Lyra Home
Privacy notice
Version 1.2 · effective as of 10/25/2026.
This is a translation provided for convenience. In case of any discrepancy, the Portuguese version prevails. Versão em português.
This Privacy Notice explains, in clear and objective terms, how Lyra Home Comércio Ltda. collects, uses, shares, stores and deletes the personal data of those who interact with it, in compliance with Brazilian Law No. 13,709/2018 (General Personal Data Protection Law, LGPD), the Consumer Protection Code and the Brazilian Internet Civil Framework (Law No. 12,965/2014), as well as the regulations of the National Data Protection Authority (ANPD).
1. Who the controller is
The controller of the personal data processed under this Notice is Lyra Home Comércio Ltda., registered under CNPJ No. 52.192.749/0001-81, with headquarters and showroom at Alameda dos Maracatins, 843, Moema, São Paulo/SP, Brazil, postal code 04089-012 ("Lyra Home").
This Notice applies exclusively to Lyra Home. Companies of the same group with their own operations are each responsible for the data they process.
2. Who and which channels this Notice covers
It applies to website visitors, people requesting a quote or assistance, clients, architects, designers and other partner professionals, and showroom visitors, across all Lyra Home channels:
- the lyrahome.com.br website and its forms;
- Lyra Home's WhatsApp, Instagram and Facebook;
- email, telephone and voice or video calls made by our consultants;
- quote and contract links sent to clients;
- in-person service at the showroom, as well as deliveries, assembly and after-sales service.
Data of job applicants is described in section 7. Employee data is governed by a separate notice, provided upon hiring.
3. What personal data is processed
| Category | Examples | Source |
|---|---|---|
| Identification and contact | first and last name, telephone or WhatsApp, email, neighborhood and city, social media profile | provided by the data subject |
| Customer service | messages, voice notes, photos and files sent in conversations; products of interest; project dimensions and preferences; how you heard about Lyra Home | provided by the data subject or generated during service |
| Purchase and delivery | CPF or CNPJ, delivery address, order, payment and invoice details, scheduling of delivery, assembly and after-sales service | provided by the data subject or generated at purchase |
| Electronic signature | name, CPF, email or mobile number used for the confirmation code, date and time, IP address and device identification | generated at the time of signature |
| Partner professionals | name, firm, professional license (CAU, CREA or ABD), contact details and referred projects | provided by the professional |
| Website browsing | IP address, date and time of access, browser and device type and, only with the visitor's consent, identifiers from audience measurement and advertising cookies | collected automatically |
| Public profile data | WhatsApp or Instagram profile name and photo | made available by the platform itself when the data subject writes to us |
4. Why the data is used and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Responding to requests for quotes, information or visits, and guiding the service through to purchase | preliminary procedures related to a contract, at the data subject's request (art. 7, V) |
| Entering into and performing the purchase contract: made-to-order production, invoicing, delivery, assembly, warranty and technical assistance | performance of a contract (art. 7, V) |
| Issuing tax documents and complying with legal and regulatory obligations | compliance with a legal obligation (art. 7, II) |
| Recording the electronic signature and keeping proof of the contract; defending rights in judicial, administrative or arbitration proceedings | regular exercise of rights (art. 7, VI) |
| Following up on an open quote, measuring satisfaction with our service and improving products and services | legitimate interest (art. 7, IX), limited to strictly necessary data and with the right to object |
| Recognizing the same person across different channels (for example, Instagram and WhatsApp), so they are served by a single consultant and do not receive repeated messages | legitimate interest (art. 7, IX) |
| Preventing fraud and scams and ensuring the security of our systems and of data subjects | legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI) |
| Sending news, launches and invitations unrelated to an ongoing service | consent (art. 7, I), which may be withdrawn at any time |
| Measuring website visits and ad performance (Google Analytics and Meta Pixel), only with the visitor's consent | consent (art. 7, I), which may be withdrawn at any time in the cookie preferences |
| Registering architects, designers and other partner professionals and managing the partnership | preliminary procedures and performance of a contract (art. 7, V) |
Providing identification and contact details is a condition for handling a request; without them, we cannot reply or prepare a quote. All other data is optional, and not providing it does not prevent us from assisting you.
5. Customer service supported by artificial intelligence
Lyra Home uses artificial intelligence tools to support customer service, including its virtual sales agent, to suggest replies, organize conversations, transcribe voice notes and identify unwanted messages. Replies sent to clients are overseen by the Lyra Home team, and the data subject may at any time ask to be served exclusively by a person.
