Privacy
Policy

The controller of your personal data is Daniel Cardoso Borges Moreno, trading as zavierflow, NIF 273296566, Rua Geraldo Sem Pavor, 1, 2755-049 Cascais, Portugal. For anything related to privacy, write to hello@zavierflow.com or to the postal address above. We are not required to appoint a data protection officer.

This policy explains how we handle personal data when you visit zavierflow.com, contact us, place an Order and work with us on it. It does not cover third-party websites or services you reach through links on the Site, such as Stripe's payment page, which have their own policies.

Data you give us.

• Contact form and emails: your name, email address, the topic and your message.
• Orders: your email address, the business name and notes you choose to add at checkout, and the name, billing address, country and, if you add it, VAT number collected by Stripe. Card details are collected and processed by Stripe. We only see limited information such as the card brand, the last four digits and the payment status.
• Working on your Order: your answers to the brief, the files, links and access you share with us, your comments and approvals, and the emails we exchange.

Data collected automatically. Our hosting provider processes technical data such as IP address, browser type and request times in server logs, to deliver and secure the Site. We store your cookie choices in your browser. We do not use analytics or advertising cookies. If we ever add them, they will only run after you opt in. See our Cookie Policy.

Data from third parties. Stripe tells us whether a payment succeeded and may share fraud-prevention signals.

We do not ask for special categories of data (such as health, religion or political opinions) and ask you not to include them in your brief or files.

When you give us access to a Webflow project, form submissions or other material that contains personal data about your own visitors or customers, you are the controller of that data and we act as your processor (article 28 of the GDPR). We process it only to carry out your Order and on your documented instructions, we do not copy or export it, we keep it confidential, we only let people bound by confidentiality access it, we help you respond to requests from those people, we tell you without undue delay about any breach, and we stop accessing it when the Order is complete. These Terms and this section are our processing agreement with you.

We do not send marketing newsletters. If we ever offer one, we will only send it if you sign up. We do not sell your personal data, we do not use it for automated decisions with legal or similarly significant effects, and we do not use your briefs, files or deliverables to train AI models.

We share personal data only with service providers that help us run the business, under terms that require them to protect it and use it only on our instructions, or with authorities when the law requires it:

• Stripe, for payment processing and fraud prevention.
• Vercel, which hosts the Site.
• Email providers, which host our mailbox and send transactional emails such as order confirmations.
• Design and delivery tools, such as Figma, Webflow, Google Workspace and file transfer services, used to create and deliver your work.
• Our certified accountant and the Portuguese Tax Authority (Autoridade Tributária e Aduaneira), to which invoice data is reported as the law requires.
• Freelance specialists, only when they help on your Order, bound by confidentiality and limited to the information they need.

We may also disclose data when required by law, by a court or by a competent authority, or to defend our rights in a dispute.

Some of our providers process data outside the European Economic Area, including in the United States. When that happens, we rely on safeguards recognised by the GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or standard contractual clauses approved by the European Commission.

• Invoices and accounting records: 10 years, as required by Portuguese tax law.
• Order records and the emails about an Order: until the end of the period in which claims about it can be made, usually 5 years after the Order is complete.
• Briefs and the files you sent us: up to 2 years after your last Order, so we can help with follow-up questions. You can ask us to delete them earlier.
• Copies of delivered files: 12 months after delivery, so we can resend them if you lose them.
• Messages that do not lead to an Order: 12 months.
• Server logs: kept by our hosting provider for a short period, usually no longer than 30 days.
• Your cookie choices: 12 months, after which we ask again.

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable format and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting processing that took place before. Write to hello@zavierflow.com. We may need to confirm your identity before acting on a request, and we reply within one month.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the data protection authority of the country where you live or work.

The Site is served only over HTTPS. Payments are handled by Stripe, which is certified to PCI DSS Level 1. We limit access to personal data and files to what is needed to carry out your Order, use strong passwords and two-factor authentication on our accounts, ask to be invited to your tools instead of receiving passwords, and delete data we no longer need. If a breach is likely to put you at risk, we will tell you and the CNPD as the law requires.

Our services are for adults and businesses. We do not knowingly collect personal data from anyone under 18. If you believe a minor has sent us personal data, contact us and we will delete it.

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you by email before it applies.

Privacy requests and questions: hello@zavierflow.com
Postal address: Daniel Cardoso Borges Moreno (zavierflow), Rua Geraldo Sem Pavor, 1, 2755-049 Cascais, Portugal