Version 0.3-draftLast updated November 2, 2026
Privacy Policy & LGPD
How Costa Mobility collects, uses, shares, transfers to the U.S., retains and protects your personal data, and how to exercise your rights, including under Brazil's LGPD.
Preliminary version under attorney review. Items marked [PREENCHER] (to be filled in) and [CONFIRMAR] (to be confirmed) are still open. Do not treat this text as final.
On this page
Effective date: [PREENCHER: effective date]
This policy explains how Costa Mobility handles your personal data when you use the website, the free assessment (Mobility Snapshot), the Mobility Blueprint, the portal, consultation scheduling and our communication channels. It is written to comply with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), which applies to us because we offer services to people located in Brazil (art. 3), and it also applies to users in the United States. Information that is part of an attorney-client relationship is also protected by the Firm's professional duty of confidentiality, which this policy does not reduce.
Summary
- We collect only what we need to assess your U.S. mobility goal, deliver the service you purchase and comply with the law.
- Nothing is collected in the assessment, and nothing is processed by AI, before you accept this policy, the artificial intelligence (AI) notice, the international transfer notice (where applicable), the Legal Disclaimer and the notice that there is no legal advice and no attorney-client relationship, and choose your communication preferences. Each acceptance is separate, recorded with the version of the text and can be withdrawn.
- The free Mobility Snapshot is generated by AI, checked by automated validation and delivered without review by an attorney, and it says so prominently. Mobility Blueprint and courtesy summary content reaches you only after review and approval by an attorney. AI does not decide whether you are eligible.
- Your data is processed in the United States, where the attorney, our hosting and our AI providers (OpenRouter, OpenAI and Google) are located.
- We keep data for up to 18 months after your last interaction if you do not purchase any service, and for 7 years if you buy the Mobility Blueprint or engage a legal service (section 8).
- We do not sell your data. WhatsApp and marketing messages only with your consent, which you can withdraw at any time.
- You can request access, correction, deletion and your other rights through the portal or at tech@costa-mobility.com (opens in a new tab).
1. Who we are and how to reach us
The Costa Mobility brand covers two separate companies:
- Costa Mobility Counsel PLLC (the "Firm"), a U.S. immigration law firm, which provides the service you engage: the assessment, the Mobility Blueprint, the legal review and the consultation with the attorney. Public office address in New York: 224 W 35th St, STE 500, #2805, New York, NY 10001, USA.
- Costa Mobility Technologies LLC, a technology company that provides the infrastructure of the website and the platform. It is not a law firm and does not provide legal services. Address: 30 N Gould St, STE N, Sheridan, WY 82801, USA.
The Firm decides how and why your personal data is processed and is the controller (LGPD, art. 5, VI). Technologies processes the data only on the Firm's instructions, as a processor (LGPD, art. 5, VII), under a written data processing and confidentiality agreement, and may not use it for its own purposes. [CONFIRMAR: controller and processor roles, including for browsing data of the public website, and the agreement between the two companies; the Privacy Policy of 11/01/2026 allows different roles depending on the context, and the legal services agreement (section 14) makes Technologies the controller of website, account registration and Mobility Snapshot data.]
Data protection officer (encarregado / DPO): Christopher F. Costa, at tech@costa-mobility.com (opens in a new tab) or at the mailing address of Costa Mobility Technologies LLC above, which we use for privacy and data protection matters. The DPO receives your complaints and requests, answers questions and communicates with Brazil's National Data Protection Authority (ANPD) (LGPD, art. 41).
2. Who this policy covers
- Website visitors.
- People who take the free assessment (Mobility Snapshot), whether or not they buy anything.
- People who buy the Mobility Blueprint and use the portal.
- People whose data is provided to us by someone taking the assessment, such as a spouse or dependents (section 12).
This policy does not cover third-party websites we link to.
