Privacy policy
How YRV Design processes and protects personal data across its website, forms, accounts, payments, support, analytics and integrations.
Last updated: September 6, 2026.1. Controller and contact
The controller is YRV Design, trading name of 65.234.837 YOSDELVIS DE LA ROSA VEGA - ME, Brazilian CNPJ 65.234.837/0001-40, Microempreendedor Individual (MEI), operating in São José/SC, Brazil. Privacy contact: contact@yrvdesign.com.
While the Brazilian small-processing-agent regime applies, YRV Design maintains this direct channel for data subjects and follows the differentiated ANPD obligations that apply.
2. Scope
This policy covers yrvdesign.com, forms, Assistant, business WhatsApp, accounts, client panel, contracting, payments, support, notifications, projects, analytics and related administrative processes.
3. Data we may process
Identification/contact: name, email, phone/WhatsApp when provided, language and information voluntarily submitted in a request.
Account/security: internal identifiers, hashed password, verification status, sessions, temporary codes, access dates and technical device/network references used to prevent unauthorized access.
Contracting/billing: service, scope, price, billing model, acceptance, dates, purchase/subscription status and Stripe technical references. YRV Design does not receive or store full card numbers or CVC.
Projects/support: domains, progress, project files or links, communications, tickets, notifications and notes needed to deliver the service.
Navigation/campaign data, only with Analytics permission: pages, landing/referrer, approximate duration, interactions, language, time zone, screen size, UTM data, gclid/wbraid/gbraid and configured attribution parameters; random visitor/session identifiers; IP for technical/security purposes, including protected versions, and approximate IP-derived location such as country, region or city. Device GPS is not used for this analytics.
Advertising, only with Advertising permission: Google Ads may process cookies/identifiers and events for attribution and conversion measurement under its policies.
4. Purposes
Reply to enquiries/quotes; carry out requested pre-contract steps; create/authenticate accounts; formalize contracts; process payments; deliver projects; manage support and transactional communications; protect accounts; prevent fraud/abuse; meet legal, tax and accounting duties; manage rights and claims.
With permission, measure website use/performance, understand campaign sources, improve experience and measure advertising/conversions.
5. Legal bases
Depending on the operation: requested pre-contract measures and contract performance, legal/regulatory obligations, regular exercise of rights, legitimate interests for security/operations when compatible with data-subject rights, and consent for optional processing that depends on it, including Analytics and Advertising.
Reading the privacy policy when submitting a form does not make consent the universal basis. Data needed to answer a requested enquiry may be processed to take requested pre-contract measures. Where processing relies on consent, it can be withdrawn free of charge for future processing.
6. Forms, Assistant and WhatsApp
Forms collect data needed to understand and answer the request. The Assistant may process conversation text and necessary business context; do not submit passwords, full card details or unnecessary secrets.
Business WhatsApp conversations/files may be retained by YRV Design when needed for service, proof of instructions, projects or support. Meta/WhatsApp also processes information under its own policies.
7. Payments and Stripe
Stripe receives payment-method data directly. YRV Design may send name, email, internal reference, service, amount and minimum contract metadata, and retain customer, Checkout, payment, price, invoice/subscription identifiers and statuses for reconciliation, renewals, refunds, cancellation and support.
8. Account, panel and files
Private information is linked to the authenticated account and separated by user/client. A URL alone does not grant panel access. Only authorized YRV Design personnel access the information necessary to provide and manage the services.
YRV Design may use Google Drive to store certain private client files and Google Workspace to operate business email, with data limited to what each function requires.
9. Security
Reasonable safeguards include HTTPS, secure sessions, HttpOnly/SameSite, CSRF protection, password hashing, email verification, attempt limits, access controls and separation of private areas. No system can guarantee zero risk.
Technical device/network information used for security is not used for precise commercial geolocation.
10. Providers and international transfers
Hosting/database, DNS/security, technical IP geolocation when configured, Google Workspace/Drive, Stripe, Meta/WhatsApp and AI providers may participate as processors or independent controllers depending on the function. Sharing is limited to what is necessary.
Where an operation is an international transfer subject to the LGPD, it must have a valid legal basis and an ANPD-recognized transfer mechanism, such as adequacy, standard contractual clauses, binding corporate rules or another permitted route.
11. Analytics, advertising and choices
First-party analytics and Google Ads activate on public pages only after permission for the relevant category. Account, client panel, payment and contract pages are excluded from YRV Design optional measurement.
Your choice is stored in the browser and can be changed through “Privacy settings”. Details: https://yrvdesign.com/en/cookies/.
12. Retention
Data is retained for as long as needed for its purpose and applicable tax, accounting, contractual or legal-defence periods. Security codes expire quickly.
First-party analytics currently has a configured retention of up to 365 days. Account, contract, billing, project and support data follow their own purposes and obligations. Data no longer required may be deleted, anonymized or restricted.
13. Your rights
You may request confirmation, access, correction, anonymization/blocking/deletion of unnecessary or unlawful data, portability where applicable, deletion of consent-based data subject to legal exceptions, sharing information, information about the option/consequences of refusing consent, withdrawal, objection and review/information about solely automated decisions where applicable.
Requests are free through https://yrvdesign.com/data-deletion/ or contact@yrvdesign.com. Proportionate identity verification may be required. If immediate action is not possible, we will explain the reason or applicable process. Deadlines follow the LGPD and ANPD rules, including applicable differentiated rules for small processing agents.
If a right is not resolved, lawful channels before the ANPD and, in consumer relationships, consumer-protection bodies remain available.
14. Children and sensitive data
Services are not specifically directed to children and we do not deliberately request sensitive personal data for ordinary contracting. Projects requiring special categories are assessed for necessity, minimization, legal basis and safeguards.
15. Incidents
Incidents presenting relevant risk or damage will be contained, assessed, recorded and communicated to data subjects and the ANPD when legally required, within the deadline applicable to the circumstances and regulatory regime.
16. Changes
This policy may change for legal, technical, provider or purpose changes. The current version is published here. Terms: https://yrvdesign.com/terms/. Cookies: https://yrvdesign.com/en/cookies/.