Ask us to fix information that is inaccurate.
• Delete. Ask us to delete your information. We may keep what the law requires, what we need for security or to handle legal claims, and the minimum needed to keep you on our do-not-contact list.
• Opt out. Opt out of the sale or sharing of your information, targeted advertising, and profiling. We don't do any of these, but we will record your request and honor it if our practices ever change.
• No retaliation. We will not treat you differently for using these rights.

How to make a request. Email hello@cgrabbit.com.br with "Privacy request" in the subject line. Tell us what you want and how we can reach you. To protect you, we confirm your identity by matching what you tell us with what we already have, for example by asking you to write from the same email address we have on file. If we need more details, we will only ask for what is necessary.

Authorized agents. Someone you authorize can make a request for you with your signed permission. We may confirm the request directly with you.

Timing and cost. We confirm that we received your request within 10 business days and answer within 45 days. If we need more time (up to 45 more days), we will tell you why. Requests are free.

Appeals. If we decline your request, in whole or in part, you can appeal by replying with "Appeal" in the subject line. We will answer within 45 days and explain our decision. If you are not satisfied with the answer, you may contact the attorney general of your state.

15. More details for California residents

This table describes the personal information we have collected in the past 12 months.

• We keep each category for the periods in section 11.
• We do not collect, use or disclose sensitive personal information for the purpose of inferring characteristics about you.
• We have not sold or shared personal information in the past 12 months, including that of consumers under 16.
• We do not disclose personal information to third parties for their own direct marketing purposes (California "Shine the Light" law).

16. Children

Our Sites and services are for businesses and adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, write to us and we will delete it.

17. Links to other websites

Our Sites link to websites we don't control, such as Calendly, Instagram, Behance and our clients' sites. Their own privacy policies apply when you use them.

18. Changes to this policy

We may update this policy as our Sites, our tools or the law change. When we do, we will post the new version here and change the "Last updated" date. If a change is material, for example if we start using advertising cookies or pixels, or begin selling or sharing personal information, we will update this policy before the change takes effect and, where the law requires, ask for your consent or give you a way to opt out first. We will not apply a material change to information we collected before it without telling you and, where the law requires, getting your consent.

19. Contact us

CGRABBIT LTDA Rua Doutor Reynaldo Machado, 1336, Prado Velho Curitiba, PR, 80215-242, Brazil hello@cgrabbit.com.br (subject: "Privacy request")

If you have a disability and need this policy in another format, email us and we will provide it.