Privacy policy

Who is responsible

This site, laures.design, is run by Guilherme Nunes Laureano, a designer and developer based in Brazil, known professionally as Laures. I decide how your personal data is used, which makes me the controller under the General Data Protection Regulation (GDPR, including the UK GDPR) and the controlador under Brazil’s Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018).

For anything about your data, write to hello@laures.design. I handle every request myself, and I’m also the person in charge of data protection (the encarregado under the LGPD).

What is collected, and why

When you get in touch

The contact chat (and the plain form behind it) asks for your name, your email address and what you’d like to talk about; depending on that, whether you’re with an agency or a freelancer (and its name), a rough budget and timeline, or your site’s address; your message; and, if you’d like to be reached on WhatsApp, a phone number. It also notes which page you wrote from — in the game, which note or button opened the chat. If you answered the stack questions on the Development page, those answers are kept only in your browser for 30 days and are sent only if you contact me: with your message in the chat or the form, or added to the email or WhatsApp message, where you can see and edit them before sending. To clear them sooner, choose “Start again” under the questions, or clear this site’s data in your browser.

• Purpose: to reply to you, talk about a possible project and, if we work together, prepare a quote.
• Legal basis: steps you ask for before a possible contract (GDPR art. 6(1)(b); LGPD art. 7, V), and my legitimate interest in answering messages sent to me (GDPR art. 6(1)(f); LGPD art. 7, IX).

Answers saved as you go

Before the first question, the chat tells you that your answers are saved as you go, so I can still get back to you if the page closes before you press Send. From the moment you give an email address, what you have typed is stored as a draft. If you choose “Don’t save until I send” (a box in the plain form), nothing is stored until you send it.

• Legal basis: my legitimate interest in answering someone who started writing to me (GDPR art. 6(1)(f); LGPD art. 7, IX), with the choice to opt out before anything is kept. You can ask for a draft to be deleted at any time by writing to me.
• Your choice and the date of this policy are kept with the message.

Rating the game

The little game on the site (Fetch) may ask how you’d rate it: a number of stars and, if you like, a comment. It’s stored with the date, the page and the kind of device (browser and system) — no name, email or IP address; to stop one person sending many, the server briefly keeps a scrambled (hashed) form of the IP address, never the address itself.

• Legal basis: legitimate interest in improving the game (GDPR art. 6(1)(f); LGPD art. 7, IX).

To keep the contact form safe

Each message is stored with the IP address it came from and an approximate location (country and city) worked out from it. This is used only to spot spam and abuse. The location is looked up on the server itself — from the hosting network’s own headers, or from a local database (IP to City Lite by DB-IP, licensed under CC BY 4.0) — and the address is never sent to a third-party service for this.

• Legal basis: legitimate interest in protecting the site and my inbox (GDPR art. 6(1)(f); LGPD art. 7, IX).

Comments

Articles and case studies take comments. The form asks for a name, which is shown with your comment, the comment itself and, optionally, an email address, which is never shown and is used only if I need to reply to you privately. Every comment is read before it appears, and is stored with the IP address it came from, only to spot spam and abuse.

• Legal basis: legitimate interest in running a moderated discussion under my writing and keeping it free of spam (GDPR art. 6(1)(f); LGPD art. 7, IX). You can ask for your comment to be removed at any time.

Reactions

The reactions under an article (Useful, Loved it and so on) are anonymous: only the totals are stored. Your own choice is remembered in your browser, not on the server, and to stop one person voting many times the server briefly keeps a scrambled (hashed) form of the IP address, never the address itself.

Visits to the site

If analytics are switched on, the site uses Umami, a privacy-focused service that sets no cookies and doesn’t build a profile of you. It counts page views, referring sites, browser, device type and country, in aggregate. The contact chat only reports that a step was reached — never anything you typed.

Like any web server, the hosting may keep short-lived technical logs (IP address, date, the page requested, browser) to keep the site running and secure.

• Legal basis: legitimate interest in understanding how the site is used and keeping it secure (GDPR art. 6(1)(f); LGPD art. 7, IX).

Display settings

The choices you make in the Accessibility panel (text size, contrast, motion and so on) are saved in your own browser and never sent to me. They aren’t used for analytics. See the cookie policy for details.

What is not collected

No advertising or social media trackers, no fingerprinting, and no sensitive personal data is asked for. Fonts and images are served from this site, not from third parties. Please don’t include sensitive information (health, finances, identity documents) in your message.

Who else handles it

Your data is never sold, and it isn’t shared for anyone’s marketing. A few services process it on my behalf, only to run the site:

If you choose to book a call, message me on WhatsApp or share a page, you go to Cal.com, WhatsApp or the network you picked. Their own privacy policies apply there.

I may also disclose data where the law requires it, for example to a court or a public authority.

Where it is stored

The site and the messages you send through it are stored on Hostinger’s servers in the Netherlands, in the European Union. I work from Brazil, and some of the services above are based elsewhere, including the United States and the European Union. When your data crosses borders, it is protected by the safeguards the law provides — adequacy decisions, the standard contractual clauses the services offer, or the mechanisms in LGPD article 33 — and only the minimum needed for each purpose is transferred.

How long it is kept

• Drafts that were never sent: deleted automatically after 90 days.
• Messages you sent: kept for 2 years after they arrive, so an enquiry can be picked up again, then deleted. The copy in Notion is removed on the same schedule.
• Game ratings: kept for two years, then deleted.
• Comments: published ones stay for as long as the page they’re on; the ones that aren’t published (spam, or not approved) are deleted within 90 days.
• If we work together, what is needed for the contract, invoices and tax is kept for as long as the law requires.
• Server logs are kept for a short period set by the hosting provider.

You can ask for your data to be deleted sooner at any time.

Your rights

Wherever you are, you can ask me to:

• confirm whether I hold data about you, and give you a copy of it;
• correct anything that is wrong or incomplete;
• delete it, or anonymise or block what isn’t needed;
• send it to you, or to someone else, in a common format;
• tell you who it has been shared with;
• stop using it, or use it only in limited ways, while a question is sorted out;
• withdraw a consent you gave, without affecting what was done before.

Write to hello@laures.design. I may ask you to confirm it’s you before acting, and I’ll reply within 15 days — sooner where I can. Requests are free.

If you’re not happy with my answer, you can complain to a data protection authority: in Brazil, the ANPD; in the European Union, the authority where you live or work (in Ireland, the Data Protection Commission); in the United Kingdom, the ICO. I’d appreciate the chance to sort it out with you first.

How it is protected

Messages are stored outside the public part of the site, sent over encrypted connections (HTTPS), and only I can read them. Access to each service is limited to what it needs, passwords and keys are kept out of the code, and software is kept up to date. No system is perfectly secure, but if a breach ever put your data at risk, I would tell you and the authorities as the law requires.

Automated decisions

None. No decision about you is made by software alone, and your data isn’t used for profiling. Every message is read by me.

Children

This site is meant for businesses and adults. It isn’t aimed at children, and I don’t knowingly collect their data. If you think a child has sent me their details, let me know and I’ll delete them.

Changes to this policy

If what the site does with data changes, this page changes first, with a new date below. If a change affects a consent you gave, I’ll ask again rather than assume.