Privacy Policy

1. Introduction

YNCO Studio (“YNCO”, “YNCO Studio”, “we”, “us”, or “our”) respects your privacy and is committed to handling personal information responsibly and transparently.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you:

• Visit yncostudio.com;
• Use our Project Builder or other project inquiry forms;
• Request or receive an AI-assisted project diagnosis;
• Contact us by email, WhatsApp, or another communication channel;
• Request a proposal or engage YNCO Studio for services;
• Make or arrange a payment for our services;
• Otherwise interact with YNCO Studio.

YNCO Studio operates from Brazil and may serve clients and website visitors in Brazil and internationally.

We process personal information in accordance with applicable data protection laws, including Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — LGPD), and, where applicable, other privacy laws such as the European Union's General Data Protection Regulation (GDPR).

2. Who Is Responsible for Your Data

For personal information processed in connection with our website, project inquiries, client relationships, and business operations, YNCO Studio generally acts as the data controller, meaning we determine the purposes and essential means of the processing.

Questions or requests regarding privacy or your personal information may be sent to:

YNCO Studio
Independent Web Design Studio
Brazil
Email: legal@yncostudio.com
Website: https://yncostudio.com

3. Information We May Collect

Depending on how you interact with us, we may collect the following categories of information.

3.1 Contact and identification information

This may include:

• Name;
• Email address;
• Phone number;
• Company or brand name;
• Job title or professional role, when provided;
• Website or social media links, when provided.

3.2 Project inquiry and briefing information

When you use our Project Builder, contact forms, or communicate with us about a potential project, we may process information such as:

• Project type;
• Business or brand information;
• Project objectives;
• Desired website characteristics;
• Design preferences;
• Requested functionality;
• Budget or investment range;
• Timeline;
• Existing website or digital presence;
• Messages, notes, answers, and other information you choose to provide.

Please avoid submitting sensitive personal information, confidential credentials, passwords, financial account information, health information, government identification numbers, or other information that is not reasonably necessary for us to understand your project.

3.3 AI-assisted diagnosis information

Our website may use artificial intelligence to generate an initial project diagnosis or summary based on information you voluntarily provide.

To generate this diagnosis, relevant project answers or text may be transmitted to OpenRouter and to the AI model provider selected or routed through OpenRouter.

The AI-generated diagnosis is intended to help organize and interpret the project information submitted by the user. It does not constitute a legally binding decision, automated eligibility determination, credit decision, or other decision producing legal or similarly significant effects.

3.4 Communications

If you contact us, we may process:

• Email correspondence;
• WhatsApp or other business messages;
• Project discussions;
• Attachments;
• Feedback;
• Support or service requests.

3.5 Payment and transaction information

Payments may be processed by third-party payment providers such as Stripe.

Depending on the transaction, we may receive information such as:

• Client name;
• Email address;
• Billing information;
• Payment status;
• Amount and currency;
• Invoice or transaction identifiers;
• Limited payment-related metadata.

YNCO Studio does not need to receive or store your full payment card number when payment is processed directly by Stripe.

Stripe processes payment information according to its own legal and privacy terms.

3.6 Technical, usage, and security information

When you visit our website, our hosting, security, and analytics providers may automatically process technical information such as:

• IP address;
• Approximate location derived from IP address;
• Browser and device type;
• Operating system;
• Referring page or source;
• Pages or routes visited;
• Date and time of access;
• Performance and diagnostic information;
• Request and security metadata;
• Aggregated website usage information.

At the date of this Policy, we use Vercel Web Analytics to understand aggregate website usage and navigation, and Vercel Speed Insights to measure website performance, technical user experience, and Web Vitals.

4. How We Collect Information

We may collect information:

4.1 Directly from you

For example, when you:

• Complete the Project Builder;
• Submit a contact form;
• Send us an email or WhatsApp message;
• Request a proposal;
• Sign a project agreement;
• Make a payment;
• Provide feedback or project materials.

4.2 Automatically through our website and infrastructure

Certain technical, analytics, security, and request information may be processed automatically when you access our website.

4.3 From service providers

We may receive limited information from providers that support our operations, such as payment status or transaction information from Stripe.

5. How We Use Personal Information

We may use personal information to:

• Receive and evaluate project inquiries;
• Understand your project goals and requirements;
• Generate an AI-assisted project diagnosis or summary;
• Respond to leads, inquiries, and clients;
• Prepare proposals, estimates, contracts, and project documentation;
• Provide web design, development, and related services;
• Manage project communications and approvals;
• Process or reconcile payments;
• Maintain records relating to our client relationships;
• Operate, secure, troubleshoot, and improve our website;
• Prevent abuse, spam, fraud, or excessive automated requests;
• Measure aggregate website usage and performance;
• Comply with applicable legal, regulatory, tax, or accounting obligations;
• Establish, exercise, or defend legal claims;
• Protect the rights, security, and integrity of YNCO Studio, our clients, and our services.

