Privacy Policy (United States)
Last updated: November 14, 2026
This policy explains what personal information Lucca Studio collects through https://lucca.studio, how we use it, and the choices you have. It follows the structure of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar US state laws.
Short version: we collect what you send us through the contact form plus basic technical data needed to run the site. We do not sell or share your personal information for cross-context behavioral advertising, and we honor Global Privacy Control signals.
1. Who we are
Lucca Studio is a design, video editing and web studio run by Daniel Corrêa, based in Brazil.
- Business / controller: Daniel Corrêa (individual), Brazil
- Privacy contact: dan.souza.correa@gmail.com
2. Personal information we collect (last 12 months)
| CCPA category | Examples | Source | Purpose | Disclosed to (for a business purpose) |
|---|---|---|---|---|
| Identifiers | Name, email address, IP address | You (form/email); your device (IP) | Reply to inquiries, prepare quotes, deliver and secure the site | Netlify (hosting), Web3Forms (form delivery), Google (email; YouTube player, only when you press play), Adobe (video player, only when you press play) |
| Customer records / communications | Company and service of interest (both optional), message content you send us | You | Reply to you, keep a record of the conversation | Web3Forms, Google |
| Internet or network activity | Pages requested, browser type, date/time, referrer (server logs) | Your device | Operate, secure and debug the site | Netlify |
| Approximate geolocation | Country derived from IP address (not stored by us) | Your device | Show the right privacy notice and cookie choices | Netlify (computes it) |
| Inferences / analytics / advertising data | — | — | Not collected today. If added later, only as described in Section 4 | — |
We do not collect sensitive personal information (such as government IDs, financial account data, precise geolocation or health data) and ask you not to send it through the form. The site is not directed to children under 13 (or under 16), and we do not knowingly collect their data.
The contact form has no captcha: spam is filtered with a hidden field and by Web3Forms' own filters.
3. Sale and sharing
We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not sell or share personal information of consumers under 16.
Why there is no "Do Not Sell or Share" link right now: that link is only required when a business sells or shares personal information. Today the site has no advertising pixels or third-party analytics, so there is nothing to opt out of. If we ever add advertising or analytics tools that count as "selling" or "sharing", we will (a) update this policy, (b) add a "Do Not Sell or Share My Personal Information" link in the footer, and (c) keep honoring Global Privacy Control automatically.
4. Cookies and your choices
- Essential (always on): keep the site working and remember your privacy choices (e.g., the
ls_consentcookie, up to 12 months). - Analytics (on by default where allowed, you can opt out): none in use today.
- Marketing (on by default where allowed, you can opt out): none in use today.
Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a valid request to opt out of sale/sharing and of targeted advertising, and we turn Analytics and Marketing off for that browser automatically.
Portfolio previews: some portfolio items can show a live preview of a client's website. Those third-party sites may set their own cookies, so previews load only when you click them.
Portfolio videos: Some portfolio videos play through YouTube (in privacy-enhanced mode, youtube-nocookie.com) or Adobe's Behance video player. They load only when you press play, except the header video on the Ana Castela case page, which plays automatically only if you turned on "Third-party previews". Once a player loads, YouTube or Adobe receive your IP address and may store data on your device under their own privacy policies.
You can change your choices at any time with "Privacy choices" in the footer.
5. Service providers
We use these service providers, under contracts that limit their use of your data to providing services to us:
- Netlify, Inc. — hosting, content delivery, server logs (US).
- Web3Forms (operated by Web3Creative, India; servers in the US) — receives contact form submissions and forwards them to our email. Its spam filters (CleanTalk, Akismet) check the sender's IP and email.
- Google LLC (Gmail) — email inbox.
- Google LLC (YouTube) — video player for some portfolio videos, in privacy-enhanced mode (youtube-nocookie.com); loads only when you press play.
- Adobe Inc. — Behance video player for some portfolio videos; loads only when you press play.
Our business is based in Brazil, so your information may be processed in Brazil and in the United States.
We may also disclose information if required by law or to protect our rights.
6. Retention
- Contact messages and emails: up to 24 months after last contact, longer if they become part of a client contract.
- Server logs: kept by Netlify online for 30 days and archived for up to 13 months.
- Privacy choices: up to 12 months.
7. Your rights
Depending on your state, you may have the right to:
- Know / access the categories and specific pieces of personal information we hold about you;
- Delete personal information we collected from you;
- Correct inaccurate personal information;
- Opt out of sale, sharing, targeted advertising and profiling (we do none of these today);
- Limit use of sensitive personal information (we do not collect it);
- Not be discriminated against for exercising these rights.
How to make a request: email dan.souza.correa@gmail.com with the subject "Privacy request". We will verify your request by confirming control of the email address you used with us. You may use an authorized agent with your signed permission. We respond within 45 days (extendable once by 45 days if needed, with notice). If we deny a request, you may appeal by replying to our decision; we will answer the appeal within the time your state law requires.
8. Security
We use HTTPS, reputable providers, and restrict access to Daniel Corrêa. No method is completely secure.
9. Changes
We will post updates here and change the "Last updated" date.
10. Contact
Daniel Corrêa · dan.souza.correa@gmail.com