Coolpants Logo

AND NOW, THE BORING BUTVERY IMPORTANT PART

Privacy Policy

Last updated: October 21, 2026

We like keeping things transparent—both in how we build websites and how we handle your data. This page outlines what information we collect when you use our website or fill out our forms, why we collect it, and how we protect it under the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and Portuguese Law No. 58/2019.

1. Data Controller

The entity responsible for processing your personal data (Data Controller) is:

2. What Data We Collect & How

When you fill out and submit our intake or contact forms, we collect the personal information you voluntarily provide, which typically includes:

  • Name
  • Email Address
  • Company Name & Website URL (if provided)
  • Message content, project details, and service preferences
  • Consent Log: Timestamp and technical audit log associated with your form submission.

3. Purpose & Legal Basis for Processing

We process your personal data under the following legal bases pursuant to the GDPR and Portuguese law:

  • To respond to your inquiries: The legal basis is your explicit consent (Art. 6(1)(a) GDPR) granted when checking the consent box prior to form submission, and/or taking necessary pre-contractual steps at your request (Art. 6(1)(b) GDPR) to prepare for a 15-minute discovery call or project proposal.
  • Direct Communication: We only use your contact details to communicate directly about your inquiry or active project. We do not run unsolicited spam campaigns.

4. How We Process & Share Your Data

We value your privacy and do not sell, rent, or trade your personal information. We only partner with verified infrastructure subprocessors adhering to stringent data protection standards:

  • Cloudflare, Inc. (Hosting, Edge Infrastructure & Database): Our website and Edge serverless runtime are hosted globally on Cloudflare Pages and Workers. Form submissions and consent records are encrypted and stored in our serverless Cloudflare D1 database. Cloudflare complies with GDPR standards and data transfer mechanisms under the EU-U.S. Data Privacy Framework.
  • Discord Inc. (Internal Inquiries Webhook): To manage incoming contact inquiries efficiently without clunky CRM intermediaries, our custom-built form routes your submission notifications directly to an internal, highly restricted Discord channel via Webhooks. Discord complies with GDPR standards under the EU-U.S. Data Privacy Framework. Access to this channel is strictly limited to the two of us on a need-to-know basis.

Analytics & Cookies: We use Cloudflare Web Analytics, a privacy-first analytics tool. It operates entirely without cookies, does not collect personal identifiers or IP addresses, and does not track you across different websites.

5. Data Retention (90-Day Policy)

We retain your personal data only for as long as necessary to fulfill the purpose for which it was collected:

  • Automated 90-Day Database Lifespan: Contact form submissions stored in our Cloudflare D1 database and associated consent logs are programmed to be automatically purged 90 days after the date consent was recorded.
  • Webhook Notifications: Incoming inquiry notifications in our internal channels are routinely cleared once the inquiry is resolved, and no later than 90 days.
  • Active Business Agreements: If communication leads to a commercial agreement, project contract, or billing, records required for tax, accounting, or legal compliance will be retained in accordance with statutory retention periods under Portuguese law.

6. Your Data Protection Rights

Under the GDPR, as a user based in the EU/EEA (or contacting an EU entity), you have the following rights:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete data.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data when no longer needed or if consent is withdrawn.
  • Right to Restrict or Object: Object to or restrict the processing of your data under specific circumstances.
  • Right to Withdraw Consent: You can withdraw your consent at any time by contacting us, without affecting the lawfulness of processing based on consent prior to withdrawal.

To exercise any of these rights, please send an email to sofia.ribeiro@coolpants-studio.com.

If you believe your data is being processed in breach of GDPR regulations, you also have the right to lodge a complaint with the Portuguese Data Protection Authority:

  • CNPD – Comissão Nacional de Proteção de Dados
  • Website: www.cnpd.pt

7. Changes to This Policy

We reserve the right to update this Privacy Policy periodically. Any updates will be posted directly on this page with an updated “Last updated” date.