RAFAEL SANCHES ISABELLA · PRIVACY
Privacy notice
Last updated: November 4, 2026
This notice explains how this professional portfolio handles personal information. The website is a static portfolio and does not use advertising trackers or third-party analytics.
Who is responsible
Controller: Rafael Sanches Isabella, based in Greater São Paulo, Brazil. For privacy requests, send a message through LinkedIn and write “Privacy request.” LinkedIn will process that communication under its own privacy terms. Do not include sensitive data.
Information and purposes
- Portfolio content: professional history, credentials, public profile link and the small portrait supplied for this website are displayed to present my experience.
- Contact form: when active, it collects a visitor’s name, email address and message so I can reply. Please do not include sensitive, confidential or highly personal information.
- Technical visit data: Cloudflare Pages processes the request IP address and technical metadata such as requested URL, timestamp, browser information and security events to deliver and protect the site.
For contact replies, the intended legal basis is taking steps at the visitor’s request before a potential professional or business relationship, where applicable (LGPD, Article 7, V). Technical security processing may rely on legitimate interests where the required assessment supports it (Article 7, IX). No consent-based analytics or marketing is used.
Contact form status and service providers
The Static Forms endpoint is configured for EU (Frankfurt) form storage, with automatic deletion after 30 days. I have temporarily disabled the form in this site until I receive written confirmation about the Brazilian international-transfer mechanism for all non-EU processing. Do not submit messages through an older copy of this site while that review is pending.
Static Forms’ published documentation says submissions are stored in AWS in Frankfurt; account data, operational request metadata and email notifications are processed in the United States, and notification email has a Singapore failover region. Its classic spam filter may send form values, sender email and IP address to CleanTalk for scoring in the EU; the provider is incorporated in the United States. The notification email is delivered to the account inbox, where Google may retain it under the account’s own settings. The provider says its Free plan supports per-form retention settings; this form is set to 30 days.
The Static Forms DPA and current subprocessor list are available at staticforms.dev/dpa. The EU storage choice does not mean every part of the service stays in the EU.
Hosting and international processing
This website is hosted on Cloudflare Pages. Cloudflare’s global network processes visitor requests. Cloudflare’s documentation says customer traffic metadata may be stored globally by default unless a localization feature is configured; no regional boundary is configured for this project. See Cloudflare’s metadata-boundary documentation and Cloudflare’s DPA.
The ANPD recognizes the European Union as an adequate destination for LGPD transfer purposes. That recognition does not automatically cover transfers to the United States or Singapore. The lawful mechanism and safeguards for those flows are being confirmed with Static Forms before the contact form is enabled.
Cookies and local storage
This website code does not set cookies or save a language preference in local storage. Hosting or security providers may use technical identifiers needed to deliver or protect their services; consult their current notices for details.
Retention and rights
If the contact form is enabled after review, Static Forms will delete stored submissions after 30 days under the current form setting. Copies delivered to the Gmail inbox may remain until deleted there. Hosting-provider logs are governed by the provider’s current retention terms and settings. I will keep contact messages only as long as needed to reply and handle related professional or legal follow-up.
Under the LGPD, people may request confirmation, access, correction, information about sharing, portability where applicable, anonymization, blocking or deletion where legally available, and review or complain to the ANPD. Requests can be made using the channels listed above. See the ANPD rights guidance.
Security
The site is designed to serve locally hosted assets and code, without analytics scripts, external fonts, file uploads or user accounts. When deployed to Cloudflare Pages, response headers are configured to restrict framing, scripts, form destinations and browser capabilities. No internet service can guarantee absolute security; please do not send secrets through a public contact form.
Changes
This notice will be updated if provider terms, data flows or settings change. The contact form remains paused until the international-transfer review is complete.