Your data stays yours.
This page has two parts. Part A is the privacy policy for this website. Part B is our Security and Data Handling Statement for U.S. public-sector engagements, which can be attached to any proposal we submit.
Version 1.1 · Effective September 29, 2026
Website privacy policy
START THE FUTURE is the brand of Upgrade Cursos Assessoria Consultoria e Treinamento Ltda., a company organized in Brazil. This policy covers startthefuture.us and the conversations that start through it.
What we collect and why
Information you send us
This site has no accounts. Our contact form prepares an email that you send yourself, and you can also write to us directly. We receive what you choose to send: typically your name, phone, work email, organization, industry, company size, your main challenge and what you are looking for. We use it only to reply, prepare a proposal and follow up on that conversation, and we may record it in our customer relationship system, hosted in Brazil.
Technical logs
Our hosting provider processes standard server logs, such as IP address, browser type and time of request, to deliver the site and protect it against abuse. We do not use these logs to identify or profile visitors.
Who receives it
Only the service providers that run our email and host this site, under contracts that limit their use of the data. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising.
Where it is processed
Our team is based in Brazil, so information you send may be processed in Brazil and in the United States. Client data in U.S. engagements follows Part B.
How long we keep it
Contacts that do not become a contract are deleted after 24 months without interaction. Contract records follow the retention required by law and by the contract.
Cookies, Do Not Track and third-party tracking
No tracking
This site does not use advertising cookies, analytics trackers or social media pixels, and it does not allow third parties to collect information about your activity over time or across other websites.
Where your visit came from
To learn which campaign brought each contact, the site may store in your own browser (local storage, not a cookie) where you arrived from: campaign parameters (utm), the ad click identifier (Google, Meta, LinkedIn, Microsoft or TikTok), the referring site, the landing page and the date. This information is not sent anywhere on its own: it only leaves your browser together with the contact form, if you choose to send it. We do not share it with advertising platforms. It expires after 90 days, and you can delete it at any time by clearing this site's data in your browser.
Do Not Track and Global Privacy Control
We do not track visitors across other websites, so browser "Do Not Track" and Global Privacy Control signals do not change how the site behaves. If we ever start cross-site tracking, we will update this policy first and honor these signals.
Your choices and rights
Access, correction and deletion
You can ask us what information we hold about you, and ask us to correct or delete it, by writing to our privacy contact below. We respond within 45 days, whether or not a state law requires it.
Nevada residents
We do not sell covered information as defined by Nevada law. You may still submit a verified request directing us not to sell it, and we will honor it.
Consumer health data
We do not collect consumer health data through this site. Please do not send health information by email.
Children
This site is not directed to children under 13, and we do not knowingly collect their information. If we learn that we have, we delete it.
Email communications
We send updates only to people who ask for them. Every commercial message identifies us, includes our postal address and offers a working unsubscribe link, honored within 10 business days.
Security and breach notification
We protect information with encryption in transit and at rest, access control and monitoring. If a breach affects your personal information, we notify you as required by the law of your state.
Accessibility
We design this site and our deliverables to conform to WCAG 2.1 Level AA. If any part of this page is hard to use, write to us and we will provide the content in another format.
Changes to this policy
We post every change on this page with a new effective date. Material changes are highlighted at the top of the page for 30 days.
Security and Data Handling Statement for U.S. public-sector engagements
Our current operation is designed for Brazil's data protection law (LGPD), where most of our clients are today. For U.S. engagements, we commit to meeting 100% of the federal, state and local requirements set by each contract, including U.S.-based infrastructure, from contract award and before any client data is processed. Where the contract is silent, the commitments below apply.
Our commitments upon award
| Area | What we commit to | Reference |
|---|---|---|
| Data location | Client data is stored and processed in the client's own environment or in U.S.-based data centers. Where the contract requires it, no client data is stored or accessed outside the United States. | Cal. SIMM 5315-B; contract terms |
| Access control | Named accounts, multi-factor authentication, least privilege and access logging. Access limited to U.S.-based personnel or U.S. persons whenever the contract requires it. | FAR 52.204-21; NIST SP 800-171 |
| Encryption | Encryption in transit and at rest, using FIPS 140-validated modules where required. | FIPS 140-3 |
| Incident response | We notify the agency within 24 hours of confirming an incident, or sooner if the contract requires, and support the agency's notification duties under state and federal law. | State breach laws; contract terms |
| Cloud services | When the scope includes cloud services, we deliver them on platforms authorized at the level the agency requires. | FedRAMP; GovRAMP; Cal. SIMM 141 |
| Controlled information | When the contract involves Controlled Unclassified Information, we implement the required NIST SP 800-171 controls before work begins. | NIST SP 800-171 |
| Sector data | Criminal justice, health, education or federal tax data is only handled after the specific requirements are in place, or the scope is declined. | CJIS; HIPAA; FERPA; IRS Pub. 1075 |
| Personnel | Privacy and security training for every team member on the engagement, and background checks when the contract requires them. | FAR 52.224-3 |
| Accessibility | Deliverables conform to WCAG 2.1 AA and Section 508. An Accessibility Conformance Report is available on request. | ADA Title II; Section 508 |
| Return and destruction | Within 30 days after the contract ends, or as the contract sets, we return client data and destroy remaining copies, with a certificate of destruction. | NIST SP 800-88 |
| Subprocessors | Disclosed in each proposal. No new subprocessor handles client data without the agency's approval. | Contract terms |
Artificial intelligence
Disclosure
We disclose the use of generative AI in every bid and deliverable, as California and other jurisdictions require.
Governance
Our AI governance program is aligned with the NIST AI Risk Management Framework. Decisions that affect people always go through human review, and outputs indicate their sources.
No training on client data
We use AI models only through enterprise agreements whose terms prohibit training on the data we send. Client data is never used to train or improve any model.
What we do not claim
Certifications
We do not currently hold FedRAMP, GovRAMP, CMMC, SOC 2 or ISO certification. Our controls are aligned with ISO/IEC 27001 and NIST frameworks, and this statement describes commitments that take effect with each contract. We will update this page as certifications are obtained.
Questions, requests or security questionnaires
Privacy requests, client questions, vendor security questionnaires and incident reports all come to this channel and are answered by our Data Protection Officer.