Privacy policy
Short version: we collect what is needed to take a payment and deliver a sprint, and nothing else. This site loads no advertising pixel and no analytics tracker. We do not sell, rent or trade your data, and we never will.
1. Who is responsible
The controller of your personal data, in the sense of article 5 of the Brazilian LGPD (Law 13.709/2018) and article 4 of the GDPR, is:
| Controller | Luan Oliveira da Silva, trading as Inflouno |
|---|---|
| CPF | 495.192.358-09 |
| Address | Av. Francisco Inácio Godoi Zerbinatti, 92, Jd. São Rafael 2, Araraquara, SP, 14806-853, Brazil |
| Data protection contact | privacy@inflouno.com |
The same person answers data requests in practice, which is what article 41 of the LGPD asks for in a one-person operation.
2. What we collect, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, billing address, tax number | To take payment, issue the invoice and meet tax obligations | Performance of a contract (LGPD art. 7 V, GDPR art. 6(1)(b)) and legal obligation for the invoice (LGPD art. 7 II, GDPR art. 6(1)(c)) |
| Brand name and channel handle entered at checkout | To open your slot and prepare the kick-off call | Performance of a contract |
| Material you send: footage, logos, briefs, approvals | To produce the content you bought | Performance of a contract |
| Email correspondence | Support, delivery record and evidence if a payment is disputed | Legitimate interest in running the service and defending claims (LGPD art. 7 IX, GDPR art. 6(1)(f)) |
| Server log with IP address, briefly | Security and abuse prevention | Legal obligation under the Marco Civil da Internet and legitimate interest |
| Card number and security code | We never see them. Stripe handles the card end to end on its own page | Not applicable to us |
We do not collect sensitive personal data as defined in article 5 II of the LGPD, we do not process children's data knowingly, and we take no automated decision that produces legal effects for you.
3. Who processes data on our behalf
- Stripe Payments Europe / Stripe Inc. takes the payment, stores the card data and issues the invoice. See the Stripe privacy policy.
- Vercel Inc. hosts the site and keeps short-lived server logs.
- Resend sends the transactional emails, such as your onboarding message.
- Google LLC serves the web fonts used by the page design, which means your browser contacts a Google server and that server sees your IP address.
- Cloud storage used to hand over your video files, with access limited to the link we send you.
Each of these acts on our instructions under a data processing agreement. None of them is allowed to use your data for its own purposes.
4. International transfers
Our providers are based in the United States and in the European Union, so your data leaves Brazil. Transfers out of the EU rely on the European Commission's standard contractual clauses. Transfers out of Brazil rely on article 33 of the LGPD, on the basis that they are necessary to perform the contract you entered into and are covered by contractual guarantees with each provider.
5. What we do not do
- No advertising pixel and no analytics tracker are loaded by this site.
- We do not build behavioural profiles and we take no automated decisions about you.
- We do not sell, rent or share your data with anyone for their own marketing.
- We do not send marketing email to people who only visited the site.
6. How long we keep it
| Data | Kept for |
|---|---|
| Invoices and payment records | As long as tax and accounting law requires, normally 5 to 10 years |
| Project material and correspondence | 2 years after the sprint ends |
| Raw footage you sent us | 90 days after delivery, unless you ask us to keep it |
| Server logs | 30 days |
| Cookie consent choice | Stored in your own browser, not on our servers |
When the period ends the data is deleted or anonymised.
7. Your rights
Under article 18 of the LGPD and chapter III of the GDPR you can ask us to:
- confirm whether we process data about you, and give you a copy;
- correct data that is wrong, incomplete or out of date;
- anonymise, block or delete data that is unnecessary or excessive;
- port your data to another provider in a machine-readable format;
- tell you with whom we shared it;
- withdraw a consent you gave, and know what happens if you refuse;
- object to processing based on legitimate interest, and have that objection reviewed;
- restrict processing while a request is being examined.
Write to privacy@inflouno.com. We answer within 15 days as the LGPD requires, and within 30 days for GDPR requests, free of charge. We may ask you to confirm your identity before sending personal data anywhere.
8. Complaints
If you are not satisfied with our answer you may complain to the Brazilian national data protection authority, the ANPD (gov.br/anpd), or, if you are in the EU or the UK, to the supervisory authority of your country.
9. Security
The site is served only over HTTPS. Payment happens on Stripe's own hosted checkout, so card data never touches our servers and we are not in scope for storing it. Access to project material is limited to the people working on your sprint. Secrets such as API keys live in environment variables and are never in the page source.
If a security incident happens that is likely to create risk for you, we tell you and the ANPD within a reasonable time, as article 48 of the LGPD requires.
10. Cookies
Set out separately in the cookie policy. In short, this site sets no cookies of its own.
11. Changes
If this policy changes we update the date at the top. Material changes are announced by email to clients with an active or recent sprint.