← Back
Privacy

Privacy Policy

Last updated:

01Who is responsible

The controller of the personal data processed on this site and in the studio's services is Vitor Sayão Prado, an individual operating as Estúdio LAPA (a branding and design studio), based in Indaiatuba, SP, Brazil.

Vitor also acts as the data protection officer (encarregado). For any privacy request or question: contato@estudiolapa.com.br.

In Italy, the studio's strategist Fernando Donea represents LAPA in Abruzzo. Italian and other EU data subjects may write to the same e-mail address.

02Site visitors, cookies and local storage

We use no analytics, no advertising pixels and no tracking cookies. The site only uses your browser's local storage to remember your language, your preferences, the fact that you have seen the intro animation and your brief draft (for up to 7 days). This data stays on your device and you can erase it at any time in your browser settings.

The hosting provider keeps access logs (IP address and browser) for security and operation. The legal basis is legitimate interest (GDPR, art. 6(1)(f); LGPD, art. 7, IX).

When the site loads, your IP address is also seen by third parties that deliver files: Google Fonts (only the variable typefaces of the home animation), cdnjs (Cloudflare) and jsDelivr (animation and PDF libraries).

03Brief form and contact

If you fill in the brief, we receive your name, e-mail, phone/WhatsApp, company and project information. We use it to reply and to prepare a proposal.

Legal basis: steps at your request prior to entering into a contract (GDPR, art. 6(1)(b); LGPD, art. 7, V). The data is stored in Supabase, and the studio owner receives an internal e-mail notification sent through Resend. We do not use the brief for newsletters or spam.

04Clients: quotes, proposals and project portal

When you become a client, we process your name, company, contacts and project data to prepare quotes and proposals, carry out the work and follow the project in the portal.

When a quote is e-signed we record the signer's name, date and time, IP address and browser as proof of acceptance.

Legal basis: performance of a contract and establishment or defence of legal claims (GDPR, art. 6(1)(b) and 6(1)(f); LGPD, art. 7, V and VI).

05Business prospecting (LAPA Radar)

To find businesses that could benefit from branding and design, we use public business data from Google Maps/Places and from the business's own website: business name, address, public phone, e-mail and Instagram, and website.

We use it to make an individual, manual first contact offering our services. Legal basis: legitimate interest (GDPR, art. 6(1)(f); LGPD, art. 7, IX and art. 10).

  • The analysis of a business is assisted by an AI model (Google Gemini), which receives only the business's public data.
  • We do not send automated mass messages. Every first message says where we found the contact and how to ask us to stop.
  • If you ask not to be contacted, we honor it permanently: we keep only an irreversible code (hash) so we never reach out again.
  • In Italy and the European Union we use only the business's institutional channels.

Received a message from us and want it to stop? Reply to it or write to contato@estudiolapa.com.br.

06Who receives data and international transfers

We do not sell personal data. We use providers that process data on our behalf (processors):

  • Vercel: website hosting (USA).
  • Supabase: database and file storage.
  • Resend: internal notification e-mails to the studio owner.
  • Google: Maps/Places, Gemini and Fonts.
  • Cloudflare (cdnjs) and jsDelivr: library delivery networks.

Some of these providers operate outside Brazil and the EU. International transfers rely on the providers' standard contractual clauses (GDPR, ch. V; LGPD, art. 33).

07How long we keep data

  • Briefs that did not become a project: up to 24 months.
  • Prospected businesses with no interaction: deleted after 12 months (we keep only a minimal hash to honor opt-out requests).
  • Clients' contractual and financial records: 5 years, for tax and legal obligations.
  • Backups: rotated within 8 weeks.
  • Browser local storage: on your device; the brief draft expires after 7 days.

08Your rights

Under the GDPR (arts. 15 to 22) you can request access, rectification, erasure, restriction, portability and object to processing. Under the Brazilian LGPD (art. 18) you can also ask for confirmation of processing, anonymization, information about sharing and revocation of consent.

Send your request to contato@estudiolapa.com.br. We reply within 15 days. You may also lodge a complaint with the Garante per la protezione dei dati personali (garanteprivacy.it) in Italy or with your local data protection authority, or with Brazil's ANPD (gov.br/anpd).

09Security

Connections are encrypted (HTTPS/HSTS). Access to data is restricted to two administrators, the database uses row-level security and backups are private.

If a security incident affects personal data, we notify the ANPD and the affected people as required by law.

10Changes to this policy

We may update this policy when our practices change. The date of the last update is shown at the top of the page.

11Contact

Questions, requests or complaints about your data: contato@estudiolapa.com.br (Vitor Sayão Prado, data protection officer).