Who is responsible for your data
OrStudio is a brand of OR STUDIO TECNOLOGIA LTDA, a Brazilian company, CNPJ 62.843.896/0001-28, and the controller of data from this website and incoming enquiries. For privacy and rights: contact@orstudio.io.
Registered address: Avenida Marquês de São Vicente, 405, Conjunto 1804, Várzea da Barra Funda, São Paulo – SP, CEP 01139-001, Brazil. This is neither a public-facing office nor a correspondence reception point.
Information we process
The form collects your name, email and message; your company name is optional. Attachments are not accepted. Do not send passwords, confidential documents or sensitive personal data.
Serving the site and preventing abuse involves connection data such as IP address, browser and request details. Turnstile also processes TLS signals, the public widget key and origin. The antispam API does not receive your enquiry content.
Your browser saves your language choice in localStorage and an attempted-submission marker in sessionStorage, lasting for the tab session, to prevent duplicates. We do not store the fields or token there. We do not incorporate advertising analytics or marketing cookies.
Why we process it and on what basis
We use data to answer enquiries and assess a collaboration. When you request steps towards a contract to which you would be a party, the basis is LGPD Article 7.V and, where applicable, GDPR Article 6(1)(b).
For communications from company representatives and protection against spam and abuse, we rely on our legitimate interests in handling business communications and keeping the service secure: LGPD Article 7.IX and GDPR Article 6(1)(f), with data minimisation and a right to object.
Legal obligations and rights requests rely on LGPD Article 7.II and GDPR Article 6(1)(c) where applicable. Retention necessary for legal claims relies on LGPD Article 7.VI and, where appropriate, legitimate interests under the GDPR.
Contacting us does not subscribe you to marketing. We do not train AI models on enquiries or make solely automated decisions with legal or similarly significant effects about you. Antispam controls may prevent a submission; you can use our contact email instead.
Providers and sharing
Cloudflare Pages and Pages Functions serve the site and process the form. Cloudflare Turnstile, provided by Cloudflare, Inc., checks antispam signals. Cloudflare processes these on our behalf for protection and as a controller for its own bot-detection improvements.
Resend (Plus Five Five, Inc.) transmits enquiries to our fixed recipient contact@orstudio.io. Your email is used as Reply-To so we can answer. Hostinger manages that mailbox and replies. We do not publish or sell enquiries.
Providers use subprocessors for infrastructure, delivery and security. We may also disclose data where required by law or for legal claims. You can request information about recipients and safeguards through our privacy email.
International transfers
OrStudio operates in Brazil. Commission Implementing Decision (EU) 2026/179 recognises Brazil as adequate for the transfers it covers. ANPD Resolution 32/2026 recognises the European Union as adequate. Neither decision extends adequacy to the United States.
Resend stores content and delivery logs in the United States, even when another sending region is selected. Its DPA incorporates European clauses and describes the EU-U.S. Data Privacy Framework; it does not incorporate Brazilian ANPD clauses.
Cloudflare uses international infrastructure, including the United States. Hostinger uses international entities and subprocessors; we do not guarantee exclusive Brazilian residency. Their contracts and European safeguards alone do not establish a valid mechanism for every transfer under the LGPD.
You can request countries, recipients and copies or details of applicable safeguards at contact@orstudio.io. Transfer safeguards do not replace the lawful basis for the purpose or other data protection rights.
The specific Resend transfer uses the Article 33.VIII choice described below. We do not extend it as a general authorisation for other providers, countries, purposes or other people’s data. Providers’ European safeguards alone do not establish an LGPD mechanism for their other transfers.
Choice of transfer to Resend and withdrawal
Sending to Resend in the United States requires your specific, informed and prominent consent under LGPD Article 33.VIII. The checkbox is separate and unchecked. Without it we do not send the enquiry to Resend. This is neither general policy acceptance nor marketing, and does not replace the processing bases explained above.
The checkbox disclosure identifies recipient, country, purpose, data, retention and consequences. The server records the affirmative declaration received, its UTC receipt time, language, notice version and digest in the same enquiry email. It does not add your IP or token to that evidence, or by itself prove the sender’s civil identity.
We keep that evidence with the enquiry under the same 55/90 rule, without another database or an automatic extension. Do not send other people’s personal data: your choice can only concern your own data.
You can withdraw free of charge at contact@orstudio.io and request deletion or exercise your rights. Withdrawal cannot undo a previous transmission or affect its prior lawfulness. We stop new uses of this route for your enquiry and handle deletion with providers, subject to applicable legal limits.
Alternatively, email the same address directly without using Resend. Hostinger receives, stores and transmits those emails using international infrastructure and providers. This option is not transfer-free: the provider information and rights described in this notice apply.
How long information is kept
Enquiries without a contract have a planned maximum retention of 90 days after the last relevant interaction. Isra reviews them monthly and deletes threads with 55 or more days of inactivity, unless there is a documented legitimate reason to retain them.
This covers copies managed in the mailbox and trash. Enquiries resulting in contracts, and legal, tax or legal-claims records follow separate, specific periods according to their purpose and applicable obligations.
Hostinger allows messages to remain in trash for up to 30 days; our routine includes removing them without waiting for that period. Mailbox deletion does not guarantee immediate physical erasure of technical copies or provider backups.
Resend documents 30 days for emails and logs on active Free accounts, 7 days for backups and up to 90 days for remaining data after termination. These provider periods are independent of our Hostinger cleanup.
Cloudflare retains technical information according to its security purposes and policies. The specific Turnstile notice does not set one numerical period; Resend periods do not apply to it. We do not keep enquiry content in a separate form database.
Your rights
Depending on applicable law, you can request confirmation and access, correction, information about entities receiving your data, anonymisation, blocking or deletion of unnecessary data, portability, restriction or objection to processing.
Where processing relies on consent, you can withdraw it and learn the consequences of withholding it. You can complain to ANPD in Brazil or the competent European authority, including AEPD in Spain, without waiving other rights.
Write to contact@orstudio.io. Isra handles requests. We verify identity proportionately, without requesting documents by default, and respond within applicable legal deadlines. Deletion may be limited by legal obligations or legal claims.
Security and updates
We apply field validation, server-side antispam verification, limited access to enquiry management and duplicate controls. No system guarantees absolute security. Material changes and the effective date are published on this page.