Last updated: September 14, 2026
Notice: this is a draft
This text is a first version (draft) of our Privacy Policy, written to already make clear how we handle the data you send us. It has not yet been reviewed by a lawyer — before being treated as final and binding, it will go through legal review. If you have questions about any specific point, please contact us at the email address at the bottom of this page.
Arte da Floresta takes seriously the personal data you share with us through this site. This policy explains what data we collect, why we collect it, who has access to it, how long we keep it, and what rights you have over it, in plain language.
Arte da Floresta is a family handmade-jewelry business, formally registered as a Microempreendedor Individual (MEI, a Brazilian individual micro-entrepreneur), CNPJ 67.182.863/0001-06, with a physical point of sale at the Feira de Artesanato da Guilhermina craft fair, in Praia Grande, Brazil. This website is operated by the same family that runs the physical store.
We only collect personal data when you provide it yourself, through one of the site's forms. We don't use invasive tracking cookies or purchase data from third parties.
Contact form (/contato): name, email, phone, and the message sent, used exclusively to answer your question or contact request.
"Notify me when back" form (on out-of-stock pieces): name (optional), email, and the product of interest, used exclusively to email you when that specific piece becomes available again.
Checkout reservation request (/checkout): name, email, phone (optional), notes (optional), and the items in your cart, used exclusively so the family can confirm piece availability and arrange payment and pickup with you. Important: no payment is processed and no card or payment data is collected at this step — payment is arranged afterward, directly with the family, in person.
Your data is accessed directly only by the family that runs Arte da Floresta, for the purposes described above.
We also use the following service providers (data processors, not third parties that buy or resell data) to keep the site running: Supabase (database storage), Resend (sending confirmation and contact emails), and Vercel (site hosting). Each of these services processes data strictly to enable the site's technical operation, under their own privacy and security policies.
If traffic-analysis tools (like Google Analytics) or advertising tools (like the Meta/Facebook Pixel) are active on the site, they collect browsing data in an aggregated way, to understand how people use the site — they are never used to sell or share your personal data with third parties.
We never sell, rent, or share your personal data with third parties for marketing purposes.
We keep your data for as long as necessary to fulfill the purpose for which it was collected, or as required by law.
"Notify me when back" sign-ups that never result in a notification (because the piece never becomes available again) are kept for up to 12 months and then removed.
Reservation requests that the family is unable to confirm or complete with the customer are kept for up to 90 days and then removed, unless retention is required by a legal or tax obligation.
You can request early removal of your data at any time — see "Your Rights" below.
By default, this site doesn't use tracking cookies. It may, in the future, enable tools like Google Analytics (GA4) and the Meta Pixel to understand, in an aggregated way, how many people visit the site and which pages are most visited — these tools are only active when configured by the family, and never involve selling data.
You can block cookies and tracking at any time in your browser settings, without affecting the essential parts of the site.
We adopt reasonable technical measures to protect your data, such as encrypted connections (HTTPS) across the entire site and access control on the database. Even so, no system is 100% risk-free — if you suspect any misuse of your data, please contact us immediately.
This policy may be updated as the site evolves — for example, once the legal review mentioned in the notice at the top of this page is completed. The last-updated date is always shown at the top of this page.
Under Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018), especially article 18, you have the right to:
To exercise any of these rights, just contact us at the email below — we reply personally, as quickly as possible.
To exercise your rights, ask questions, or request the removal of your data, contact us at: contato@artedafloresta.com.br
