Who we are
Southlark Studio ("the studio", "we", "us") is a remote web design studio, registered in Brazil, that designs and builds landing pages for clients worldwide. We are the controller of the personal data described in this policy.
Southlark Studio is a trade name of Gestia Soluções em Tecnologia Ltda, registered in Brazil under CNPJ 63.091.947/0001-75, based in Novo Hamburgo, Rio Grande do Sul.
This policy covers southlarkstudio.com and the emails we exchange with you about an inquiry or a project. For questions about it, write to privacy@southlarkstudio.com.
What we collect
When you send an inquiry
The form on our plan pages asks for your name, email address, business name, current website, the plan you're interested in and a message. Only your name and email are required. The form also includes hidden anti-spam checks; they are not used to identify you.
When we work together
If you become a client, we also handle the brief you fill in, the content and materials you send us (text, images, logos, references), our email correspondence, and the details needed to invoice you, such as your name, business name, email and billing address. Payments are processed by our payment provider; we never see or store your full card or bank account numbers.
When you browse the site
- Server logs. Our hosting provider automatically records technical data for each request, such as IP address, browser and device type, the page requested and the time. This is needed to deliver the site and keep it secure.
- Analytics, only with your consent. If you accept analytics, Google Analytics collects information about how you use the site: pages viewed, approximate location (country or city), device and browser type, the site that referred you and interactions such as sending the inquiry form. Google Analytics 4 does not log or store full IP addresses.
We do not use advertising pixels, and we do not knowingly collect sensitive data. Please don't send us any.
How we use it and why
Under the EU and UK General Data Protection Regulation (GDPR), we need a lawful basis for each use of personal data. These are ours:
- Replying to your inquiry and preparing a proposal: taking steps at your request before entering into a contract.
- Delivering your project, sending invoices and support: performance of our contract with you.
- Keeping invoices and accounting records: compliance with our legal obligations, including tax law.
- Analytics: your consent, which you can withdraw at any time.
- Server logs, spam prevention and site security: our legitimate interest in keeping the site available and protected from abuse.
We don't send marketing newsletters, and we don't use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
Cookies and analytics
This site doesn't set any cookies of its own. On your first visit, a consent banner asks whether you accept analytics. Until you click Accept, nothing from Google loads and no analytics cookies are set.
If you accept, Google Analytics 4 runs with Google Consent Mode v2 set to analytics only: advertising storage, ad personalization and ad user data stay denied. Google Analytics then sets the _ga and_ga_<ID> cookies, which last up to 2 years.
Your choice is saved in your browser's local storage (not in a cookie) so we don't ask again on every page. You can change it at any time with the Cookie settings link in the footer. Clearing your browser storage also resets it.
Who we share it with
We share personal data only with service providers that process it on our behalf, under contracts that require them to protect it and use it only to provide their service:
- Vercel (United States): hosting of this site and its server logs.
- Resend (United States): delivery of the emails generated by the inquiry form, including the message we receive and the confirmation you receive.
- Google: Google Analytics, only if you accept analytics.
- Our payment provider (United States): processing invoice payments by ACH bank transfer or card.
- Our email and file storage providers: our day-to-day correspondence and project files.
We may also share data with professional advisers such as our accountant, or when required by law or to protect our legal rights.
We don't sell your personal information, we don't share it for cross-context behavioral advertising, and we don't use advertising pixels.
International transfers
The studio operates from Brazil, and several of our service providers are based in the United States. This means your data may be processed outside your country, including outside the European Economic Area and the United Kingdom.
When we transfer personal data from the EEA or UK, we rely on appropriate safeguards: an adequacy decision where one applies (for example, the EU-U.S. Data Privacy Framework for certified providers) or Standard Contractual Clauses approved by the European Commission and their UK equivalents. Contact us for more information about these safeguards.
How long we keep it
- Inquiries that don't become a project: up to 12 months after our last contact, then deleted.
- Client project records, invoices and correspondence: for the duration of the project and then for 5 years, to meet tax and accounting obligations and to handle any claims.
- Analytics data: up to 14 months in Google Analytics, after which it is deleted automatically.
- Server logs: a short period set by our hosting provider, generally no longer than 30 days.
- Your consent choice: in your browser until you change it or clear your browser storage.
Your rights
Wherever you live, you can ask us what personal data we hold about you, get a copy, have it corrected or deleted, and withdraw any consent you gave. Email privacy@southlarkstudio.com with your request. We may ask you to confirm your identity before acting on it, and we'll never charge you or treat you differently for asking. To withdraw consent for analytics, use Cookie settings in the footer.
The sections below add what the law of your region gives you on top of that.
If you are in the United States
Several US states, including California, Colorado, Connecticut, Virginia and Texas, have consumer privacy laws. Depending on where you live, they give you the right to:
- know which categories and specific pieces of personal information we collect, and why;
- have it corrected or deleted;
- get a copy in a portable format;
- opt out of its sale, of sharing for targeted advertising, and of profiling;
- appeal if we decline your request.
We don't sell or share personal information as those laws define it, we don't use it for targeted advertising, and we don't profile you. The categories we collect are the ones listed inWhat we collect: identifiers and contact details you give us, the content of your messages and project materials, invoicing details, and internet activity such as server logs and, with your consent, analytics.
To make a request, email privacy@southlarkstudio.com. An authorized agent can also make one for you with your written permission. We'll confirm receipt within 10 business days and reply within 45 days. If we decline, we'll explain why, and you can appeal by replying to that email; we'll answer the appeal within 60 days.
If you are in the EU or the UK (GDPR)
If you are in the European Economic Area or the United Kingdom, you also have the right to:
- restrict how we process your data;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing that happened before;
- lodge a complaint with the data protection supervisory authority in your country.
We'll reply within one month. We'd appreciate the chance to address any concern before you contact an authority, but you're free to do so at any time.
If you are in Brazil (LGPD)
Under Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD), you can ask us to confirm whether we process your data; access, correct, anonymize, block or delete it; port it to another provider; learn which entities we share it with; and revoke your consent. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD). Send any request to privacy@southlarkstudio.com.
Security
The site is served only over HTTPS, access to inquiry and project data is limited to the studio, and we use established providers with their own security programs. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data and will notify you and the relevant authorities of a breach where the law requires it.
Children
Our services are for businesses and professionals. This site is not directed at children under 16, and we don't knowingly collect their personal data.
Changes to this policy
We may update this policy when our services or the law change. The date at the top of the page shows the latest version. If a change affects what we collect for analytics, we'll ask for your consent again.
Contact us
For any question about this policy or your personal data, write to privacy@southlarkstudio.com. Our terms of service are on the Terms page.