Privacy policy — AND Branding Studio

IWho looks after your data

AND Studio de Marcas (AND Branding Studio), Brazilian company registration (CNPJ) 34.272.975/0001-90, is the controller of the personal data processed on this website (andmore.com.br): we decide what it is used for and how.

Data protection officer (LGPD, art. 41): requests are handled at contato@andmore.com.br. Any request, question or complaint about your data goes there.

IIWhat data we process and why

When	What data	What for	Legal basis (LGPD)
You visit the website	IP address, browser, date and pages visited, logged by the hosting server.	Keeping the site online and secure; complying with Brazil's Internet Civil Framework (Law No. 12,965/2014, art. 15).	Legal obligation (art. 7, II) and legitimate interest in protecting the site (art. 7, IX).
You fill in a brief	Name, email, company or developer, role, phone or WhatsApp (real estate brief), your written answers and the images and PDFs you upload.	Understanding the project, preparing the proposal and creating the brand; sending you a copy of your answers.	Pre-contractual steps and performance of a contract, at your request (art. 7, V).
You resume a brief on another device	The brief's email address and a single-use 6-digit code sent to it.	Making sure only the owner of the email can open the answers: knowing the email is not enough.	Performance of a contract (art. 7, V) and security of your data (art. 7, IX; art. 46).
You receive a proposal	The name of the person who contacted us (written by AND in the proposal); when the proposal is opened (date and an encrypted identifier of the connection, without storing the IP); on acceptance, the typed name, the date and the approved version.	Following the negotiation and recording what was agreed.	Pre-contractual steps and performance of a contract (art. 7, V); regular exercise of rights (art. 7, VI).
You talk to AND	Whatever you write by email or on Instagram.	Replying and moving the conversation forward.	Pre-contractual steps (art. 7, V) or legitimate interest (art. 7, IX).
Abuse protection	An encrypted identifier (hash) of the connection to count attempts on the forms; and, in error and studio-area logs, date, time, IP and the type of event — never passwords or answers.	Blocking bots, mass submissions and intrusion attempts; fixing bugs.	Legitimate interest (art. 7, IX) and the Internet Civil Framework.

We do not ask for sensitive data (health, religion, racial origin, political opinion, etc.) — please don't include it in your answers. The brief is about your company: if an image shows people, only upload it with their permission.

We do not use your data for automated decisions or behavioural profiling.

IIICookies and browser storage

This website uses no advertising or analytics cookies. What it stores in your browser is only what it needs to work, so we don't ask for consent for it:

Where	What it is	How long
`and-intro`	Remembers that the opening animation was already shown in this visit (sessionStorage).	Until you close the tab.
`and-briefing:…`	A copy of your answers on this device, so nothing is lost offline, and this device's access key to your brief (localStorage).	The copy is removed when the brief is sent; the key stops working after 180 days without use. On a shared computer, send the brief when you finish or clear your browsing data.
`and_estudio` and related	Studio-area cookies, used by the AND team to log in to the dashboard. Only created for whoever opens the studio area.	The session ends on logout, after 60 minutes of inactivity or within 12 hours; the team's device recognition, after 180 days.
Vimeo videos	The case-study videos use the Vimeo player with “do not track” (`dnt`) on, which turns off cookies and viewing statistics. To deliver the video, Vimeo receives the IP address.	While the video is playing.

Hostinger — hosts the website, the briefs and the contato@andmore.com.br mailbox. It acts as a processor: it only handles the data to provide that service to AND.
Vimeo — only when you watch a video on a case-study page.
Instagram (Meta) — only if you click the link to our profile; from then on, Meta's policy applies.
Public authorities — when required by law or court order.

No visit to this website is reported to Google, Adobe or ad networks: fonts and animation libraries are served from our own server.

VInternational transfers

The website's server is in Brazil, but the hosting backups are kept in the United States, and Vimeo also operates from there. These transfers follow art. 33 of the LGPD: they are needed to deliver the service you asked for (item IX) and rely on the contractual data protection safeguards offered by these providers (item II).

VIHow long we keep it

Data is kept only while it serves the purpose it was collected for. The server applies these periods automatically:

Data	Period
Brief draft not sent	Deleted, with its files, 90 days after the last change.
Brief sent, no contract	Deleted, with its files, 12 months after it was sent.
Brief of a client who hired AND	Kept for 5 years from hiring, to meet legal obligations and to defend ourselves in any legal proceeding; then deleted.
Proposals and acceptance records	While the negotiation or contract lasts and for up to 5 years after, for the same reasons.
Emails exchanged with AND, including the copy of the brief	The same periods as the brief or proposal they refer to.
Email confirmation code	15 minutes. Each device's access key stops working after 180 days without use.
Abuse counters	24 hours.
Error and studio-area logs	6 to 12 months.
Server access logs	The hosting provider's period, never less than the 6 months required by the Internet Civil Framework.

Hosting backups may keep already deleted data for a while longer, until they are replaced in the provider's normal cycle.

VIIYour rights and how to ask

Under the LGPD (art. 18), you may ask at any time for:

confirmation that we process your data, and access to it;
correction of incomplete, inaccurate or outdated data;
anonymisation, blocking or deletion of unnecessary data or data processed against the law;
deletion of your data, except what the law requires us to keep;
portability of your data to another provider;
information about who we share your data with;
objection to processing based on legitimate interest.

Write to contato@andmore.com.br, preferably from the same email used in the brief or proposal — otherwise we may ask you to confirm the data is yours before acting on it. We reply within 15 days.

If you feel your request was not properly handled, you can also complain to Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.

VIIISecurity

The whole website runs on an encrypted connection (HTTPS).
Briefs are kept out of reach of the browser and identified by an encrypted code, never by the email address.
Resuming a brief on another device requires a code sent to that same email.
The studio area is restricted to the AND team, with an irreversibly stored password (hash), limited attempts and expiring sessions.
The forms have limits against bots and mass submissions.

If a security incident may bring you relevant risk or harm, we will notify you and the ANPD, as required by art. 48 of the LGPD.

IXOther points

Children and teenagers. This website is aimed at companies and does not knowingly collect data from anyone under 18.

Changes to this policy. When this policy changes, the “Last updated” date at the top changes too. Important changes are highlighted here.

Ask about my data Ler em português

In short