The controller of the data processed on this site is Craft, based in São Paulo, Brasil.

For anything concerning personal data, including exercising your rights, write to contato@thisiscraft.co.

The site has two forms, and each stores exactly the fields below. None asks for more than is needed to reply to you.

• Project briefing. Name, email, phone, whether you are an advertiser or an agency, agency, brand or client, product or campaign, intended deliverables, timing, budget range, your message and the language you filled it in.
• Creative network application. First and last name, email, phone, Instagram, portfolio link, your discipline, your message and the language you filled it in.

In serving a page, our infrastructure records technical request data: IP address, date and time, the page requested, the referring address and browser information. These records exist to keep the site up and to investigate faults and abuse, not to build a profile of you.

Your answer to the cookie notice is stored in your own browser, in local storage, under the key craft.consent. It is sent neither to us nor to anyone else, and exists only so the question is not asked again on every page. If your browser sends the Global Privacy Control signal, we treat it as a refusal and do not ask at all.

This site does not need cookies to work: there is no public login, no basket and no session to keep. What exists is one measurement tag, and it loads only if you accept.

• Necessary. The record of your own choice about measurement, in your browser. Without it there is no way to honour your decision. It does not depend on consent, because it is what makes consent possible.
• Measurement and advertising. LinkedIn Insight Tag, used to count visits, build remarketing audiences and measure conversions. It sets LinkedIn's own cookies in your browser. None of it loads before you accept, and declining limits no part of the site.

Each purpose has its own legal basis, under art. 7 of the Brazilian LGPD and, for readers in the European Union, art. 6 of the GDPR.

• Replying to a briefing and assessing a project. Preliminary steps relating to a contract, at your request (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Assessing a creative network application. Legitimate interest in building and keeping a network of collaborators, limited to what you sent us yourself (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Measurement, remarketing and conversions. Your consent, freely given and revocable at any time (LGPD art. 7, I; GDPR art. 6(1)(a)).
• Security, diagnostics and fraud prevention. Legitimate interest in keeping the service available and sound (LGPD art. 7, IX; GDPR art. 6(1)(f)).

We do not sell personal data and do not hand it to third parties for their own ends. We share it with processors who run the service on our behalf and on our instructions, and only with what each one needs.

• Vercel. Site hosting and technical request logs.
• Supabase. The database the forms are written to.
• Cloudflare R2. Storage and delivery of images and video.
• Resend. Sending the email that notifies us of a new form.
• LinkedIn. Measurement, remarketing audiences and conversions, with your consent only.

The processors above may handle data outside Brazil, including in the United States and the European Union. Those transfers rest on contractual clauses and on the safeguards each supplier offers, under art. 33 of the LGPD and Chapter V of the GDPR.

Each item is kept for as long as the purpose that justifies it, not indefinitely by default.

• Project briefings. Up to 5 years from the last contact, the window in which a commercial conversation may resume and in which related obligations may still be claimed.
• Creative network applications. Up to 2 years from submission, when the application is reviewed again or deleted.
• Technical logs. For our host's log retention period, which is short.
• Your choice about measurement. In your browser, until you clear the site's data or change your mind from the notice itself.

The LGPD (art. 18) and the GDPR (arts. 15 to 22) give you, over your data: confirmation that processing exists, access, correction of incomplete or outdated data, anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully, portability, information about who we share it with, withdrawal of consent, and objection to processing based on legitimate interest.

To exercise any of them, write to contato@thisiscraft.co. We answer within 15 days. We may ask for one further detail to confirm it is you, and for nothing else.

This site makes no automated decisions about you: there is no scoring, automatic screening or profile that decides anything concerning you.

If our answer does not settle it, you may complain to Brazil's National Data Protection Authority (ANPD) or, in the European Union, to your country's data protection authority.

The site is served over encrypted connections only. The database applies row-level access rules: forms can be written by anyone on the site and read only by the studio's named administrative accounts. Panel access is personal and logged, and every change is kept in a history with author and date.

No measure removes risk entirely. Should an incident occur with material risk to your rights, we will notify you and the ANPD, under art. 48 of the LGPD.

This site addresses professionals and companies. We do not knowingly collect data from anyone under 18. If you know of a case, write to us and we will delete the record.

If we change how we handle data, we change this text and the date below. If the change adds a new measurement technology, the cookie notice asks again: consent given to one tag is not consent given to another.