Privacy Policy

This Privacy Policy explains how SAY THINGS (Stephanie Crane De Narváez, operating as a sole trader/freelancer in Portugal) collects, uses, and protects your personal data when you visit saythings.co (the "Site").

I take your privacy seriously and handle your data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Portuguese law.

1. Who is responsible for your data

Data Controller: Stephanie Crane De Narváez, trading as SAY THINGS
Location: Lisbon, Portugal
Contact: stephanie@saythings.co

For any question about this policy or your data, this email is the right place to reach me.

2. What data I collect

I collect only what's needed to run this Site and respond to you. This includes:

a) Contact form

When you submit the contact form, I collect:

• Your name
• Your email address
• Any message or project details you choose to share

This data is used only to respond to your inquiry. It is not added to any marketing list unless you separately sign up for the newsletter.

b) Newsletter signup

If you subscribe to the newsletter, I collect:

• Your email address

This is handled through Resend, a third-party email service provider. Their own privacy policy also applies to how they process this data on my behalf. You can unsubscribe at any time using the link included in every email.

3. Legal basis for processing

Under GDPR, I process your data based on:

• Consent — for the newsletter signup, which you can withdraw at any time by unsubscribing.
• Legitimate interest — for responding to contact form submissions.

4. How long I keep your data

• Contact form submissions: kept only as long as needed to respond to and resolve your inquiry, and for a reasonable period afterward for record-keeping, generally no longer than 12 months.
• Newsletter data: kept until you unsubscribe.

5. Who your data is shared with

I do not sell your personal data. It is shared only with the service providers necessary to run this Site:

• Resend — newsletter and transactional email delivery
• Vercel — website hosting

Each of these providers processes data under their own privacy policies and, where data leaves the EU/EEA, under appropriate safeguards such as Standard Contractual Clauses.

6. Your rights

Under GDPR, you have the right to:

• Access the personal data I hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Request a copy of your data in a portable format
• Withdraw consent at any time (for the newsletter — use the unsubscribe link in any email)

To exercise any of these rights, email stephanie@saythings.co. I'll respond within one month, as required by law.

You also have the right to lodge a complaint with Portugal's data protection authority, the CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt, if you believe your data has been mishandled.

7. Cookies

This Site uses essential cookies to enable basic functionality such as page transitions. We may also use analytics cookies in the future to understand how the Site is used. When you first visit the Site, a banner gives you the choice to accept all cookies or essential cookies only. You can change your preference at any time by clearing your browser cookies and reloading the page.

You can also control or disable cookies through your browser settings at any time.

8. Children's privacy

This Site is not directed at children, and I do not knowingly collect data from anyone under 16.

9. Changes to this policy

I may update this policy occasionally to reflect changes in how the Site operates or in applicable law. The "Last updated" date at the top will always reflect the most recent version. Material changes will be noted here directly.

10. Contact

Questions about this policy or your data can be sent to:
stephanie@saythings.co