Privacy Policy

The data controller is Andreia Cirne, trading as Andreia Cirne, based in Faro, Portugal. For any privacy request, contact Andreia through the Contact page or WhatsApp.

The contact form on this site helps you write a message, which then opens in WhatsApp for you to review and send yourself. When you press the final button, the details you entered are also saved in Andreia's client management system, so she can reply even if the WhatsApp message is never sent. The form may include:

• Your name
• Business or project name (optional)
• Website or social media profile (optional)
• Email or mobile number (optional)
• The situations you selected and your message (optional)

While you fill it in, your answers are kept only in your browser's session storage, so they survive a page refresh. They are erased when you close the tab. Nothing is saved or reaches Andreia before you press the final button.

When you contact Andreia by WhatsApp, email or LinkedIn, she receives the details you choose to share. No financial data, identification numbers or special categories of data are requested.

Messages are used to understand your request, reply with the most useful next step and keep the context of past conversations, so later replies make sense. With your consent, analytics data is used to understand how the site is used and to improve it.

• Pre-contractual measures (GDPR Art. 6(1)(b)): replying to a request that may lead to an engagement.
• Legitimate interest (GDPR Art. 6(1)(f)): keeping a basic record of past conversations to provide useful continuity.
• Consent (GDPR Art. 6(1)(a)): analytics and marketing tools, which only run after you accept them in the cookie banner. You can withdraw consent at any time.

Conversations are kept for up to 24 months from the last interaction. Conversations tied to an active client relationship are kept for the duration of that engagement and for the legal retention periods that apply to the underlying contract and accounting records. Contact form requests that do not lead to an engagement are deleted automatically 12 months after they are submitted. Your cookie choice is stored in your browser for up to 6 months, after which you are asked again.

Personal data is processed by Andreia Cirne. It is not sold, rented, or shared with third parties for marketing purposes. It may be processed by the technical providers listed in the next section.

• Hosting: Cloudflare serves this website. Like any web server, it processes technical data such as your IP address and browser type to deliver pages and protect the site against abuse.
• Messaging and email: messages you send through WhatsApp are handled by WhatsApp (Meta) under its own privacy policy. Email replies are sent through standard email providers.
• Client management: contact form requests are stored in a database provided by Supabase, hosted in the European Union (Ireland), and only Andreia can access them.
• Analytics, only with consent: Google Tag Manager and Google Analytics 4 (Google) measure visits and clicks, with ads data redaction enabled. Microsoft Clarity (Microsoft) shows how pages are used through heatmaps and session recordings. None of these tools load until you accept analytics in the cookie banner. Marketing tools, if used, follow the same rule and only load after you accept the marketing category.
• Fonts: served from this website. No request is made to Google Fonts.

Before you choose, the site only stores what it strictly needs to work: your cookie choice (in your browser's local storage) and, if you use the contact form, your draft answers (in session storage). No analytics or marketing cookies are set and no analytics script is loaded.

If you accept analytics, Google Analytics and Microsoft Clarity may set their own cookies to tell visits apart. Analytics events never include your name, email, phone number or message content, only anonymous parameters such as the page, the button clicked and the language.

You can change your choice at any time through "Cookie preferences" in the footer. If you withdraw consent, the page reloads so the tools stop straight away.

Where a provider processes data outside the EU/EEA, that transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

You have the right to:

• Access the data held about you;
• Request correction of inaccurate data;
• Request deletion of your data;
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with the Portuguese supervisory authority, CNPD (Comissão Nacional de Proteção de Dados).

To exercise any of these rights, contact Andreia through the Contact page or WhatsApp. Requests are answered within one month.

Reasonable technical and organisational measures are in place to protect personal data, including encrypted transport (HTTPS) and minimum data collection: the website itself does not store contact messages. No system is ever fully immune to incidents; in the event of a breach affecting your rights, you will be informed.

This policy may be updated as the business or applicable law evolves. The version in force is always the one published on this page; material changes will be reflected in the "Last updated" date above.