Last updated: October 15, 2026.

This policy explains, in plain terms, what personal data this website receives, what it is used for, how long it is kept and how you can request access, correction or deletion. It follows Brazil's General Data Protection Law (Law No. 13,709/2018, the LGPD). This is a translation of the original Portuguese text; in case of any discrepancy, the Portuguese version prevails.

Who is responsible for your data

The website noahtuomi.com is run by Noah Tuomi, an individual artist based in São Paulo (SP), Brazil, who is the controller of the data processed here. For any privacy matter, use the page Contact and write “Privacy” at the start of the message. This is the channel for data subject requests.

What data we receive

  • Contact form: name, email and the message you write.
  • Mural quote request: name, email, phone (optional), city, wall type and size, desired deadline, project description and the images you choose to send (photos of the location and references). Please avoid sending photos that show people, documents or information that is not needed for the quote.
  • Technical access data: like any website, the server automatically records information such as IP address, date and time of access and browser type, for security and operation.
  • Purchases made here on the site (when the own shop is open): name, email, phone, CPF (Brazilian taxpayer ID), delivery address and the order items. Payment data (card, Pix or boleto) is entered directly in the Mercado Pago environment and is not stored on this site.

We do not ask for sensitive data (such as health, religion or political opinion) and the site is not directed at people under 18.

What we use it for and the legal basis

  • Replying to your message and preparing quotes: preliminary procedures related to a contract, at your request (art. 7, V, of the LGPD).
  • Fulfilling a purchase or a contracted service: performance of a contract (art. 7, V).
  • Keeping sales records required by law: compliance with a legal obligation (art. 7, II).
  • Keeping the site secure and running (access logs, protection against spam and attacks): legitimate interest (art. 7, IX).

Your data is not sold, is not used for advertising, and you are not added to any email list without asking.

Who the data is shared with

  • Hostinger: company that hosts the site and stores the messages received.
  • Google (Gmail): form messages also arrive by email in a Gmail inbox. Google may process this data on servers outside Brazil.
  • Mercado Pago: processes payments for purchases made here on the site, under its own privacy policy.
  • Partner shops (such as Colab55 and others listed on the page Shop): when you click a link, you leave this site. Purchases made there are handled by those shops, under their own policies. Some links are affiliate links: the shop may record that you arrived from here, but no data of yours is sent by this site.
  • Authorities: only when there is a legal obligation or a court order.

When any of these services stores or processes data outside Brazil, the transfer takes place to make possible the service you requested and with companies that adopt data protection safeguards, as provided by the LGPD.

Cookies

This site does not use advertising cookies or tracking or statistics tools (such as Google Analytics or social network pixels). It only uses strictly necessary cookies, for example to keep the shopping cart, keep administrators logged in and protect the forms. These cookies do not require consent, and you can delete or block them in your browser settings, knowing that some functions may stop working.

If in the future we start using cookies that are not essential, this policy will be updated and the site will ask for your authorization first, with the option to decline.

How long we keep it

  • Messages and quote requests that did not become work: up to 2 years after the last contact, to continue the conversation. After that they are deleted.
  • Data from contracted work and purchases: for the period required by tax and consumer protection law (generally 5 years).
  • Technical access logs: for as long as needed for the site's security.

You may request deletion before these periods, except when the law requires the data to be kept.

Your rights

Under the LGPD (art. 18), you may, at any time:

  • confirm whether we process your data and access it;
  • correct incomplete, inaccurate or outdated data;
  • request anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
  • request the portability of your data;
  • find out with whom your data has been shared;
  • revoke a consent you have given and learn what happens if you do not give it.

To do so, send the request through the page Contact, with “Privacy” at the start of the message and the email used in the original contact. The reply comes within 15 days. If you think your request was not met, you can also contact the National Data Protection Authority (ANPD), at gov.br/anpd.

Security

The site uses an encrypted connection (HTTPS), spam protection on the forms, two-step verification for administrative access and backups in a restricted area. No system is entirely immune to failures; if a security incident occurs that could pose a risk to you, you and the ANPD will be notified, as the law requires.

Changes to this policy

This policy may be updated when the site changes, for example when the own shop opens or new tools start being used. The date at the top of the page always shows the version in force.