How studiowebr collects, uses and protects personal data, and the rights you have under the LGPD, GDPR, UK GDPR and US state laws.
1. Who is responsible for your data
The controller of your personal data is Webert Rangel Oliveira de Sousa, trading as studiowebr, CPF 545.497.588-56, R. Fortunato, 227, Vila Buarque, São Paulo, SP, 01224-030, Brazil. For anything related to privacy, including the role of data protection officer (encarregado) under the Brazilian General Data Protection Law (LGPD), contact privacy@studiowebr.com.
2. What this policy covers
This policy explains how we handle personal data when you visit studiowebr.com, contact us, place an Order and work with us on it. It does not cover third-party websites or services you reach through links on the Site, such as Stripe's checkout page, which have their own policies.
3. The data we collect
Data you give us.
- Contact forms: your name, email, topic and message.
- Orders: your email, the brand or project name and notes you choose to add at checkout, and your name, billing address and country collected by Stripe. Card details are collected and processed by Stripe. We only see limited information such as the card brand, the last four digits and the payment status.
- Working on your Order: your answers to the brief, the files and materials you send us, feedback, approvals and the emails we exchange. Where a deliverable is handed over in a platform such as Figma, Canva or Webflow, the email of the account we share it with.
Data collected automatically. Our hosting provider processes technical data such as IP address, browser type and request times in server logs, to deliver and secure the Site. We store your cookie choices in your browser. We do not currently use analytics or advertising cookies. If we add them, they will only run after you opt in. See our Cookie Policy.
Data from third parties. Stripe tells us whether a payment succeeded and may share fraud-prevention signals.
We do not ask for sensitive data (such as health, religion or political opinions), and we ask you not to include it in your brief or files. If your materials contain photos or personal data of other people, you confirm that you are allowed to share them with us for your Order.
4. How we use your data and why we are allowed to
| Purpose | Legal basis (GDPR / UK GDPR) | Legal basis (LGPD) |
|---|---|---|
| Carrying out your Order: brief, design work, revisions and delivery of files | Performance of a contract (art. 6(1)(b)) | Performance of a contract (art. 7, V) |
| Taking payments, issuing receipts, keeping accounting and tax records | Contract and legal obligation (art. 6(1)(b) and (c)) | Contract and legal obligation (art. 7, II and V) |
| Answering messages sent through the Site or by email | Steps before a contract or legitimate interests (art. 6(1)(b) and (f)) | Preliminary procedures or legitimate interest (art. 7, V and IX) |
| Showing finished work in our portfolio, unless you opt out | Legitimate interests (art. 6(1)(f)) | Legitimate interest (art. 7, IX) |
| Keeping the Site and our systems secure, preventing fraud | Legitimate interests (art. 6(1)(f)) | Legitimate interest and fraud prevention (art. 7, IX) |
| Handling refunds, complaints and legal claims | Legitimate interests and legal obligation (art. 6(1)(c) and (f)) | Regular exercise of rights (art. 7, VI) |
| Analytics or marketing cookies, if ever used | Consent (art. 6(1)(a)) | Consent (art. 7, I) |
We do not send marketing newsletters. If we ever offer one, we will only send it if you sign up. We do not sell your personal data and we do not use it for automated decisions with legal or similarly significant effects. We do not use your files or briefs to train AI models.
5. Who we share data with
We share personal data only with service providers that help us run the business, under terms that require them to protect it and use it only on our instructions:
- Stripe, for payment processing and fraud prevention.
- Vercel, which hosts the Site.
- Email providers, which host our mailboxes and send transactional emails such as order confirmations.
- Design and file-sharing tools, such as Figma, Canva, Webflow and cloud storage, used to create and deliver your files.
- Freelance designers, only when they help on your Order, bound by confidentiality and limited to the materials they need.
We may also disclose data when required by law, by a court order or by a competent authority, or to protect our rights in a dispute. We do not sell personal information and we do not share it for cross-context behavioural advertising.
6. International transfers
We are based in Brazil and some of our providers process data in other countries, including the United States. When data is transferred internationally, we rely on safeguards recognised by law, such as adequacy decisions, standard contractual clauses approved by the European Commission, the UK addendum to those clauses, or the standard clauses and other mechanisms provided for in article 33 of the LGPD.
7. How long we keep data
- Order, payment and accounting records: 5 years after the end of the year of the Order, to meet tax obligations and the limitation periods of Brazilian consumer law.
- Briefs, feedback and the files you sent us: up to 2 years after your last Order, so we can help with updates. You can ask us to delete them earlier.
- Copies of final files: 12 months after delivery, so we can resend them if you lose them.
- Messages that do not lead to an Order: 12 months.
- Server logs: kept by our hosting provider for a short period, usually no longer than 30 days.
- Your cookie choices: 12 months, after which we ask again.
8. Your rights
Everyone. You can ask us for a copy of your data, to correct it or to delete it, and you can withdraw any consent you have given at any time. Write to privacy@studiowebr.com. We may need to confirm your identity before acting on a request. We reply as soon as possible and in any case within the deadlines set by the law that applies to you (15 days for a complete answer under the LGPD, one month under the GDPR).
Brazil (LGPD, art. 18). You have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with your consent, information about who we share data with, information about the consequences of refusing consent, and revocation of consent. You may also file a complaint with the National Data Protection Authority (ANPD).
European Economic Area and United Kingdom. You have the rights of access, rectification, erasure, restriction, portability and objection, including the right to object to processing based on legitimate interests such as portfolio use. You may complain to your local data protection authority or, in the UK, to the Information Commissioner's Office.
United States. Depending on your state, you may have the right to know what personal information we collect, to access, correct and delete it, and to opt out of its sale or sharing. We do not sell or share personal information, and we honour Global Privacy Control signals. We will not discriminate against you for exercising your rights. You may use an authorised agent, in which case we may ask for proof of authorisation.
9. Security
The Site is served only over HTTPS. Payments are handled by Stripe, which is certified to PCI DSS Level 1. We limit access to personal data and files to what is needed to carry out your Order, use strong passwords and two-factor authentication on our accounts, and delete data we no longer need. No system is completely secure, but we will tell you and the competent authority without undue delay if a breach is likely to put you at risk.
10. Children
Our services are for adults and businesses. We do not knowingly collect personal data from anyone under 18. If you believe a minor has sent us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you by email before it applies.
12. Contact
Privacy requests and questions: privacy@studiowebr.com
Postal address: Webert Rangel Oliveira de Sousa (studiowebr), R. Fortunato, 227, Vila Buarque, São Paulo, SP, 01224-030, Brazil