Complete Privacy & Cookie Policy by Extent
At Atelier João Ishiguro, reverence for the tree's natural lifespan goes hand-in-hand with an uncompromising respect for your individual privacy and data sovereignty. We operate in strict adherence to Brazil's General Data Protection Law (LGPD - Law No. 13,709/2018), the European Union's General Data Protection Regulation (GDPR - Regulation EU 2016/679), and the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).
This Privacy and Cookie Policy describes in a complete, transparent, and exhaustive manner how we collect, process, protect, retain, and share your personal data when navigating our website (jshiguro.com), inquiring about custom architectural commissions, or acquiring ready heirloom pieces from our collection.
1. Data Controller and Data Protection Officer (DPO)
The Controller responsible for decisions regarding the processing of your personal data is Atelier João Ishiguro (João Ishiguro Fine Woodworking & Bespoke Design), operating out of São José dos Campos - SP, Brazil. For any questions regarding this policy or to exercise your statutory rights as a data subject, our official channel and Data Protection Officer can be reached directly via email at jshiguro@gmail.com or via official WhatsApp at +55 (11) 97338-5935.
3. Collected Personal Data and Collection Methods
3.1. Data Provided Directly by You: We collect personal information that you voluntarily provide when completing our consultation forms, inquiring about bespoke projects, opening WhatsApp channels, or purchasing a ready piece from our studio. This includes:
- Basic identity: First and Last Name.
- Direct contact channels: WhatsApp/Phone number and official email address.
- Courier delivery details: Complete physical shipping address including Postal Code (CEP), street, building number, suite/unit, neighborhood, city, and state.
- Custom commission specifications: Desired architectural dimensions, wood species preferences (Ipê, Brazilian Cherry, Muiracatiara, Purpleheart, etc.), and functional requirements.
3.2. Data Collected Automatically (Subject to Your Prior Consent): When navigating our gallery, certain technical telemetry may be recorded in aggregated or pseudonymous form, solely upon your affirmative consent:
- Network connection metadata: Anonymized IP address, ISP, and connection port.
- Device identifiers: Operating system, browser family and version, interface language, and screen viewport dimensions.
- Navigation behavior: Pages visited, dwell time across individual philosophies (Wabi-Sabi and Heirloom), scroll interactions, and anonymous session replay (heatmaps via Microsoft Clarity).
- Attribution and traffic origin: UTM tags (utm_source, utm_medium, utm_campaign), initial landing route, referring URL, and advertising campaign click IDs (gclid, fbclid, msclkid, ttclid).
4. Processing Purposes and Legal Bases (LGPD Art. 7 & GDPR Art. 6)
Every data processing activity conducted by Atelier Ishiguro serves a legitimate purpose and relies on strict statutory legal grounds under LGPD Article 7 and GDPR Article 6:
Commission Quotes and Contract Performance (LGPD Art. 7, V): Using your name, WhatsApp, email, and address to draft formal proposals, align natural wood grain patterns, and confirm bespoke orders.
Physical Courier Logistics and Delivery (LGPD Art. 7, V): Sharing delivery details and parcel dimensions with national couriers (Correios Sedex/PAC) and certified freight partners for secure dispatch in custom timber crates.
Direct Artisan Dialogue (LGPD Art. 7, V & IX): High-touch personalized communication via WhatsApp to transmit workshop progress photographs and discuss joinery nuances.
Analytics and Experience Optimization (LGPD Art. 7, I - Consent): Measuring aggregate audience reach and reading flow across collections via Google Analytics 4 and Microsoft Clarity, strictly contingent on your explicit consent.
Compliance with Statutory Obligations (LGPD Art. 7, II): Retaining internet application connection timestamps and IP records for 6 months pursuant to Article 15 of Brazil's Marco Civil da Internet (Law 12,965/2014).
Fraud Prevention and Infrastructure Hardening (LGPD Art. 7, IX - Legitimate Interest): Mitigating malicious automated scrapers, billing attacks, cross-site scripting (XSS), and safeguarding server infrastructure.
5. Comprehensive Cookie Policy and Tracking Taxonomy
Cookies are compact text files stored on your device when you browse our website. They enable session recognition, preserve language preferences, and help us analyze visitor engagement.