3. What data we process
| Category | Examples | When |
|---|---|---|
| Browsing and security | IP address, browser and device, pages visited, date and time, language cookie | when you visit the website |
| Visit origin | the website you came from (only its main address, for example google.com, never the page or the search) and the campaign of the link (UTM parameters) | when you start the assessment |
| Contact | email address or WhatsApp number, confirmed with a one-time code | in the assessment or when you request a guide |
| Mobility profile | profile (founder, executive, investor, researcher, professional, company), goal, countries of residence and citizenship, professional situation, experience, career highlights, ties to the U.S., desired timeline, immigration history, education, family and dependents, challenges you describe | in your assessment answers |
| Assessment result | pathways considered, score per criterion, strengths, gaps and risks and, where applicable, the attorney's screening before payment | produced by the platform from your answers |
| Consents | version of the notice accepted, purpose, language, date and time, IP address and browser | at each acceptance or withdrawal |
| Purchase | name, email, country, WhatsApp, amount, currency, payment status, receipt. Card details stay with Stripe and never pass through us | at checkout |
| Account and portal | name, email, sign-in credentials [CONFIRMAR: email and password and/or Google sign-in], language and channel preferences | from payment onwards |
| Deliverables | Mobility Snapshot, Mobility Blueprint, courtesy summary, versions, the attorney's reviews and approvals | during the service |
| Documents | files you upload through the portal (for example, passport and supporting evidence) | when the attorney requests them |
| Consultation | date, time, time zone, language, video call link | when you schedule |
| New facts | description and files you send through the portal after the Blueprint is delivered, and the attorney's response | after delivery |
| Communications | emails and WhatsApp messages sent to you, with delivery status | during the service |
| Rights requests | type of request, identity verification, response | when you exercise your rights |
Sensitive data. We do not ask for sensitive data as defined by the LGPD (art. 5, II), such as health, religion, racial origin or biometrics. Please do not include it in open-ended answers. If any is needed for your matter, the attorney will ask for it specifically and explain the legal basis. [CONFIRMAR: legal basis for any sensitive data in specific cases (LGPD, art. 11).]
4. Why we use data and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Show the website, remember your language and protect the platform against abuse | legitimate interest (art. 7, IX) and, for access logs, legal obligation (art. 7, II) |
| Know which websites and campaigns bring people to the assessment | legitimate interest (art. 7, IX) [CONFIRMAR: legal basis for the visit origin] |
| Run the assessment, calculate the result and generate the Mobility Snapshot | consent (art. 7, I), given at the start of the assessment |
| Use AI to generate the Mobility Snapshot and prepare drafts reviewed by the attorney | specific consent (art. 7, I) |
| Transfer data to the U.S. | specific and highlighted consent (art. 33, VIII) and performance of a contract (art. 33, IX) [CONFIRMAR: transfer mechanism] |
| Carry out the attorney's screening before payment, when needed | pre-contractual steps at your request (art. 7, V) |
| Process payment, create the account, prepare and deliver the Blueprint and schedule the consultation | performance of a contract and pre-contractual steps at your request (art. 7, V) |
| Assess new facts reported after delivery and, where applicable, issue a new version | performance of a contract (art. 7, V) |
| Check for conflicts of interest | the attorney's legal and regulatory obligation (art. 7, II) |
| Send service emails (access code, receipt, delivery, new version, scheduling) | performance of a contract (art. 7, V) |
| Send notices via WhatsApp | consent (art. 7, I) |
| Send marketing content and reminders to finish the assessment | consent (art. 7, I), separate for each purpose |
| Keep receipts and records required by law | legal obligation (art. 7, II) |
| Keep evidence of the service provided and of the attorney's review to defend claims | regular exercise of rights (art. 7, VI) |
| Record consents and access for audit purposes | legal obligation and regular exercise of rights (art. 7, II and VI) |
Where the legal basis is consent, you may refuse or withdraw it at any time (section 10). Refusing the assessment consents prevents the automated assessment, because it depends on that processing (LGPD, art. 9, § 3, and art. 18, VIII). [CONFIRMAR: offer an alternative path without AI or without the transfer, for example contacting the firm directly.]
The Mobility Blueprint and the platform do not monitor document expiration dates. Expiration monitoring (such as of the I-94, visas, work authorizations and passports) exists only for people who engage the Firm for a separate legal service, after the petition covered by that engagement is approved, and follows that service's agreement.
5. Artificial intelligence and human review
- AI generates the Mobility Snapshot from your structured answers. It goes through automated validation and is delivered without individual review by an attorney, with the prominent notice that it is AI-generated, has not been reviewed or approved by an attorney, is informational only, is not legal advice and is not an eligibility determination.
