Privacy Policy

Last updated

This policy explains what personal data this website collects, why it is collected, how long it is kept, who else processes it, and what you can ask me to do with it. It applies to mayarasousa.com and to anyone who contacts me through it.

1. Who is responsible

Mayara Sousa de Oliveira is the data controller for this website. The business is registered in Brazil as a Microempreendedor Individual (MEI), CNPJ 38.363.484/0001-06, São Paulo, SP.

Everything about your data goes to hi@mayara.design. That address is the contact channel the LGPD requires, and it reaches me rather than a helpdesk.

2. Which law applies, and where you are

People read this site from all over the world. Rather than sorting visitors into legal regimes and giving some of you fewer rights than others, I apply one standard, the strictest one, to everybody.

Specifically: the LGPD (Lei 13.709/2018) applies because the business is registered in Brazil. The GDPR applies because this site is offered to people in the European Economic Area, and the UK GDPR for the same reason in the United Kingdom. If you are somewhere the rules are lighter or absent, which for a business this size includes most of North America, you get the same rights anyway. It is simpler for me to run and better for you.

3. What is collected

When you use the contact form

Your name, your email address, the service you selected, and the content of your message. If you ticked the newsletter box, that opt-in is recorded too, with the date and time. There are no hidden fields.

When you email me directly

Your email address and whatever the email contains.

If you opt in to the newsletter

Your email address, held separately from your enquiry, for the purpose described in section 6.

When you visit the site

My hosting provider keeps standard server logs, which include IP addresses, browser and device information, and timestamps. These are used to keep the site running and secure.

If, and only if, you accept the cookie banner, Google Analytics collects information about your visit. See section 5. If you decline, nothing is requested from Google at all.

Either way I keep a record that you answered the banner: the date, what you chose, and a one-way hash of your IP address and browser. The law requires me to be able to show that consent was given, and the hash is how I do that without keeping a list of IP addresses. It cannot be turned back into your address.

What is never collected

I do not ask for sensitive personal data: health, biometrics, racial or ethnic origin, political or religious views, or anything comparable. I would rather you did not send it. There is no automated decision-making and no profiling that produces legal effects.

This site is not aimed at children, and I do not knowingly collect data from anyone under 18. If you believe a child has sent me something, email me and I will delete it.

4. Why it is collected, and the legal basis

  • To reply to your enquiry. Legal basis: taking steps at your own request before entering into a contract. You asked me something; answering it is the whole point. I deliberately do not ask you to consent to this, because consent is not the right basis for it and asking for it would only add a box to tick.
  • To send you the newsletter. Legal basis: your consent, given by ticking the newsletter box. You may withdraw it at any time, from any email I send.
  • To deliver a project. Legal basis: performance of a contract. This covers proposals, files, correspondence and project management once we are working together.
  • To keep accounting records. Legal basis: legal obligation under Brazilian tax and commercial law.
  • To measure how the site is used. Legal basis: your consent, given through the cookie banner. You can change or withdraw it at any time from the cookie settings link in the footer.
  • To show that consent was given. Legal basis: legal obligation. The GDPR requires me to be able to demonstrate it, which is why the record described in section 3 exists.
  • To keep the site online and secure. Legal basis: legitimate interest. This covers the server logs above.

5. Cookies and analytics

This site uses Google Analytics 4 to count visits and see which pages people read. It sets cookies, so under European and Brazilian law it needs your consent first. Nothing is requested from Google until you accept: not the tracking library, not a cookieless ping, nothing at all. Declining costs you no part of the site.

Google Analytics is provided by Google, and data may be transferred to the United States. It is configured so that Google may not use the data for its own products and services, and GA4 anonymises IP addresses by design.

There is no advertising tracking of any kind here. Nothing follows you to other sites, nothing builds a profile of you, and nothing is shared with an advertising network.

Changing your mind

Use the cookie settings link in the footer at any time. Declining stops the tracking immediately, and you can also clear this site's cookies in your browser.

Embedded content

The videos on the home page are static images until you click play. Nothing loads from YouTube before that, and when it does it loads from youtube-nocookie.com, which does not set tracking cookies. Once you click play, YouTube's own privacy policy applies.