Our platform implements Google Consent Mode v2 and native script governance. By default, all analytical and marketing scripts are strictly frozen until you provide unambiguous consent.
Critical for network transmission, secure typography loading, and preserving your legal consent choices (cookie 'ishiguro_lgpd_consent'). These contain no personally identifiable data and cannot be switched off.
Allows us to quantify visitor flows, reading depth across our Philosophy essays (Wabi-Sabi and Heirloom), and UI responsiveness. Powered by Google Analytics 4 (with IP anonymization) and Microsoft Clarity (with form masking).
Maintains your preferred browsing settings, such as your chosen language ('ishiguro_locale' for English/Portuguese) and catalog filters across visits.
Measures the effectiveness of atelier exhibitions and search campaigns on Google and Meta Ads, utilizing consolidated conversion events without building third-party cross-site profiling.
6. Data Sharing with Third-Party Processors
Atelier João Ishiguro does not sell, lease, monetize, or broker your personal information to any third parties for external marketing purposes.
Sharing is strictly restricted to enterprise-grade service operators required to maintain our digital atelier, process orders, and fulfill parcel deliveries:
Supabase Inc. (Postgres Database Infrastructure): Encrypted storage of consultation briefs, customer records, and orders, secured with Zero-Trust Row Level Security (RLS) policies and SOC 2 Type II compliance.
Vercel Inc. (Edge Cloud & CDN Infrastructure): Global edge delivery provider ensuring encrypted transport and DDoS protection.
Empresa Brasileira de Correios e Telégrafos (Correios) & Courier Partners: Restricted sharing of recipient name, delivery address, and telephone to calculate postal rates, generate tracking waybills, and execute safe delivery.
Google LLC & Microsoft Corporation: Telemetry providers (GA4 and Clarity), activated solely upon affirmative consent with anonymized data.
7. Information Security, Encryption, and Hardening
We apply rigorous industry-standard software engineering practices to preserve the confidentiality, integrity, and availability of your records:
In-Transit Encryption (TLS 1.3 / HSTS Preload)
All traffic between your device and our edge servers is encrypted via TLS 1.3 with active HSTS Preload policy.
Sanitized Content Security Policy (CSP)
Strict HTTP security headers prevent cross-site scripting (XSS), framed clickjacking, and rogue third-party script injection.
Zero-Trust Row Level Security (RLS)
PostgreSQL database tables protected at engine level, preventing public selects, unauthorized data browsing, and lead leaks.
WebCrypto Cryptographic Signatures
Cryptographic SHA-256 and HMAC request verification prevents malicious bots, automated tampering, and billing attacks.
8. Data Retention and Irreversible Disposal
Your personal data is retained only for the duration necessary to fulfill the legitimate purposes outlined in this policy:
Inquiries and Bespoke Briefs: Retained throughout the consultation and for a statutory period of 5 (five) years following fulfillment, in accordance with the Brazilian Civil Code and Consumer Protection Code, backing heirloom warranties.
Internet Application Connection Logs: Maintained securely under restricted access for the mandatory statutory duration of 6 (six) months, pursuant to Article 15 of Brazil's Marco Civil da Internet.
Cookie Consents: Consent tokens remain active for up to 12 (twelve) months, after which re-affirmation is requested, and may be revoked by you at any moment.
Irreversible Deletion: Upon expiration of legal retention thresholds or upon verified request by the data subject, records are destroyed via secure physical/logical deletion or irreversibly anonymized.
9. Your Rights as a Data Subject (LGPD Art. 18 & GDPR)
In alignment with Brazilian and international privacy standards, you are entitled to request at any time:
- ✓Confirmation of whether your personal data is being processed by us;
- ✓Access to the personal data we hold about you;
- ✓Rectification of incomplete, inaccurate, or out-of-date information;
- ✓Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
- ✓Portability of your personal data to another service provider;
- ✓Irrevocable deletion of personal data processed on the basis of consent;
- ✓Information on the entities with whom your data has been shared;
- ✓Revocation of consent at any moment, without affecting the legality of prior processing.
10. Contact Channel and Studio Inquiries
To exercise any of your statutory rights, update your consent preferences, or request clarification regarding our data handling practices, please contact our studio directly: