Instagram LinkedIn
PT EN

Privacy
Policy.

How we process personal data and images, how long we keep them and how you exercise your rights (LGPD).

Last updated November 2, 2026

1. Who is responsible for your data

The data controller is 69.301.456 REINAN LISBOA AMORIM (trading as Reinan Lisboa), no. 69.301.456/0001-98, Rua José Duarte, 288, Tororó, Salvador/BA, CEP 40050-050. The Data Protection Officer (DPO) is Reinan Lisboa, reachable at reinanlisboar@gmail.com and through the DPO form. This policy follows the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and the Brazilian Internet Civil Framework (Law No. 12,965/2014).

2. What data we process

  • Browsing the site: the hosting provider logs IP, date, time and pages visited for security and operation. We use Google Analytics (Google LLC) for anonymous visit statistics, only if you allow it under “Cookie preferences”; IP addresses are anonymized and we use no ad pixels or ad personalization.
  • Contact form: name, e-mail and message. On submit, your device’s e-mail app opens; the data reaches us by e-mail and is not stored on the site.
  • Scheduling chat: service of interest, format and time chosen, name and WhatsApp (optional). Answers stay in your browser and go to WhatsApp only if you tap the send button.
  • Client Area: name, company, tax ID, e-mail, phone, password (stored only in encrypted form), service and payment history, support messages, reviews and access logs (IP, date and time).
  • Photos and videos: images of clients and of people photographed or filmed in the work, which may reveal sensitive data such as health, religion or beliefs (for example coverage of religious events, health and aesthetics).
  • Payments: processed by Pix and card providers. We do not store card numbers.
  • Marketing e-mails and messages: your contact and the date of your opt-in, if you chose to receive them.

3. What we use it for and the legal basis

  • Providing the contracted service, delivering galleries, billing and issuing invoices: performance of a contract (art. 7, V).
  • Answering quote requests and scheduling meetings: preliminary procedures related to a contract (art. 7, V).
  • Platform security, fraud prevention and access logs: legitimate interest (art. 7, IX) and legal obligation (Internet Civil Framework, art. 15).
  • Keeping tax and contract records: legal obligation and regular exercise of rights (art. 7, II and VI).
  • Sending news, offers, content and behind-the-scenes by e-mail or WhatsApp: consent (art. 7, I), always optional and separate from submitting the form.
  • Showing images of people in the portfolio, site and social media: consent or written image-use authorisation.
  • Optional cookies and embedded videos: consent.

4. Photographic and video images

Images of people are personal data. When they show health, religion or other sensitive information, we use them only with specific consent or when needed to perform the contract. In the portfolio we use only authorised material. Images of children and teenagers are used only with a legal guardian’s authorisation.

Copyright and data protection are different things: even if the client holds a licence to use a photo, the person photographed keeps their data-subject rights and may ask for the image to be removed through the DPO. We handle the request within 15 days, removing it from the site, social media and new publications; material already printed or given to third parties is outside our control.

5. Marketing by e-mail and WhatsApp

We only send news if you tick the opt-in box, which is unticked by default and separate from the submit button. Asking for a quote does not require accepting marketing. To unsubscribe use the link in our e-mails, reply “stop” or write to the DPO. We process it within 48 hours and keep only what is needed to avoid messaging you again.

Contracting clients. Anyone who hires a service and creates Client Area access receives, by e-mail and WhatsApp, communications about the service itself: access, album and approval notices, bookings, invoices, tax documents and news from the studio related to what was hired. This is done to perform the contract and for legitimate interest (LGPD, art. 7, V and IX), and is recorded when you accept this Policy on first login. You can ask to stop receiving news at any time without losing the service, through the DPO channel. Essential service messages, such as billing and delivery, are still sent.

Portfolio use of the material. By accepting this Policy and the Terms of Use on first login, the client authorises the studio to show excerpts of the work in its portfolio, website and social media, as set out in the portfolio-use clause of the Terms. The authorisation can be withdrawn by written request, and images of identifiable third parties follow the rules in the images section.

6. Cookies and browser storage

We only use what is essential: your cookie choice and the welcome animation (browser local storage) and, in the Client Area, session control. Google Analytics (_ga cookies) and YouTube videos are optional and work only after your consent; YouTube (Google) may set its own cookies. The site’s fonts are hosted by us, with no calls to Google. You can change or withdraw your choice at any time under “Cookie preferences” in the footer of the site and of the Client Area.

7. Who we share it with

We do not sell data. We share the minimum necessary with: the hosting provider and cloud storage for files; payment providers (Pix and card); the invoicing service; WhatsApp (Meta), when you choose to contact us there; YouTube (Google), when you enable videos; and public authorities when required by law or court order.

8. International transfers

Some providers may keep servers outside Brazil. In those cases we choose vendors with adequate protection safeguards, as required by art. 33 of the LGPD.

9. How long we keep it

  • Online galleries: 12 months after delivery. Raw files: up to 12 months.
  • Registration, contracts, payments and invoices: for the length of the relationship and 5 years after, for tax purposes and legal defence.
  • Access logs (IP, date and time): at least 6 months, as required by the Brazilian Internet Civil Framework.
  • Support messages: 24 months.
  • Marketing: until you withdraw consent.
  • After that, data is deleted or anonymised, including from backups, in the next rotation cycle.

10. Security

We use HTTPS across the whole domain, encrypted password storage, protection against repeated login attempts, expiring sessions, private gallery links with expiry and optional password, separation between each client’s galleries, restricted access and a log of sensitive actions. No system is fully immune; if an incident that may cause relevant risk or harm occurs, we will notify you and the ANPD, as required by art. 48 of the LGPD.

11. Your rights

At any time you may: confirm whether we process your data; access and correct it; request anonymisation, blocking or deletion; request portability; learn who we share it with; withdraw consent; object to processing; and request review of automated decisions. Use the DPO channel. We reply within 15 days. You may also complain to Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.

The Support assistant in the Client Area is automated and makes no decisions affecting your rights; any case is passed to a person.

12. Children and teenagers

Our site is not aimed at people under 18. Images of children and teenagers are processed only with authorisation and in their best interest.

13. Updates

We may update this policy. The current version is always this page, in force since November 2, 2026. Important changes will be announced.