Privacy Policy
Last updated: November 14, 2026
Applies to: visitors located in Brazil and in the Americas (outside the United States)
This policy explains what personal data Lucca Studio collects through https://lucca.studio, why, and what you can do about it. It is written to meet Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD, Law No. 13,709/2018), and we apply the same standard to visitors from other countries in the Americas.
A Portuguese version of this policy is available: Versão em português. If the two versions differ, the Portuguese version prevails for visitors in Brazil.
1. Who we are (controller)
Lucca Studio is a design, video editing and web studio run by Daniel Corrêa, based in Brazil.
- Controller: Daniel Corrêa (individual), Brazil
- Contact for privacy matters: dan.souza.correa@gmail.com
Data protection officer (Encarregado)
As a small processing agent, we have not appointed an encarregado, as permitted by ANPD Resolution CD/ANPD No. 2/2022. Questions, requests and complaints about your data can be sent directly to us at dan.souza.correa@gmail.com.
2. What we collect and why
| What | When | Why (purpose) | Legal basis (LGPD art. 7) |
|---|---|---|---|
| Name, email address, company and service of interest (both optional), message content | You send the contact form | To answer you and, if you ask, prepare a quote or proposal | Steps prior to a contract at your request (art. 7, V) and our legitimate interest in replying to inquiries (art. 7, IX) |
| Emails you exchange with us | You write to dan.souza.correa@gmail.com | Same as above; keep a record of our conversation | Same as above |
| Technical data: IP address, browser type, pages requested, date/time | Automatically, when any page loads | To deliver the site, keep it secure and fix errors (server logs kept by our host) | Legitimate interest (art. 7, IX) |
| Approximate country (derived from IP address, not stored by us) | Automatically, when any page loads | To show you the right privacy notice and cookie banner | Legitimate interest (art. 7, IX) / compliance with legal obligation (art. 7, II) |
| Your cookie choices | When you use the cookie banner | To remember your choices | Compliance with legal obligation (art. 7, II) |
| Analytics / marketing cookies | Only if you accept them | To understand how the site is used / measure advertising | Consent (art. 7, I) — none active today |
We do not ask for sensitive personal data (art. 5, II) and we ask you not to send it through the form. The site is not directed at children or adolescents.
The contact form has no captcha: spam is filtered with a hidden field and by Web3Forms' own filters.
3. Cookies and similar technologies
- Essential (always on): needed for the site to work and to remember your privacy choices (for example the
ls_consentcookie, kept for up to 12 months). These do not require consent. - Analytics (off unless you accept): none in use today. If we add any, they will only run after you opt in.
- Marketing (off unless you accept): none in use today. If we add any, they will only run after you opt in.
Portfolio previews. Some portfolio items show a live preview of a client's website inside a frame. Those third-party sites may set their own cookies, so previews only load when you click them (or after you accept the relevant cookie category). The third-party site's own privacy policy applies to that content.
Portfolio videos. Some portfolio videos play through YouTube (in privacy-enhanced mode, youtube-nocookie.com) or Adobe's Behance video player. They load only when you press play, except the header video on the Ana Castela case page, which plays automatically only if you turned on "Third-party previews". Once a player loads, YouTube or Adobe receive your IP address and may store data on your device under their own privacy policies.
You can change your choices at any time using "Privacy choices" in the footer.
4. Who we share data with
We do not sell your personal data. We share it only with service providers that process it on our behalf (operadores):
| Provider | Role | Location |
|---|---|---|
| Netlify, Inc. | Website hosting and delivery; server logs | United States (global CDN) |
| Web3Forms (operated by Web3Creative, India) | Receives contact form submissions and forwards them by email; uses spam-filtering sub-processors (CleanTalk, Akismet) that receive the sender's IP and email | India; servers in the United States (AWS), with sub-processors in the US and the EU |
| Google LLC (Gmail) | Email inbox where we receive and answer messages | United States / global |
| Google LLC (YouTube) | Plays some portfolio videos in privacy-enhanced mode (youtube-nocookie.com); loads only when you press play, and then receives your IP address | United States / global |
| Adobe Inc. (Behance video player) | Plays some portfolio videos; loads only when you press play, and then receives your IP address | United States / global |
We may also disclose data when required by law, court order or a competent authority, or to defend our rights.
Links to Instagram, LinkedIn and Behance take you to those platforms, which have their own privacy policies. We do not embed their tracking on this site.
5. International transfers
Some of the providers above store data outside Brazil, mainly in the United States. We rely on the mechanisms allowed by LGPD art. 33, such as the standard contractual clauses in our providers' data processing agreements (Netlify and Web3Forms publish theirs), and the ANPD's rules on international transfers (Resolution CD/ANPD No. 19/2024).
6. How long we keep data
- Contact form messages and email exchanges: up to 24 months after our last contact, or longer if they become part of a client contract (then, for as long as legally required).
- Server logs held by Netlify: access logs are kept online for 30 days and archived for up to 13 months, under Netlify's data processing agreement.
- Cookie choice record: up to 12 months, after which we ask again.
7. Your rights (LGPD art. 18)
You can ask us at any time, free of charge, to:
- confirm whether we process your data;
- access your data;
- correct incomplete, inaccurate or outdated data;
- anonymize, block or delete data that is unnecessary, excessive or processed in breach of the LGPD;
- port your data to another provider;
- delete data processed based on your consent;
- know which public and private entities we shared your data with;
- know that you can refuse consent and what happens if you do;
- withdraw consent at any time.
You can also object to processing based on legitimate interest, and ask for a review of decisions made solely by automated means (we do not make any).
How: email dan.souza.correa@gmail.com. We may ask you to confirm your identity. We aim to reply within 15 days.
Complaints: you can file a complaint with Brazil's National Data Protection Authority (ANPD — Autoridade Nacional de Proteção de Dados, https://www.gov.br/anpd). We would appreciate the chance to resolve your concern first.
Outside Brazil: if you are in another country in the Americas, you can exercise the same rights by writing to us, and you may also contact your local data protection authority.
8. Security
We use reputable providers with encrypted connections (HTTPS) and limit access to your data to Daniel Corrêa. No system is 100% secure; if a security incident may cause you relevant risk or damage, we will notify you and the ANPD as required by law.
9. Changes
We may update this policy. The date at the top shows the latest version. Significant changes will be highlighted on the site.
10. Contact
Daniel Corrêa · dan.souza.correa@gmail.com