6. Legal Bases for Processing

Where required by applicable law, we rely on an appropriate legal basis for processing personal information.

Depending on the context, this may include:

6.1 Steps requested before entering into a contract

We may process information you provide when requesting a quote, project diagnosis, proposal, or other steps related to a possible engagement.

6.2 Performance of a contract

When you become a client, we may process information necessary to provide the agreed services, communicate about the project, and administer the commercial relationship.

6.3 Legitimate interests

Where permitted by law, we may process information based on legitimate interests such as:

• Operating and improving our website;
• Responding to professional inquiries;
• Protecting our systems;
• Preventing abuse and fraud;
• Maintaining appropriate business records;
• Understanding aggregate website performance.

We seek to balance these interests against the rights and reasonable expectations of individuals.

6.4 Compliance with legal or regulatory obligations

We may retain or process certain information where necessary to comply with legal, tax, accounting, regulatory, or other mandatory requirements.

6.5 Consent

Where consent is required, we will request it before carrying out the relevant processing.

For example, if YNCO Studio introduces optional marketing emails, newsletters, advertising technologies, or non-essential tracking that requires consent, we will implement appropriate notice and choice mechanisms.

Consent may be withdrawn where applicable.

7. Project Builder and Email Delivery

Information submitted through our Project Builder is not intentionally stored by YNCO Studio in a dedicated lead database at this time.

During use of the Project Builder, your answers, conversation, and diagnosis may be stored temporarily in your own browser using session storage (sessionStorage) so you can recover your progress during the session. The current mechanism considers the draft valid for approximately 2 hours from its last update. This validity is checked while the Builder is active or when it is reopened.

This temporary browser storage is not a persistent YNCO Studio lead database. Information you actually submit continues to be processed and sent by email as described below.

The information is processed to:

1. Understand the project request;
2. Generate the AI-assisted diagnosis where applicable; and
3. Send the resulting inquiry and relevant project information to YNCO Studio by email.

The inquiry and related correspondence may therefore remain stored in our business email systems according to the retention rules described in this Policy.

If we materially change how information submitted through the Project Builder is stored, we will update this Policy as appropriate.

8. Artificial Intelligence and OpenRouter

YNCO Studio uses AI-assisted technology as part of the Project Builder diagnosis experience.

Relevant content submitted by the user may be transmitted to OpenRouter, which routes requests to one or more third-party AI model providers.

AI providers may have different data retention, logging, training, and processing practices depending on the provider or model used.

We do not ask users to submit sensitive personal information through the Project Builder, and users should avoid including confidential or sensitive information that is not necessary for the project inquiry.

Where technically and commercially appropriate, YNCO Studio may use privacy controls, provider restrictions, or zero-data-retention routing options made available by AI service providers.

We may change the specific AI model or provider used without materially changing the purpose of this processing.

9. Website Analytics

At the date of this Policy, we use Vercel Web Analytics to understand aggregate website usage and navigation, and Vercel Speed Insights to measure website performance, technical user experience, and Web Vitals.

These services may provide information such as:

• Page views;
• Routes visited;
• Referring sources;
• Country or approximate region;
• Browser, device, or operating system categories;
• Aggregate usage events;
• Website performance and Web Vitals.

We use analytics to understand how the website performs and which areas are useful to visitors.

We do not currently use the website analytics data to build advertising profiles or serve behavioral advertising.

If we introduce additional analytics or advertising tools in the future, we will update our disclosures and implement consent controls where required by applicable law.

10. Marketing Communications

At the date of this Policy, contact information submitted through our website is used primarily to:

• Respond to project inquiries;
• Communicate with leads;
• Manage client relationships;
• Provide requested services.

We do not currently use Project Builder submissions to automatically enroll users in a marketing newsletter.

If we introduce newsletters or marketing email campaigns in the future, we will use an appropriate legal basis, provide the required notice, and offer a simple way to unsubscribe.

Where consent is legally required, we will request it before sending such communications.

11. Service Providers and Data Sharing

We do not sell personal information.

We may share or permit access to limited personal information when reasonably necessary for service providers to operate our website and business.

Service providers involved in these activities include:

These providers operate under their own terms, privacy policies, and data processing arrangements.

