Privacy Policy

The controller of your personal data is Gabrielle Boniolo Alves, trading as Limestategy, CPF 382.575.768-40, R. Macuco, 113, Jardim, Santo André, SP, 09180-400, Brazil. For anything related to privacy, including the role of data protection officer (encarregada) under the Brazilian General Data Protection Law (LGPD), contact privacy@limestategy.com.

This policy explains how we handle personal data when you visit limestategy.com, contact us, place an Order and work with us on it. It does not cover third-party websites or services you reach through links on the Site, such as Stripe's checkout page, which have their own policies.

Data you give us.

• Contact form: your name, email, topic and message.
• Orders: your email, the business name and notes you choose to add at checkout, and your name, billing address and country collected by Stripe. Card details are collected and processed by Stripe. We only see limited information such as the card brand, the last four digits and the payment status.
• Working on your Order: your answers to the brief, the links and files you send us, comments, approvals and the emails we exchange, and the email address we share documents with.

Data collected automatically. Our hosting provider processes technical data such as IP address, browser type and request times in server logs, to deliver and secure the Site. We store your cookie choices in your browser. We do not currently use analytics or advertising cookies. If we add them, they will only run after you opt in. See our Cookie Policy.

Data from third parties. Stripe tells us whether a payment succeeded and may share fraud-prevention signals.

We do not ask for sensitive data (such as health, religion or political opinions) and we ask you not to include it in your brief or files.

When you give us viewer access to an account that contains personal data about your own customers or visitors (for example an email platform or an analytics property), you are the controller of that data and we act as your processor. We access it only to carry out the audit you ordered, we do not copy or export it, we do not use it for any other purpose, we keep it confidential, and we stop accessing it when the Order is delivered. Our deliverables only include aggregated figures or anonymised examples. You confirm that you are allowed to give us this access under the law and the privacy notices that apply to your customers.

We do not send marketing newsletters. If we ever offer one, we will only send it if you sign up. We do not sell your personal data and we do not use it for automated decisions with legal or similarly significant effects. We do not use your briefs, files or deliverables to train AI models.

We share personal data only with service providers that help us run the business, under terms that require them to protect it and use it only on our instructions:

• Stripe, for payment processing and fraud prevention.
• Vercel, which hosts the Site.
• Email providers, which host our mailboxes and send transactional emails such as order confirmations.
• Document and file-sharing tools, such as Google Workspace and cloud storage, used to write and deliver your documents.
• Freelance specialists, only when they help on your Order, bound by confidentiality and limited to the information they need.

We may also disclose data when required by law, by a court order or by a competent authority, or to protect our rights in a dispute. We do not sell personal information and we do not share it for cross-context behavioural advertising.

We are based in Brazil and some of our providers process data in other countries, including the United States. When data is transferred internationally, we rely on safeguards recognised by law, such as adequacy decisions, standard contractual clauses approved by the European Commission, the UK addendum to those clauses, or the standard clauses and other mechanisms provided for in article 33 of the LGPD.

• Order, payment and accounting records: 5 years after the end of the year of the Order, to meet tax obligations and the limitation periods of Brazilian consumer law.
• Briefs, comments and the files you sent us: up to 2 years after your last Order, so we can help with follow-up questions. You can ask us to delete them earlier.
• Copies of delivered documents: 12 months after delivery, so we can resend them if you lose them.
• Messages that do not lead to an Order: 12 months.
• Server logs: kept by our hosting provider for a short period, usually no longer than 30 days.
• Your cookie choices: 12 months, after which we ask again.

Everyone. You can ask us for a copy of your data, to correct it or to delete it, and you can withdraw any consent you have given at any time. Write to privacy@limestategy.com. We may need to confirm your identity before acting on a request. We reply as soon as possible and in any case within the deadlines set by the law that applies to you (15 days for a complete answer under the LGPD, one month under the GDPR).

Brazil (LGPD, art. 18). You have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with your consent, information about who we share data with, information about the consequences of refusing consent, and revocation of consent. You may also file a complaint with the National Data Protection Authority (ANPD).

European Economic Area and United Kingdom. You have the rights of access, rectification, erasure, restriction, portability and objection, including the right to object to processing based on legitimate interests. You may complain to your local data protection authority or, in the UK, to the Information Commissioner's Office.

United States. Depending on your state, you may have the right to know what personal information we collect, to access, correct and delete it, and to opt out of its sale or sharing. We do not sell or share personal information, and we honour Global Privacy Control signals. We will not discriminate against you for exercising your rights. You may use an authorised agent, in which case we may ask for proof of authorisation.

The Site is served only over HTTPS. Payments are handled by Stripe, which is certified to PCI DSS Level 1. We limit access to personal data and files to what is needed to carry out your Order, use strong passwords and two-factor authentication on our accounts, ask for viewer access instead of passwords, and delete data we no longer need. No system is completely secure, but we will tell you and the competent authority without undue delay if a breach is likely to put you at risk.

Our services are for adults and businesses. We do not knowingly collect personal data from anyone under 18. If you believe a minor has sent us personal data, contact us and we will delete it.

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you by email before it applies.

Privacy requests and questions: privacy@limestategy.com
Postal address: Gabrielle Boniolo Alves (Limestategy), R. Macuco, 113, Jardim, Santo André, SP, 09180-400, Brazil