Privacy Policy

Last updated 27 June 2026

This policy explains what personal data is collected when you use this website, why it is collected, and what your rights are.

Who is responsible for your data

This site is run by Ana Dias, a freelance web designer (trabalhadora independente) based in Portugal (“I”, “me”). I am the data controller for the personal data described here. You can reach me at [email protected] or through the contact page.

What I collect

I only collect what I need to answer you and to deliver work you have asked for:

  • Contact details you send me. When you fill in the contact form, I receive your name, email address, the project type you select, and your message.
  • Order details. When you buy a package, you can add your business name and a short note about your project. Payments are handled by Stripe: your card details are entered on Stripe and never reach or get stored on this site. I receive confirmation of the payment, the package you bought, your email, and anything you added in those optional fields, not your full card number.
  • Basic technical data. Like most websites, the hosting provider may log standard request data such as your IP address and browser type to keep the site running and secure.

Why I use it, and the legal basis

Under the GDPR, I rely on these legal bases:

  • To reply to your enquiry and talk through your project. Legal basis: legitimate interest in responding to people who contact me.
  • To deliver, invoice, and support the work you hired me for. Legal basis: performance of our contract.
  • To keep payment and accounting records. Legal basis: a legal obligation under Portuguese tax law.
  • To keep the site secure and prevent spam and abuse. Legal basis: legitimate interest in protecting the site.

I do not sell your data, and I do not use it for advertising or automated decision-making.

Who I share it with

I use a small number of trusted providers to run the site, and each one acts as a processor that only receives the data it needs:

  • Stripe processes payments and holds the related order and customer data. See Stripe's privacy policy.
  • Resend delivers the contact-form and order emails to my inbox (and your payment confirmation to you). See Resend's privacy policy.
  • Cloudflare hosts the site, serves it through its network, stores image files, and provides the privacy-first analytics described below. See Cloudflare's privacy policy.
  • Turso hosts the database, which stores blog content and site settings only, not your personal data.

Where your data is processed

Some of these providers process data outside the European Economic Area, including in the United States. When they do, they rely on safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, so your data keeps a comparable level of protection. You can ask me for more detail at any time.

Cookies and analytics

This site uses Cloudflare Web Analytics to understand how the site is used. It is privacy first: it sets no cookies, does not track you across other websites, and does not collect personal data. It only records anonymous, aggregate information such as page views, the referring site, country, and device type. The only cookie this site sets is a secure login cookie used by me to manage the site, which ordinary visitors never receive. Stripe may set cookies that are necessary to process your payment securely at checkout. Because the site uses no non-essential or tracking cookies, there is no cookie consent banner.

How long I keep it

I keep enquiry messages for up to twelve months if we do not end up working together, and for the length of our project (plus a reasonable period afterwards) if we do. Payment and invoice records are kept for the period Portuguese tax and accounting law requires, which is currently ten years. After the relevant period, data is deleted or anonymised.

Your rights

Under the GDPR, you have the right to:

  • ask for a copy of the personal data I hold about you (access);
  • have inaccurate data corrected (rectification);
  • have your data deleted (erasure), where the law allows;
  • restrict or object to how I use it;
  • receive your data in a portable format (portability);
  • withdraw consent at any time, where I rely on consent.

To make a request, contact me at [email protected] or through the contact page, and I will respond within one month. If you believe I have not handled your data properly, you can lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or with the authority in your own EU country.

Children

This site and these services are intended for adults and are not directed at children under the age of sixteen. I do not knowingly collect data from children.

Changes to this policy

If I update this policy, I will change the “Last updated” date at the top of the page. Please check back from time to time.