Prices, lead times and configurations mentioned during service are estimates and are binding on Lyra Home only when stated in the formal quote or contract. No decision affecting the data subject's interests is made solely by automated means; should this occur, the data subject will be entitled to request a review by a person and to obtain clear information about the criteria used (art. 20 of the LGPD).
The artificial intelligence providers engaged act as processors, handling conversation content solely to provide the service to Lyra Home.
6. Sensitive data and data of children and adolescents
Lyra Home does not request sensitive personal data, such as data concerning health, racial or ethnic origin, religious beliefs or political opinions, nor biometric data. We recommend that data subjects do not send such data in conversations; if sent spontaneously, it will not be used for any purpose and will be deleted as soon as identified, unless retention is legally required.
Lyra Home's channels are not intended for anyone under 18, and purchases are made by persons of legal age and capacity. If data of a child or adolescent is found to be processed without the specific consent of a parent or guardian, where required, it will be deleted.
7. Job applicants
Anyone applying for a position or joining the Lyra Home talent pool, through the Careers page or a job link, provides their name, email, telephone, city, professional profile, résumé and answers to the position's questions. This data is used solely in the selection process: profile review, interview scheduling and, upon approval, hiring, based on preliminary procedures related to a contract at the data subject's request (art. 7, V, of the LGPD).
The résumé may be summarized by an artificial intelligence tool, solely to support screening; the decision always rests with the Human Resources team. Any photo included in the résumé or in the applicant's public WhatsApp profile may be displayed in the internal selection record. At the final stage, with specific notice to the applicant, information is checked against official public databases, with access restricted to the board.
Applicant data is kept for 12 months from registration, so the applicant can be considered for new openings, and is then deleted or anonymized, unless the applicant is hired. Early deletion may be requested at any time by email to [email protected].
8. Who the data is shared with
Lyra Home does not sell, rent or trade personal data. Sharing is limited to what each purpose requires:
- the manufacturers and suppliers of the products, which receive the order specifications for made-to-order production and, only exceptionally, client data when essential for production or technical assistance;
- carriers, delivery and assembly teams, and upholstery protection and after-sales service providers, which receive name, telephone and address to carry out delivery and services;
- the architect or designer appointed by the client, regarding the project they oversee;
- payment institutions and banks, to process payments;
- accounting and legal advisors, to comply with legal obligations and defend rights;
- technology providers acting as processors: website and management system hosting, database, file storage, email delivery, messaging platforms (WhatsApp, Instagram and Facebook) and artificial intelligence tools;
- public authorities and the courts, where required by law or by order of a competent authority.
Processors are contractually bound to process data only according to Lyra Home's instructions and to protect it with appropriate security measures.
9. International data transfers
The database of Lyra Home's management system is hosted in Brazil, in the São Paulo region. Some technology providers, however, process data outside the country, particularly in the United States and the European Union: website hosting and file storage (Cloudflare), email delivery (Resend), messaging platforms (Meta: WhatsApp, Instagram and Facebook), artificial intelligence tools (Anthropic and Cloudflare), the providers of fonts and 3D viewing components (Google Fonts and jsDelivr) and, only with the visitor's consent, the website's measurement and advertising tools (Google Analytics and Meta Pixel).
These transfers take place when necessary to perform the contract or the preliminary procedures requested by the data subject, to comply with a legal obligation or to exercise rights (art. 33, IX, of the LGPD), with the safeguards set out in ANPD Resolution No. 19/2024 adopted whenever applicable. Further information about each transfer may be requested through the channel indicated in section 16.
10. How long the data is kept
Data is kept only for as long as necessary for the stated purposes and is then deleted or anonymized, except in the retention cases provided for in art. 16 of the LGPD.
| Data | Retention period | Basis |
|---|---|---|
| Service without purchase (unclosed quotes and conversations) | up to 2 years after the last contact | legitimate interest, to resume service and avoid repeated contact |
| Contract, order, delivery, warranty and after-sales service | 5 years after delivery of the last product or the end of the warranty, whichever is later | Consumer Protection Code, arts. 26 and 27 |
| Tax and accounting documents | 5 years, counted as provided in tax legislation | National Tax Code, arts. 173, 174 and 195, sole paragraph; Civil Code, art. 1,194 |
| Signed contract and electronic signature records | 10 years after the end of the contract | Civil Code, art. 205 |
| Website access logs | 6 months | Brazilian Internet Civil Framework, art. 15 |
| Partner professional records | for the duration of the partnership and 5 years after it ends | regular exercise of rights |
| Job applicants and talent pool | 12 months after registration, unless hired | preliminary procedures for an employment contract, at the applicant's request |
| Security incident records | at least 5 years | ANPD Resolution No. 15/2024, art. 10 |
| Data of those who withdrew consent to communications | only what is needed to avoid sending them again | legitimate interest |
11. How the data is protected
Lyra Home adopts technical and administrative measures appropriate to the nature of the data, including:
- encrypted connection (HTTPS) on the website and the management system;
- system access only for authorized users, with two-step verification;
- role-based access control: each team member sees only the data needed for their role, and data such as CPF, telephone and address is restricted to authorized profiles;
- audit logs of relevant changes (who, when and what);
- backups and technology providers with recognized security standards;
- system access for team members only after signing a contract with a confidentiality obligation.
No system is completely invulnerable; for this reason, Lyra Home maintains procedures to prevent, detect and respond to incidents.
12. Security incidents
In the event of a security incident that may result in relevant risk or harm to data subjects, Lyra Home will notify the ANPD and the affected data subjects within 3 business days of becoming aware that the incident affected personal data, directly and individually (email, WhatsApp, telephone or letter) and in plain language, under art. 48 of the LGPD and ANPD Resolution No. 15/2024. All incidents are recorded and the record is kept for at least 5 years.
13. Data subject rights
Under art. 18 of the LGPD, data subjects may, at any time and free of charge:
- confirm whether their data is processed and access it;
- correct incomplete, inaccurate or outdated data;
- request the anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
- request the portability of their data to another provider;
- request the deletion of data processed on the basis of consent, except in the retention cases of art. 16;
- know which public and private entities their data has been shared with;
- be informed about the possibility of not giving consent and the consequences of refusal;
- withdraw consent;
- object to processing carried out on another legal basis, in case of non-compliance with the LGPD;
- request a review of decisions made solely on the basis of automated processing.
Confirmation and access will be provided immediately, in simplified form, or within 15 days, through a clear and complete statement (art. 19 of the LGPD). Other requests will be answered as soon as possible; if they cannot be fulfilled immediately, Lyra Home will explain the factual or legal reasons. To protect the data subject, confirmation of identity may be requested before the request is fulfilled. Corrections and deletions will be communicated to the parties with whom the data was shared, unless this proves impossible or involves disproportionate effort.
Data subjects may also file a petition with the ANPD (gov.br/anpd) and with consumer protection bodies.
14. Cookies and website technologies
The website uses a technical record in the browser itself (session storage), which avoids repeating the opening animation during the same visit and is erased when the browser is closed, and stores in the browser the choice made in the cookie notice. These records are necessary for the website to function and do not identify the visitor.
Audience measurement and advertising cookies are activated only after the visitor accepts them in the notice shown on the first visit, where they can accept, decline or choose by category. Nothing is activated before this choice, and declining does not prevent use of the website.
| Category | Tool and purpose | Duration |
|---|---|---|
| Strictly necessary | record of the cookie choice and of the site opening, in the browser itself | until the choice is changed or the browser data is cleared |
| Audience measurement | Google Analytics (Google): counting visits and pages viewed, in aggregate | "_ga" cookies, for up to 2 years |
| Advertising | Meta Pixel (Meta Platforms): measuring how many visits and requests come from Lyra Home ads on Instagram and Facebook, and showing ads to people who have visited the website | "_fbp" cookie, for up to 90 days |
Google and Meta receive this data as providers, under their respective policies, with processing in the United States and other countries (section 9). The choice may be changed or withdrawn at any time through the "Cookie preferences" link in the footer of every page, and cookies may also be deleted in the browser settings.
To display fonts and the 3D viewer of our pieces, the browser retrieves files from external providers (Google Fonts, jsDelivr and Google), which receive the IP address and technical browser data, under their respective policies.
15. Protection against scams
Lyra Home never asks for passwords or verification codes received by SMS, WhatsApp or email, and never requests payment into an individual's account. Payments are made exclusively to Lyra Home Comércio Ltda., CNPJ 52.192.749/0001-81. If in doubt about the authenticity of a message, please confirm it through the official channels listed in this Notice.
16. Data protection officer and contact channel
Requests, questions and complaints about personal data, as well as communications from the ANPD, are received by Lyra Home's data protection officer:
- Data protection officer: Francisco Sala;
- email: [email protected];
- mail: Alameda dos Maracatins, 843, Moema, São Paulo/SP, Brazil, postal code 04089-012, attention of the Data Protection Officer.
17. Changes to this Notice, governing law and jurisdiction
This Notice may be updated due to legal or regulatory changes or changes in Lyra Home's activities. The current version will always be available on this page, with its date and version number; relevant changes will be communicated through the data subject's contact channels and, where required, new consent will be requested. The Notice is reviewed at least once a year.
Brazilian law applies. Consumers are guaranteed the jurisdiction of their place of residence.