Privacy Policy — Três Limões Website

1What this policy covers

This policy covers the treslimoes.com.br website — the studio's institutional site, which presents the company and its products. It does not cover the apps, which handle data in their own ways and each have their own policy:

2Who processes your data

This site is operated by BARBOSA E FOLLE DESENVOLVIMENTO DE SOFTWARE LTDA ("Três Limões", "we"), CNPJ 68.586.378/0001-52, registered at Av. Paulista, 91, Brazil.

For anything to do with your privacy — questions, requests for access, correction or deletion of data — write to us at privacidade@treslimoes.com.br.

Data Protection Officer: in accordance with Art. 41 of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018), Três Limões appoints Logan Cunha Folle as the officer responsible for personal data processing. The channel is free and direct:

• E-mail: dpo@treslimoes.com.br
• Hours: Monday to Friday, 9am to 6pm (BRT), except public holidays

3What this site does not do

It is worth starting with what does not happen here, because it is most of the story:

• There is no sign-up, no login and no form. There is no account on this site and no field for you to type anything into. The only way to send us data is by writing to one of our e-mail addresses, on your own initiative.
• We do not store cookies. None, under any circumstances.
• We do not load anything from third parties. Fonts and images are served from our own domain. There is no Google Fonts, no external CDN, no social network pixel, no embedded map and no video from another site — nothing that makes your browser contact another company because of our page.
• There is no advertising and no cross-site tracking. We do not sell, rent or share any data for marketing purposes.
• We do not store your preferences. Language and theme (light, dark or "system") last only while you browse and are not saved — switching theme leaves no trace on your device.

4What happens when you visit

Hosting access logs. The site is hosted on Cloudflare Pages. Like any web server, Cloudflare's infrastructure logs the request — IP address, date and time, page requested and browser identification — in order to deliver the page and to protect the site against abuse and attack.

• Legal basis: there are two purposes in the same log, and they do not share a basis. Delivering the page your browser asked for fulfils a request from you (Art. 7, V of the LGPD — procedures carried out at the data subject's request): without logging the request there is no way to answer it. Protecting the site against abuse and attack is legitimate interest (Art. 7, IX), to the extent needed to keep the service running. We do not use these logs to build a profile of you, nor for any purpose beyond those two.
• Retention: the logs stay with Cloudflare, under Cloudflare's own retention periods.
• International transfer: Cloudflare is a foreign company and its network operates outside Brazil, which constitutes an international transfer (Art. 33 of the LGPD). The ground we rely on is Art. 33, IX together with Art. 7, V: the transfer is the very act of delivering you the page you asked for, not a later use of the log. It is worth stating what we do not rely on, and why: we do not rely on standard contractual clauses (Art. 33, II), because Cloudflare does not offer the clauses approved by the ANPD (Brazil's data protection authority — Resolution CD/ANPD No. 19/2024, whose adoption deadline closed on 23/08/2025), and recognition of equivalent foreign clauses depends on a decision by the ANPD itself (Art. 18 of that resolution). The ground above is one of those the resolution preserves precisely because it does not depend on further regulation (Art. 1, sole paragraph). If that reading changes, this is the first point in this policy that changes.

Local storage. If — and only if — the measurement described in section 5 is switched on, your answer to the notice is kept in your own browser's local storage, so that we do not ask again on every page. It is not sent anywhere and it disappears if you clear the site's data. Nothing else is written to your device.

E-mail. If you write to suporte@treslimoes.com.br or privacidade@treslimoes.com.br, the message passes through Cloudflare's infrastructure (Email Routing) before reaching our inbox, and we process its contents only in order to reply to you. There is an international transfer here too, over the same network and on the same ground as the logs above (Art. 33, IX together with Art. 7, V) — you wrote on your own initiative, and delivering the message is answering what you asked for. When what you write is a request under section 6, Art. 33, IX together with Art. 7, II also applies: replying is a legal obligation of ours (Art. 18 of the LGPD), and keeping this channel open is required by Resolution CD/ANPD No. 2/2022.

5Audience measurement

This site may use Cloudflare Web Analytics to count visits: how many pages were opened, which country the visit came from, which address brought the person here, and how long the page took to load. It exists to tell us whether the site is being found, and nothing beyond that. Cloudflare already hosts the site, so this adds no new supplier.

Measurement only happens if you allow it. When it is active, a notice with two options appears on your first visit, and the script is only loaded after a yes. If you decline — or close it without answering — the script does not load, and the site works exactly the same. While no measurement is active, the notice does not appear, because there would be nothing to consent to.

• It uses no cookies. Cloudflare Web Analytics writes no cookie and no identifier to your device, and does not follow you across other sites. What it produces are aggregate counts, not a profile of you.
• Legal basis: consent (Art. 7, I).
• International transfer: Cloudflare's network operates outside Brazil, so authorising measurement is authorising an international transfer (Art. 33). The ground here is Art. 33, VIII: consent is specific to that purpose and to that purpose only, it is requested prominently before any script loads, and the notice itself states in advance that the party counting the visits is Cloudflare, from outside the country.
• To change your mind, use Measurement preferences, in the footer of any page: the notice reappears and your new answer applies from the next page load onwards.
• Retention: the aggregate data stays with Cloudflare, under Cloudflare's own retention periods.

6Your rights

The LGPD grants you, among others, the rights to confirm whether we process your data, to access it, correct it, request its deletion and withdraw consent. Since this site keeps no registration, in practice what exists about you here is the access log described in section 4 and, where applicable, your answer to the measurement notice — which you can delete yourself by clearing the site's data in your browser.

To exercise any right, write to the data protection officer's channel, dpo@treslimoes.com.br (section 2). We reply within the deadlines set by the LGPD. If a request depends on identifying you inside a log we do not keep in identifiable form, we will explain that in our reply rather than ask you for more data just to locate you.

7Changes to this policy

We may update this text as the site changes. The last updated date at the top indicates the version in force.

8Contact

BARBOSA E FOLLE DESENVOLVIMENTO DE SOFTWARE LTDA (Três Limões) CNPJ 68.586.378/0001-52 Av. Paulista, 91 E-mail: privacidade@treslimoes.com.br Data Protection Officer: Logan Cunha Folle — dpo@treslimoes.com.br