One typeface is served by Adobe Fonts, which means your browser requests it from Adobe; Adobe's privacy policy covers that request. All other fonts are served from this site.

6. The newsletter

The contact form has exactly one checkbox, and it is this. It is deliberately separate from your enquiry: asking me a question is not the same as asking to be marketed to, and neither the GDPR nor the LGPD allows the two to be bundled. It arrives unticked, and I will never add you to the list on the strength of an enquiry alone.

If you tick it, I will use your email address to send occasional updates about my work and what I am building. Every email identifies who it is from, carries a postal address, and has a working unsubscribe link. That is what Canadian anti-spam law requires, and it is a decent standard to hold to everywhere. Unsubscribing takes effect immediately.

7. How long it is kept

  • Enquiries that do not become projects: up to 24 months, then deleted.
  • Client records: for the duration of the project, then for as long as Brazilian tax and commercial law requires me to keep them, which is currently five years.
  • Newsletter subscriptions: until you unsubscribe.
  • Analytics data: according to the retention setting on the Google Analytics property.
  • Consent records: kept while they are useful as proof, and cleared periodically.
  • Server logs: according to my host's standard retention window.

You can ask me to delete anything sooner. See section 10.

8. Who else processes your data

I work alone, and this site runs on very little. Three services process data on my behalf, each under a data processing agreement:

  • Hostinger hosts the site, and hosts the contact@mayarasousa.com mailbox. That covers the server logs and the database holding enquiries and consent records.
  • Porkbun handles email for the mayara.design domain, which is the address enquiries are sent to.
  • Resend delivers the email when you use the contact form, and holds the newsletter list if you opted in.
  • Google provides the analytics in section 5, and only ever sees visitors who accepted the cookie banner.

There is no third-party form service. The contact form is part of this site, so a message sent through it goes from here to Resend to my mailbox, and through nobody else.

Because the business is in Brazil, this site is served to Europe, and several providers are American, your data may be processed in more than one country. Transfers out of the European Economic Area rely on an adequacy decision, the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. Brazil holds an adequacy decision from the European Commission. Transfers under the LGPD rely on the equivalent mechanisms in Articles 33 to 36 of that law.

Data would also be disclosed where a court or the law required it.

9. How your data is kept safe

The site is served over HTTPS. The accounts that hold your data (my inbox, the form entries, the newsletter list) are protected by unique passwords and two-factor authentication, and nobody else has access to them. Providers are chosen partly on their own security posture and are bound by data processing agreements.

No system is perfect. If there is ever a breach that puts your rights at risk, the LGPD and the GDPR both require me to notify the relevant authority and, where the risk is high, to tell you directly. I would do that.

10. Your rights

Under both the GDPR and the LGPD you can ask me to confirm whether I am processing your data at all, to give you a copy of it, to correct anything that is wrong, to delete it, to block or restrict how it is used, to anonymise anything unnecessary or excessive, to hand it over in a portable format, and to object to processing. You can also ask which public or private bodies I have shared it with, ask what happens if you refuse consent before you decide, and withdraw any consent you have already given. Withdrawing consent does not affect processing that was lawful before you withdrew it.

The LGPD additionally gives you the right to ask for a human review of a decision made solely by automated processing. I do not make any such decisions, but the right stands.

Email hi@mayara.design and say which right you want to exercise. I will respond within 15 days. That is the LGPD's limit, and comfortably inside the GDPR's one month. There is no form and no fee, and you do not have to explain why.

If you are not satisfied with how I have handled your request, you can complain to a regulator. In Brazil that is the ANPD (gov.br/anpd). In the European Economic Area it is the supervisory authority where you live, where you work, or where the problem happened. In France that is the CNIL (cnil.fr). In the United Kingdom it is the ICO (ico.org.uk). If you are somewhere without a data protection regulator, write to me and I will treat your request exactly as I would treat anyone else's.

11. Changes to this policy

If I add or remove a service that affects anything described here, I will update this page and change the date at the top. Where a change is significant and I have a way to contact you, I will do so rather than rely on you finding it here.

Written to describe how this site actually behaves. It is not legal advice. Because the business is Brazilian and the audience is partly European, it should be reviewed by someone who knows both the LGPD and the GDPR before launch.