Privacy Policy
What data is handled, why, who it is shared with and how you stay in control of it.
1. Who is responsible for your data
The controller is [RAZÃO SOCIAL — preencher], registered under Brazilian company number (CNPJ) [CNPJ — preencher], with its seat at [ENDEREÇO COMPLETO — preencher], trading as Sartori Audio. For anything in this policy — including the requests in section 8 — write to contato@sartoriaudio.com. The studio answers directly.
This policy covers the site, the client area and support over email and WhatsApp. It follows Brazilian law 13.709/2018, the LGPD.
2. The principle: only what is necessary
The sign-up screen asks for two things: email and password. It does not ask for your name, tax ID, phone, address or date of birth, because none of that is needed to create an account — and data that serves no purpose should not be collected (LGPD, art. 6, III).
What arrives later comes from the purchase, not from a form: when Hotmart confirms an order, it sends the studio the buyer’s details, so the purchase can be identified, the tax document issued and support provided. That is why the list in the next section is longer than the sign-up screen.
3. What data, what for, on what legal basis
| Data | What for | Legal basis |
|---|---|---|
| Identify the account, tie a purchase to it and talk to you about what you bought | Performance of a contract (art. 7, V) | |
| Password (stored as a hash) | Authenticate you and nobody else | Performance of a contract (art. 7, V) |
| Name | Know whose order it is, address support properly and sign service agreements | Performance of a contract (art. 7, V) |
| Tax ID (CPF) | Issue the tax invoice and meet the tax obligation that comes with the sale | Legal or regulatory obligation (art. 7, II) |
| Purchase and licence history | Release downloads, keep track of active devices and provide support | Performance of a contract (art. 7, V) |
| Project files and messages | Carry out the studio work you hired and record the recalls | Performance of a contract (art. 7, V) |
| Access logs (IP and timestamp) | Mandatory log retention and investigation of abuse or fraud | Legal obligation (Marco Civil, art. 15) and legitimate interest (art. 7, IX) |
| Email, if you ask for news | Send you word about new plugins, courses and posts | Consent (art. 7, I) |
The last row is the only one that depends on you saying yes, and it starts unticked at sign-up. Refusing changes nothing about your account, and opting out later is one click at the bottom of any email.
No sensitive data is handled, and no automated decision producing effects on you is made.
4. Who the data is shared with
Your data is not sold and is not handed to anyone for advertising. Sharing only happens with those who need it for the service to work:
- Hotmart — processes the payment, issues the charge and hosts the course video. It is the source of the buyer data and operates under its own policy.
- Hosting and transactional email provider — store and transmit what the account needs in order to exist, under contract and without using the data for anything else.
- Accounting and the tax authority — receive what issuing an invoice requires.
- A judicial or administrative authority — only under a valid order, and only what the order asks for.
Some of these providers keep servers outside Brazil. When that is the case, the transfer relies on article 33 of the LGPD and requires the provider to offer the same level of protection Brazilian law does.
6. How long the data is kept
- Account and purchase history: for 5 years after your last purchase. The window follows the limitation period in article 27 of the Consumer Code and the retention of tax documents.
- Access logs: 6 months, the minimum required by article 15 of the Brazilian Internet Act.
- Studio project files: 12 months after final delivery.
- Email on the news list: until you opt out.
When you delete your account, access ends immediately. What survives the request is only what the law requires to be kept, and it stays isolated from everything else until the period runs out.
7. Security
Passwords are stored as hashes, never in plain text — not even the studio can read yours. The site’s traffic is encrypted, and access to the database is restricted.
No system is infallible. If an incident happens that could bring you relevant risk, you and the ANPD are notified, as article 48 of the LGPD requires.
8. Your rights
Article 18 of the LGPD gives you, over your own data, the right to:
- Confirm they exist and access what is held.
- Correct anything wrong or incomplete.
- Ask for deletion of anything no longer necessary, or anything you consented to.
- Take the data to another provider.
- Know who they were shared with.
- Withdraw a consent at any time.
- Object to processing you consider improper.
To exercise any of them, write to contato@sartoriaudio.com. The answer comes within 15 days, at no cost and with no need to justify the request.
If that answer does not settle it, you can take the matter to the Brazilian data protection authority, the ANPD.
9. Children and teenagers
Accounts here are for people 18 or older, and sign-up asks you to declare it — buying means entering a contract, and minors cannot contract on their own.
If an account is found to belong to a minor, the data is deleted and whatever was paid is refunded. If you are the guardian of someone who created an account here, write to the studio and it is sorted out immediately.
10. Changes to this policy
When this policy changes, the date at the top changes with it. If a change alters the purpose or legal basis of something already handled, notice comes by email before it takes effect.
This document exists in Portuguese and in English. If the two versions disagree, the Portuguese version prevails.