We may also disclose information:

• When required by applicable law, court order, or lawful governmental request;
• To protect legal rights or prevent fraud, abuse, or security threats;
• In connection with a business reorganization or transfer, subject to applicable law;
• With your direction or consent.

12. International Data Transfers

YNCO Studio operates from Brazil, but some of our technology and service providers operate infrastructure in other countries.

As a result, personal information may be processed or transferred outside Brazil, including to the United States and, depending on the AI provider or infrastructure selected, other jurisdictions.

Where required by applicable law, we take reasonable steps to use providers and arrangements that support lawful international data transfers and appropriate protection of personal information.

The data protection laws of another country may differ from those of your country of residence.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal obligations.

13.1 Leads that do not become clients

Project inquiry information and related communications for a lead that does not become a client will generally be retained for up to 12 months after the most recent meaningful interaction, unless:

• You request earlier deletion and no legal basis requires continued retention;
• We reasonably need the information to address a dispute, abuse, security issue, or legal claim;
• Applicable law requires a different retention period.

13.2 Client and project records

Where a lead becomes a client, relevant project, contract, payment, invoicing, and communication records may be retained for the duration of the relationship and for any additional period required or reasonably justified by legal, tax, accounting, contractual, or dispute-resolution obligations.

13.3 Technical and analytics data

Technical, analytics, and security information may be retained according to the relevant provider's retention practices and our operational needs.

Aggregated or properly de-identified information may be retained for longer where it no longer reasonably identifies an individual.

14. Cookies and Similar Technologies

Our current use of browser storage and analytics is described in Sections 7 and 9 of this Policy.

At the date of this Policy, we use Vercel Web Analytics and Vercel Speed Insights.

Strictly necessary technologies may operate where required for website functionality, security, fraud prevention, or user-requested services.

If we introduce optional analytics, preference, or marketing technologies that require consent, they will not be activated before the required choice has been provided.

15. Security

We use reasonable technical and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• Access controls;
• Secure hosting and infrastructure providers;
• Encrypted network communications where appropriate;
• Request controls and abuse prevention;
• Restricted access to business systems;
• Authentication and account security controls.

However, no internet transmission, email system, or digital storage environment can be guaranteed to be completely secure.

Users should not send passwords, private keys, payment card details, or other highly sensitive credentials through ordinary project inquiry fields.

16. Your Privacy Rights

Depending on your location and applicable law, you may have rights regarding your personal information.

Under Brazil's LGPD, these may include, where applicable:

• Confirmation that processing exists;
• Access to personal information;
• Correction of incomplete, inaccurate, or outdated information;
• Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• Portability, where applicable and regulated;
• Information about public and private entities with which data has been shared;
• Information about the possibility of refusing consent and the consequences of doing so;
• Withdrawal of consent;
• Deletion of information processed on the basis of consent, subject to legal exceptions;
• Objection to certain processing;
• Review of certain decisions based solely on automated processing where applicable;
• Filing a request with the Brazilian National Data Protection Authority (ANPD) where legally available.

Where the GDPR or another privacy law applies, additional or equivalent rights may be available, such as restriction of processing and, in certain circumstances, the right to object.

To exercise a privacy right, contact:

legal@yncostudio.com

We may need to verify your identity before fulfilling a request.

Privacy requests are handled without charge where required by law, subject to applicable exceptions.

17. Automated Processing

The AI-assisted project diagnosis may automatically analyze the project information you submit and generate a summary or initial interpretation.

This diagnosis is intended as a communication and project-discovery tool.

YNCO Studio does not currently use the Project Builder AI diagnosis to make decisions producing legal or similarly significant effects about an individual.

You may contact us if you have questions about the diagnosis or would prefer to discuss your project directly with a person.

18. Children's Privacy

YNCO Studio's website and services are intended for businesses and professional project inquiries and are not directed to children.

We do not knowingly seek to collect personal information from children through the Project Builder.

If you believe a child has provided personal information to us inappropriately, contact legal@yncostudio.com so that we can review the situation and take appropriate action.

19. External Links and Third-Party Websites

Our website may link to third-party websites or services.

We are not responsible for the privacy practices, content, or security of websites and services controlled by third parties.

We encourage users to review the privacy policies of third-party services they choose to use.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to our website or services;
• New technology providers or features;
• Changes in how we process information;
• Legal or regulatory developments.

The most recent revision date will appear at the top of this page.

If a change materially affects how previously collected personal information is used, we will provide additional notice or obtain consent where required by applicable law.

21. Contact

For questions, requests, or concerns related to privacy or personal information:

YNCO Studio
Independent Web Design Studio
Brazil
Email: legal@yncostudio.com
Website: https://yncostudio.com