- In the Mobility Blueprint and the courtesy summary, AI only organizes information and prepares drafts, which the attorney reviews, edits as needed and approves before they reach you.
- Before sending data to AI, we remove or replace what directly identifies you, such as your name, email and phone number (minimization and pseudonymization). [CONFIRMAR: exact list of fields removed before sending.]
- Models are accessed through OpenRouter, which routes each request to models from OpenAI and Google, in the U.S. We do not use other AI providers.
- AI providers are configured through API, contract or other commercial terms, with confidentiality, security and data processing terms, so that your inputs and outputs are not used to train models by default. Any change would be disclosed in advance and would depend on your consent. [CONFIRMAR: OpenRouter, OpenAI and Google settings that prevent training on and retention of the data.]
- AI does not make legal decisions. The preliminary qualification after the Snapshot uses fixed, versioned rules defined by the firm to indicate the next step; pathway analysis and recommendations are made only by the attorney, in the Blueprint.
- Automated flows do not provide urgent or emergency legal help.
- You may request information about the criteria used and a review of decisions made solely on the basis of automated processing (LGPD, art. 20).
Details are in the AI Processing Notice, shown before the assessment.
6. Who we share data with
We do not sell personal data. We share only what is necessary with:
| Who | Why | Where |
|---|---|---|
| Costa Mobility Technologies LLC | processor: infrastructure of the website and the platform, on the Firm's instructions (section 1) | U.S. |
| Cloud infrastructure providers | hosting and file storage (Vercel) and database (Neon) | U.S. (us-east-1 region, Northern Virginia) |
| OpenRouter, OpenAI and Google | AI drafting (section 5) | U.S. |
| Stripe | payment and refund processing | [CONFIRMAR: contracting Stripe entity and country] |
| Lawmatics | the firm's CRM: contact, journey stage, segment, recommended pathway, language, consents, payment, delivery and scheduling | U.S. |
| consultation calendar and video call (Google Calendar and Google Meet) | U.S. | |
| Resend | email delivery | U.S. |
| Meta (WhatsApp Business) | WhatsApp notices, only with your consent | U.S. |
| People you authorize | for example, advisors, accountants or translators who help with your matter, only with your authorization | as applicable |
| Authorities | when required by law, a court order or the professional rules | as applicable |
These providers process data on our behalf and under our instructions (processors), in addition to their own privacy policies. When you ask us to delete your data, we pass the request on to the integrated systems that hold it (LGPD, art. 18, § 6).
7. International transfer to the U.S.
The attorney, our hosting, the AI providers and our other vendors are in the U.S., so your data is transferred there from the assessment onwards. [CONFIRMAR: as of this version, the ANPD has not recognized the U.S. as providing an adequate level of protection.] The transfer relies on your specific and highlighted consent (LGPD, art. 33, VIII), on the performance of the contract you requested (art. 33, IX) and on contractual clauses with vendors where applicable (art. 33, II). [CONFIRMAR: adoption of the ANPD standard contractual clauses (ANPD Resolution No. 19/2024) with vendors.]
The International Transfer Notice, shown before the assessment, details the form, purpose, destination country, recipients and your rights.
8. How long we keep data
We keep each item only as long as needed for its purpose and then delete or anonymize it, unless the law allows or requires us to keep it (LGPD, art. 16). The period depends on whether you purchased a service:
| Who | What we keep | For how long |
|---|---|---|
| People who took the assessment and did not buy (including those who received a courtesy summary) | answers, Mobility Snapshot, result, courtesy summary, contact details, communications, consents and the related AI inputs and outputs | 18 months after the last interaction |
| People who bought the Mobility Blueprint | account, answers, the Blueprint and all its versions, the attorney's reviews, consultation, new facts, documents, communications, payments and receipts, consents and the related AI inputs and outputs | 7 years after the Blueprint is delivered or the last contact |
| People who engaged the Firm for a legal service | case file, documents and payment records | 7 years after the matter closes |
[CONFIRMAR: single retention table, with 18 months after the last interaction for people who did not buy and 7 years for people who bought the Blueprint or engaged a legal service]
Some technical items have their own, always shorter, periods: verification and resume codes are valid for a few minutes, portal sessions expire 7 days after last use, and the IP address and browser recorded with each consent are deleted before the person's period ends. Access logs are kept for at least 6 months (Brazilian Internet Civil Framework, art. 15) [CONFIRMAR: applicability] and never beyond the period in the table.
