How we handle your data.

Data controller: LERIAN LTDA (Lerian Studio), CNPJ (Brazilian company register) 57.616.968/0001-64. Data protection officer (DPO): Maisa Rezende Pires Amaral, at dpo@lerian.studio.

From the contact form, we collect only what you type into it: name, email, company (an optional field), and your message. Those four fields and no others — we do not ask for your role, phone number, any identity document, or any sensitive data.

Separately, and independently of the form, the site loads measurement and advertising tools that receive technical data about your visit. They are described in Cookies and analytics.

The site loads Google Analytics 4 (identifier G-GVRJFDH02S) and Google Ads (AW-18090346848), both through the Google Tag Manager loader. That is the only third-party code on the site: the fonts are served by us, and nothing beyond those two Google tools is loaded from elsewhere.

These services write cookies in your browser and receive technical data about the visit — IP address, browser, device, pages viewed, and time. They serve two purposes: audience measurement, meaning how many people reach the site, where they arrive from, and what they read; and advertising, including remarketing, which is showing Lerian ads to people who have already visited the site.

The cookies are written when the page loads, not after prior consent: this policy tells you what happens, it does not ask permission first. If you do not want these cookies, use your browser's cookie settings or the ad controls in your Google account — both work without going through us, and both take effect immediately.

The tags load only on the site's canonical addresses, lerian.studio and www.lerian.studio. Test environments, previews, and the internal deploy domain load nothing and measure nothing. Beyond these tools, the site sets no cookies of its own, uses no local storage, and has no login.

To respond to your contact request and carry on the conversation it starts.

To measure the site's audience and run advertising, as described in Cookies and analytics.

To meet applicable legal and regulatory obligations.

Preliminary steps relating to a contract (Art. 7º V LGPD; Art. 6(1)(b) GDPR where it applies): you write in to evaluate the platform, and answering you is the preliminary step of that relationship.

Legitimate interests (Art. 7º IX LGPD; Art. 6(1)(f) GDPR where it applies): commercial communications related to the contact you initiated, audience measurement, and advertising.

We do not ask for consent and the form has no consent checkbox. The processing rests on those two grounds — and because it does, you can object to it, as described in Your rights.

We do not sell your personal data.

The form delivers your message one of two ways, and the page itself tells you which it used. On a direct send, it passes through a function in our own AWS environment, which uses Resend — a transactional email provider — only to deliver it to our corporate mailbox. Resend carries and stores the message that was sent; it receives nothing about your browsing, does not see your IP address, and does not record your browser.

The other way, the form opens a draft in your own email client and the message goes from your account straight to ours: on that path nothing is sent by the site, and neither AWS nor Resend is involved.

Google, on the terms set out in Cookies and analytics.

Public authorities when legally compelled.

We keep no lead database: there is no CRM, no database, and the site stores nothing you type.

Your message stays in the corporate mailbox that receives it for as long as needed to carry on the conversation you started and to meet legal obligations, and is deleted once it no longer serves that purpose.

Audience and advertising data are retained by Google, for the period configured on our Google Analytics property.

You may request at any time: confirmation that processing exists; access to your data; correction of incomplete, inaccurate, or out-of-date data; anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed unlawfully; portability; and information about who we share your data with.

Because the processing does not rest on consent, the matching right is not withdrawal but objection: you can object to processing grounded in legitimate interests (Art. 18 §2 LGPD; Art. 21 GDPR where it applies) and ask for your data to be deleted. For the measurement and advertising cookies, the controls described in Cookies and analytics take effect immediately and do not depend on us.

To exercise any of these rights, email dpo@lerian.studio. We respond within 15 days — the period set by Art. 19 LGPD.

The site is static: there is no database, no login, no session, and nothing you type is stored here.

Content is served over HTTPS only, with a one-year HSTS policy. Responses carry a Content-Security-Policy restricting the origin of every script, image, and font, and the destination of every form, to a closed list; the site cannot be embedded in another page; and camera, microphone, geolocation, payment, and USB are denied by Permissions-Policy.

In the event of a security incident posing risk to data subjects, we notify the ANPD and the affected individuals within the legally required timeframes.

We may update this policy. Material changes will be announced on the site.