Last updated: September 24, 2026.
1. Data controller
Design Lyra, a project by Fernando Lyra, is responsible for decisions concerning the processing of personal data collected on this website. For privacy matters and data-subject requests, write to contato@designlyra.com.br.
2. Data collected
The Portuguese contact form collects name, email address, optional WhatsApp number, subject, message, and stated interest. To protect the form against abuse, the system also derives a non-reversible cryptographic identifier (SHA-256 hash) from the normalized email address, used solely to count submission attempts. This technical control is retained for approximately 24 hours and does not store the readable email address in that table.
3. Purposes and legal bases
Data is used to receive and answer messages, record expressions of interest, manage service, and protect the form and website against abuse. Depending on the purpose and context, processing may rely on consent, steps requested by the data subject prior to a possible contract, legitimate interests in maintaining service security and continuity, compliance with a legal or regulatory obligation, or the regular exercise of rights. Consent may be withdrawn without affecting processing previously carried out on a lawful basis.
4. Storage, notifications, and providers
Submitted content is stored in the D1 database, and a copy of the message is sent to contato@designlyra.com.br through Zoho’s ZeptoMail service so that the request can be handled. Data may be processed by providers required for hosting, security, database operation, and notifications, including OpenAI Sites/Cloudflare and Zoho. Open and click tracking for notifications is disabled. We do not sell personal data.
5. International transfers
Some infrastructure providers may process personal data outside Brazil. Where an international transfer occurs, it must rely on a mechanism permitted by the LGPD and the regulations of the Brazilian Data Protection Authority, including an adequacy decision, applicable contractual clauses, or another relevant legal mechanism, together with technical and organizational safeguards appropriate to the processing.
6. Retention and deletion
Contact records are retained only for as long as needed to answer the request, manage the relationship, comply with obligations, or exercise rights. A record moved to the administrative trash remains recoverable for 30 days; after that period, its permanent deletion from D1 can be performed. Because the message is also sent to the email inbox, deletion requests and procedures cover, where applicable, both the D1 record and the corresponding mailbox copy. Minimum data may be retained longer where there is a legal basis, an applicable obligation, or a need for the regular exercise of rights.
7. Your rights
Under applicable law, you may request confirmation of and access to processing; correction; anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data; portability where applicable and regulated; information about sharing; information about the possibility of withholding consent and its consequences; withdrawal of consent; deletion of data processed on the basis of consent; and objection to unlawful processing. Statutory retention grounds remain protected. Send requests to contato@designlyra.com.br.
8. Security, local storage, and cookies
We use access controls, origin validation, rate limits, and safeguards designed to reduce unauthorized access. The website stores the language preference in the browser. Hosting or private-access infrastructure may use cookies or similar technologies strictly necessary for security, authentication, and operation. In this version, Design Lyra does not use advertising cookies, marketing pixels, or proprietary profiling tools.
9. External links and services
The website contains links to external services such as Instagram, YouTube, and LANDR. When you access those services, data processing is also governed by the policies and practices of their respective operators. Design Lyra does not control the cookies, identifiers, or processing performed by those websites outside its own domain.
10. Updates
This policy may be updated to reflect changes in services, providers, or legal requirements. The date of the current version will always appear on this page.