A longer period applies only when needed to check for conflicts of interest, meet a legal or professional obligation, or defend rights in proceedings. If any data must be kept for that reason even after a deletion request, we will tell you what was kept and why.
9. Your rights
Under the LGPD (art. 18), you may request at any time and free of charge:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
- portability of your data to another provider, as regulated by the ANPD;
- deletion of data processed on the basis of your consent, subject to the exceptions in art. 16;
- information about the entities we share your data with;
- information about the possibility of not consenting and the consequences of refusing;
- withdrawal of consent;
- review of decisions made solely on the basis of automated processing (art. 20);
- objection to processing carried out without consent if it breaches the law.
How to ask: through the portal or at tech@costa-mobility.com (opens in a new tab). To protect you, we verify your identity before acting, for example with a code sent to the email or phone number already on file. Access in simplified form is immediate; a full statement is provided within 15 days (art. 19). You may also complain to the ANPD (art. 18, § 1).
10. Consents and how to withdraw them
Each consent is requested separately, by purpose, and recorded with the exact version of the text you saw, including acceptances, refusals and withdrawals. You can withdraw it in the portal, through the unsubscribe link in our messages or at tech@costa-mobility.com (opens in a new tab). Withdrawal applies from then on and does not affect what was done before (LGPD, art. 8, § 5). Withdrawing consent to the processing of your assessment data triggers deletion of that data, subject to the exceptions in section 8.
11. Security
The platform is being built with technical and administrative safeguards, such as role-based access control, logging of access and changes, and temporary links for downloading documents. [CONFIRMAR: check this list against what is in production at launch.] No system is completely immune to failures. If an incident occurs that may pose a relevant risk or harm, we will notify you and the ANPD as required by the LGPD and ANPD regulations. See the Security page.
12. Dependents, children and other people
The service is intended for people aged 18 or over. [CONFIRMAR: minimum age.] If you provide data about a spouse, children or other people, you confirm that you are entitled to do so and that you have informed them. That data is used only to plan your own Blueprint, for example to consider who would accompany you. Children's data is processed only with the specific consent of a parent or legal guardian and in the child's best interest (LGPD, art. 14).
13. Professional confidentiality
Information you share in the assessment may be protected by the confidentiality rules that bind U.S. attorneys, including those protecting prospective clients. Submitting information through the platform does not, by itself, create a full attorney-client relationship; full protection of that relationship depends on a separate written engagement agreement, as explained in the Legal Disclaimer. [CONFIRMAR: extent of confidentiality over assessment data (NY Rule 1.18).]
14. People in the United States
If you are in the U.S., state privacy laws may also apply. [CONFIRMAR: applicable state laws and additional rights.]
15. Cookies
We use necessary cookies: the one for your chosen language, the ones that let you resume the assessment and the portal session cookie. We measure website usage with Vercel Web Analytics, which does not use cookies and only shows aggregate data. Analytics or advertising cookies, if adopted, will only be used with your consent. See the Cookie Policy.
16. Changes to this policy
We may update this policy. Each version is recorded with its date. If a change alters the purpose of processing based on your consent, we will tell you in advance and you may withdraw your consent (LGPD, art. 9, § 2).
Sources and legal bases
- Law No. 13,709/2018 (LGPD), consolidated text (Portuguese) (opens in a new tab): arts. 3, 5, 7, 8, 9, 11, 14, 16, 18, 19, 20, 33, 41 and 48.
- Law No. 12,965/2014 (Brazilian Internet Civil Framework) (opens in a new tab): art. 15.
- ANPD Resolution No. 18/2024 (data protection officer) (opens in a new tab).
- ANPD Resolution No. 19/2024 (international transfers) (opens in a new tab).
- New York Rules of Professional Conduct, Rule 1.18 (prospective clients) (opens in a new tab).
- Vendor policies: Stripe (opens in a new tab), Lawmatics (opens in a new tab), Google (opens in a new tab), Resend (opens in a new tab), OpenRouter (opens in a new tab), OpenAI (opens in a new tab) and WhatsApp Business (opens in a new tab).
[CONFIRMAR: English version drafted by the team from the Portuguese text of 11/01/2026; pending the attorney's review]