Last updated 4 September 2026 · In force from 4 September 2026
This policy explains what personal data we collect when you use this site or buy The Calyra Method, why we collect it, who else handles it, and what you can require us to do about it.
It is written to satisfy the Brazilian General Data Protection Law (LGPD, Law 13.709/2018), the EU General Data Protection Regulation and the UK GDPR, since the course is sold internationally.
The controller of your personal data is:
| Seller | Paulo Ricardo Alves Ribeiro, trading as Calyra |
|---|---|
| Legal status | Individual trader (pessoa física) registered in Brazil |
| Tax identification | CPF 493.139.658-52 |
| Registered address | Av. Luciano Grumi, 117, Jardim Roberto Selmi Dei, 14806-387 Araraquara - SP, Brazil |
| support@calyrastudio.com | |
| Telephone | +55 16 99711-1331 (Mon to Fri, 9:00 to 18:00 UTC−3) |
| Website | https://www.calyrastudio.com |
| Statement descriptor | CALYRASTUDIO |
Data protection requests go to privacy@calyrastudio.com. We have not appointed a formal Data Protection Officer, because the scale of this business does not require one under LGPD article 41 or GDPR article 37. Paulo Ricardo Alves Ribeiro handles these requests personally.
| Data | Why we need it | Lawful basis | Retention |
|---|---|---|---|
| Name and email address | To create your access link, send your receipt, deliver the course and answer support requests | Performance of a contract (GDPR 6(1)(b), LGPD 7° V) | 5 years after the last transaction, then deleted |
| Payment record: amount, currency, date, country, card brand, last four digits, Stripe reference | To take payment, issue refunds, defend chargebacks and keep the records tax law requires | Contract and legal obligation (GDPR 6(1)(b) and (c), LGPD 7° II and V) | 5 years, the Brazilian tax record period |
| Access token and the fact you opened the library | To let you back in without a password, and to detect a link being shared publicly | Contract and legitimate interest in preventing misuse (GDPR 6(1)(f), LGPD 7° IX) | For the life of the access link |
| Intake form answers, Mentorship level only. May include information about injuries or health. | To write the personal practice plan you paid for | Your explicit consent, given when you submit the form (GDPR 9(2)(a), LGPD 11 I) | 24 months, then deleted. Withdraw consent at any time and we delete it sooner. |
| Video submitted for form review, Mentorship level only | To give you written feedback on your movement | Your explicit consent, given by submitting it | Deleted within 30 days of the feedback being sent |
| Support emails and their contents | To resolve your request and keep a record of what was agreed | Contract and legitimate interest (GDPR 6(1)(f), LGPD 7° IX) | 24 months |
| Server access logs, including IP address, timestamp and page requested | Security, abuse prevention and troubleshooting. Also required of application providers by article 15 of the Brazilian Internet Civil Framework (Law 12.965/2014). | Legal obligation and legitimate interest | 6 months |
| Measurement and advertising data, only if you consent | To see which pages work and whether an ad led to a sale | Your consent, given through the cookie banner (GDPR 6(1)(a), LGPD 7° I) | Per the provider, and never longer than 14 months |
If you buy the Mentorship level, your intake form may contain information about injuries, pregnancy or medical conditions. That is a special category of data under GDPR article 9 and sensitive data under LGPD article 5 II. We only process it with your explicit consent, we use it for nothing except writing your plan, we never share it, and we delete it after 24 months or sooner on request. You are free to leave any field blank. We are not medical professionals and we do not create a medical record.
| Provider | What it does | Where |
|---|---|---|
| Stripe Payments Europe, Ltd. and affiliates | Takes payment, issues refunds, prevents fraud. Stripe is also an independent controller for its own fraud prevention and legal obligations. | Ireland, United States |
| Vercel Inc. | Hosts this website and its serverless functions, keeps short-lived access logs | United States, with edge delivery worldwide |
| Resend (Plus Five Five, Inc.) | Delivers the access email and the receipt | United States |
| Video hosting provider | Streams the course lessons | United States and European Union |
| Video conferencing provider | Hosts the Mentorship group calls, for students at that level only | United States |
Each of these is bound by a data processing agreement and may only act on our instructions.
We are based in Brazil and several of our providers are in the United States and the European Union, so your data crosses borders. Transfers out of the European Economic Area and the United Kingdom rely on the European Commission's standard contractual clauses, the UK international data transfer addendum, or the EU-US Data Privacy Framework where the provider is certified. Transfers out of Brazil rely on the standard contractual clauses approved by the ANPD under LGPD article 33. Copies are available on request from privacy@calyrastudio.com.
After you buy, we send transactional email: your receipt, your access link, and notices about the course you bought. You cannot unsubscribe from these, because they are how the product is delivered.
We may also email you occasionally about new material for the course you own. Every such message carries an unsubscribe link, unsubscribing takes effect immediately, and it never affects your access. We do not add you to a general marketing list without asking, and we do not pass your address to anyone else.
Wherever you live, you may ask us to:
Write to privacy@calyrastudio.com from the address you bought with. We answer within 15 days, as LGPD article 19 requires, and always within the 30 days that GDPR allows. There is no charge unless a request is repetitive or excessive.
Deleting your data means we can no longer verify your purchase or reissue your access link, and your access ends. We will say so clearly before acting. Records that tax law obliges us to keep cannot be deleted on request, and we will tell you which those are.
If you think we have handled your data badly, tell us first at privacy@calyrastudio.com. You also have the right to complain to a supervisory authority:
The site is served over HTTPS with HSTS. Access links are signed with HMAC-SHA256 and cannot be guessed, altered or extended. Locked lessons never send their video source to the browser. Payment card data never reaches our servers. Access to the administrative side of Stripe, Vercel and the email provider is protected by two-factor authentication.
No system is perfect. If a breach occurs that is likely to result in a risk to your rights, we will notify the ANPD and the relevant supervisory authorities and tell affected buyers by email, within the deadlines the law sets.
This course is sold only to adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to privacy@calyrastudio.com and we will delete it.
If we change this policy in a way that materially affects you, we will email everyone who has bought and give at least 30 days' notice before the change takes effect. The date at the top always shows the current version.