Privacy

Privacy Policy

Last updated: October 19, 2026

This is a professional portfolio. I don't ask you to sign up, I don't sell data and I don't use advertising or tracking cookies. Below I explain plainly what is processed, why, for how long and how you can exercise your rights.

Who is responsible

This site is run by Ana Flavia Maestri, in São Paulo, Brazil, who is the controller of the data described here.

For any privacy matter, write to portfolio@anamaestri.com.

What data is processed and why

Visit statistics: I use Umami Cloud, configured without cookies, to understand in aggregate which pages are read, which site visits come from, the country and the type of browser or device. The IP address is used by the service only when receiving the visit; I don't identify individual visitors.
Serving the site: As with any website, hosting providers receive technical connection data, such as IP address, date and time, requested page and browser, to deliver pages and protect them against abuse. Fonts are served by the site itself, with no connection to Google Fonts.
Case feedback: When you answer the question at the end of a case or leave an optional comment, I store the case, your answer, language, dates and the comment text. I don't ask for your name or email and don't store your IP. To avoid duplicate votes, your browser keeps a random code, which reaches the database only in encrypted form. Please avoid including personal data in comments.
Private documents: Some recommendation letters require a password. After a correct password, an encrypted session cookie remembers which pages were unlocked. Wrong passwords create a temporary counter linked to an encrypted, truncated digest of the IP (never the plain IP or the typed password), used to block repeated attempts.
Notifications: I receive short Telegram alerts for new feedback, CV/PDF downloads or confirmed access to a private page. Alerts never include comment text, IP, browser or any visitor identifier.
Email: If you write to me, I use what you send only to reply, for example to password requests or professional proposals.

Legal bases (Brazil's LGPD)

Aggregate statistics: Legitimate interest (art. 7, IX): understanding the portfolio's reach with minimal data, no cookies and no individual identification.
Hosting and security: Legitimate interest: delivering and protecting the site, including blocking repeated password attempts.
Feedback and comments: Legitimate interest: improving how cases are presented through voluntary, anonymous participation with no sign-up. You can ask for deletion at any time.
Email: Preliminary steps at the data subject's request (art. 7, V) or legitimate interest, depending on the subject.
Notifications: Legitimate interest: following activity on the site without sending visitor data.

Where legitimate interest applies, I considered the purpose, the need for each piece of data, what a visitor would reasonably expect from a portfolio and the safeguards on this page, following the Brazilian Data Protection Authority's (ANPD) guidance. You can object to this processing through the contact channel.

Cookies and browser storage

Private page session: Strictly necessary cookie, created only after a correct password. Lasts up to 30 days.
Theme preference: Your browser stores locally whether you chose light or dark mode, until you clear site data.
Participation code: Your browser stores the random feedback code, until you clear site data.

There are no analytics, advertising or social media cookies, so the site does not show a cookie consent banner.

I don't sell or hand over data. It is processed only by providers needed to run the site: Lovable and its hosting and database infrastructure; Umami (statistics); Telegram (alerts to me); and Google (email). Each follows its own policies and contractual obligations.

International transfers

Some providers operate outside Brazil. Umami statistics are stored in the Frankfurt, Germany region; hosting, notifications and email may involve servers in other countries, including the United States. These transfers take place to run the services described, with providers that adopt security measures and contractual data protection commitments.

How long data is kept

Feedback and comments: Up to 24 months from submission. An automatic daily routine deletes older records.
Abuse prevention counters (password attempts and feedback submissions): Deleted within 30 days. An automatic daily routine removes old counters, without affecting the 24-month retention of the feedback itself.
Private page session: Up to 30 days, in your browser.
Visit statistics: Up to 6 months, at Umami.
Emails and alerts: As long as needed to reply and keep track of professional contacts, unless you ask for deletion.
Hosting technical logs: For the periods set by the providers.

Copies kept by external providers, such as backups or caches, may take some additional time to be removed, according to each service's routines.

Security

The site uses encrypted connections (HTTPS), protected cookies, a database with no public access, identifiers stored only in encrypted form, private documents delivered only after authentication and a limit on password attempts. No system is fully immune to incidents, but I review these measures and, if something relevant happens, I will take the steps required by the LGPD.

Your rights

Under the LGPD (art. 18), you can ask for confirmation of and access to your data, correction, anonymization, blocking or deletion, information about sharing, and object to processing based on legitimate interest.

Send your request to portfolio@anamaestri.com. Because feedback is anonymous, I may ask for details that help locate the record, such as the case and approximate date. You can also clear site data in your browser and, if needed, file a complaint with the ANPD.

Changes to this policy

If the site starts handling data differently, this page will be updated and the date at the top revised.