Version of October 21, 2026. The Portuguese version prevails in case of divergence.
This policy explains what personal data CoderDraw (coderdraw.com) collects, why, who we share it with and how long we keep it, under Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and Internet Civil Framework (Law 12,965/2014). Questions and requests: [email protected].
1. What we collect
- To design your piece: the place chosen on the map, the property name, texts and customization options. If you paste a listing link (e.g. Airbnb), we read that public listing page to fill in the name, city and approximate location.
- When you generate a preview: the preview and its parameters, date and time, IP address and browser.
- At purchase: name, email, phone (optional) and shipping address; the preview you approved, with date, time, IP and browser of the purchase.
- Payment: handled by Mercado Pago. We never receive or store card data; we only receive the confirmation, amount and payment ID.
- "My orders": the email you enter to receive the access link.
- Access logs: like any website, we log IP, date, time and page accessed.
2. Purposes and legal bases
- Making and delivering your order and contacting you about it: performance of contract (LGPD art. 7, V).
- Recording the approved preview (image, fingerprint, date, time, IP, browser): proof of which piece was bought, protecting you and CoderDraw in case of dispute. Basis: regular exercise of rights and legitimate interest (art. 7, VI and IX).
- Security and abuse prevention, such as limiting automated preview generation by bots: legitimate interest (art. 7, IX).
- Keeping access logs for 6 months: legal obligation (Internet Civil Framework, art. 15).
- Tax and consumer-law obligations: legal obligation (art. 7, II).
We don't sell data, don't use it for advertising and don't build behavioral profiles.
3. Cookies
Only essential cookies: the one that keeps you signed in to "My orders" (30 days) and the sign-in cookies of the admin and partner-shop areas. No advertising or analytics cookies.
4. Who we share data with
- The partner shop that makes your piece: the piece files and shipping details (name, address, phone).
- Mercado Pago: payment processing, under its own privacy policy.
- Melhor Envio and carriers: postal codes for shipping quotes and, when shipping, the delivery details.
- Resend: sending order emails.
- Cloudflare: delivering and protecting the site; it processes your IP for that.
- Authorities: under court order or legal obligation.
Some of these providers may process data outside Brazil, always with the safeguards required by the LGPD (art. 33).
5. How long we keep it
- Previews not purchased: deleted after 7 days.
- Orders and the approved-preview record: 5 years (tax and consumer-law periods).
- Access and abuse-prevention logs: up to 6 months.
- "My orders" access link: valid for 15 minutes.
6. Your rights
You may request at any time: confirmation that we process your data, access, correction, anonymization or deletion of what we are not legally required to keep, portability, information about sharing, and review of consent where applicable (LGPD art. 18). Write to [email protected] from the email used for the purchase; we reply within 15 days. You may also file a complaint with Brazil's data protection authority (ANPD).
7. Security
The site uses encrypted connections (HTTPS), admin access is restricted and protected by hashed passwords, and we keep backups. No system is fully immune; if a relevant incident occurs, we will notify those affected and the ANPD.
8. Changes
We may update this policy. The current version date is at the top of the page; relevant changes will be announced on the site.