Privacy policy
Updated on November 10, 2026. Version 1.0.
This policy explains how Devir Bordado handles personal data on the website devirbordado.space, in line with Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018). It describes what the site actually does: if something changes, the text changes with it (see section 11).
1. Who is responsible
Iara Lima, founder of Devir Bordado, is the data controller and also acts as the data protection officer. For any privacy matter, write to contato@devirbordado.space.
2. In short
- The site has no accounts, does not sell data and does not show ads.
- Reading the site does not require you to give any information.
- Visit statistics (Google Analytics) only work if you allow them, and without advertising features.
- YouTube videos and Spotify playlists only load after you click.
- Your personal data is collected only if you subscribe to the newsletter, comment or write to us.
- The newsletter, comments and downloads are being activated gradually. This policy already describes how data will be handled when these features go live.
3. What data we process and why
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting the site | IP address and technical access data (browser, page requested, date and time), recorded by the hosting and network services | deliver the pages and keep the site secure and running | legitimate interest (Art. 7, IX) |
| Statistics | browsing data collected by Google Analytics (pages viewed, visit length, device type, approximate country and city), through cookie identifiers | understand, in aggregate, how the site is used | consent (Art. 7, I) |
| Your cookie choice | the choice itself (accept or decline) and its date, stored only in your browser | remember your decision for 12 months | duty to respect your consent and legitimate interest |
| Newsletter | email and date of subscription confirmation | send the lab’s news | consent (Art. 7, I) |
| Comments | name, email and comment text | publish the comment after moderation | consent (Art. 7, I) |
| Email messages | name, email and message content | reply to you | legitimate interest (Art. 7, IX) |
| Anti-bot check | technical browser signals and IP address, processed by Cloudflare Turnstile on forms | prevent automated submissions | legitimate interest (Art. 7, IX) |
| Downloads | IP address and technical request data, recorded by the service that stores the files | deliver the file you asked for | legitimate interest (Art. 7, IX) |
| Videos and playlists | the data YouTube (Google) and Spotify collect when you click to load the player, including your IP address | show the embedded content | consent, given by the click |
The email you give in comments is never shown publicly. The site’s search runs inside your browser: what you type is not sent to anyone.
We do not use data for automated decisions or to build behavior or consumer profiles.
4. Who the data passes through
Data is processed by service providers that make the site work. They process it on the lab’s behalf or, for embedded content, on their own behalf under their own policies.
- GitHub (Microsoft): hosts the site’s pages and receives the IP address of whoever accesses them.
- Cloudflare: anti-bot check (Turnstile), form functions and storage of download files. It processes data only from people who use these features, from the moment they are activated.
- Hostinger: domain registration, DNS (the site’s “address”) and mailboxes, where the messages sent to us arrive.
- Brevo (newsletter delivery): receives the email and the date of confirmation of subscribers (a subscription only counts after the confirmation link in the email is clicked), and also email delivery and open data. According to Brevo itself, data is kept on servers in the European Union.
- Google (Google Analytics): receives browsing data only if you allow statistics.
- YouTube (Google) and Spotify: receive data only if you click to load the video or playlist.
We do not sell or rent personal data, and we do not share it for advertising.
5. International transfers
These providers store and process data outside Brazil, especially in the United States and the European Union. The transfer happens so the service works and relies on the LGPD’s grounds (Arts. 33 to 36), such as your specific consent, where applicable, or protection clauses and safeguards offered by the providers.
6. How long we keep data
- Newsletter: until you unsubscribe; afterwards, only what the law requires.
- Comments: while published, or until you ask for removal. Comments rejected in moderation are deleted.
- Email messages: as long as needed to reply and keep a record of the contact.
- Statistics: Google Analytics is set to keep event data for 2 months, the shortest period the tool offers. Statistics cookies last up to 2 years in your browser if you do not delete them.
- Cookie choice: 12 months; after that the notice appears again.
- Technical access logs: for the period each provider adopts, generally short.
7. Your rights
Under Art. 18 of the LGPD you may ask for: confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share it with, information about the possibility of not consenting and its consequences, and withdrawal of consent. Make the request at contato@devirbordado.space. We will answer within 15 days for confirmation and access, and within a reasonable time for the rest. For your safety, we may ask you to confirm that the request comes from the owner of the email address.
If you believe your rights were not respected, you can also complain to Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.
8. How to withdraw consent
- Cookies and statistics: through the “Manage cookies” link in the footer of any page. See the Cookie policy.
- Newsletter: through the unsubscribe link in every email.
- Comments: ask for removal by email.
- Videos and playlists: simply do not click. To stop processing after the click, close the page; to erase what YouTube or Spotify already hold, use your account settings there.
Withdrawing consent does not affect what was done before it.
9. Children and teenagers
The site is not aimed at children and does not knowingly collect their data. If you notice that a child has sent data, write to us and we will delete it.
10. Security
We use a secure connection (https), keep access keys outside the public code, moderate comments before publication, do not display emails, and give access to data only to those who need it. No system is completely secure. In case of an incident that may cause relevant risk or harm, we will notify you and the ANPD, as the law requires.
11. Changes to this policy
We may update this policy, for example when the site gains new features. The date and version appear at the top of the page. Important changes will be highlighted on the site and, when they require new consent, we will ask again.