Privacy Policy

Joá Rio (joario.com) is a single-property site for ADV101, a cliffside villa in Joá, Rio de Janeiro, represented by Art de Vivre (CRECI RJ 009278/O). This Privacy Policy explains how we handle personal information when you visit this site.

1. What Data We Collect

Data You Provide

When you contact us via WhatsApp or email at [email protected], we receive only what you choose to share — typically your name, viewing request details, and contact information. This is used solely to respond to your enquiry and arrange private viewings.

Analytics Cookies (with consent)

With your consent, this site uses Google Analytics (GA4, property G-6B5TKJPNV6) to collect anonymised data about page visits and traffic sources. If you decline cookies, Google Analytics is not loaded.

Data Collected Automatically

Our hosting provider (Cloudflare) processes your IP address and request metadata to serve the site and prevent abuse.

2. How We Use Your Data

• To respond to viewing requests and enquiries about the property.
• To understand site traffic via Google Analytics (consent required).
• To maintain website performance and security.

We do not sell, rent, or share your personal information.

3. Cookies & Consent

Analytics cookies are loaded only with your explicit consent via the banner on your first visit. You can withdraw consent at any time by clearing your browser's local storage. Essential Cloudflare cookies are set regardless of consent. See Google's Privacy Policy and Cloudflare's Privacy Policy.

4. Your Rights Under LGPD (Brazil)

Under Brazil's Lei Geral de Proteção de Dados (LGPD), you have the right to confirm, access, correct, or delete your data, and to file a complaint with the ANPD. Contact us at [email protected].

5. Your Rights Under GDPR (European Visitors)

If you are in the EEA, you have the right to access, rectify, erase, or port your personal data, and to object to its processing. You may also lodge a complaint with your national data protection authority.

6. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion of your personal information, and to opt out of any sale of personal information. We do not sell personal information. Email [email protected] to exercise these rights. We will respond within 45 days.

7. Children's Privacy (COPPA)

This site is not directed at children under 13. We do not knowingly collect personal information from minors.

8. Data Retention

Correspondence is retained for up to 2 years. Analytics data per Google Analytics defaults (26 months).

9. Contact

Questions? Email [email protected] or WhatsApp +55 21 97090-9740.

California Privacy Rights — CCPA & CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights with respect to your personal information. We take these rights seriously and have built our site specifically to support them.

Do Not Sell or Share My Personal Information

We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising without your consent. As a California resident you have the explicit right to opt out of the sale or sharing of your personal information at any time.

How to exercise this right: When you first visit this site, a cookie-consent banner appears at the bottom of your screen. Clicking "Decline" immediately prevents Google Analytics and all other optional tracking scripts from loading or sending any data about your visit. This is our designated opt-out mechanism. If you have previously accepted cookies and wish to change your choice, please clear your browser's local storage for this site (or contact us at [email protected] and we will reset your preference). You may also install a browser-level opt-out extension such as the Google Analytics Opt-out Browser Add-on.

Right to Know

You have the right to request disclosure of: (a) the categories and specific pieces of personal information we have collected about you; (b) the categories of sources from which personal information was collected; (c) our business or commercial purpose for collecting, selling, or disclosing personal information; and (d) the categories of third parties to whom we disclose personal information.

We collect the following categories of personal information: identifiers (name, email, IP address), internet or electronic network activity information (pages visited, time on site, device type, browser), and geolocation data (approximate location derived from IP address). We collect this information directly from you via forms and automatically via analytics tools when you consent.

Right to Delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (such as information needed to complete a transaction you requested, detect security incidents, or comply with a legal obligation). We will honor verified deletion requests within 45 days.

Right to Correct

You have the right to request correction of inaccurate personal information we hold about you.

Right to Limit Use of Sensitive Personal Information

We do not collect sensitive personal information (as defined by the CPRA) through this website.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your California privacy rights. You will receive the same quality of service regardless of whether you accept or decline cookies.

Shine the Light (California Civil Code § 1798.83)

California residents may request information about our disclosure of personal information to third parties for their direct-marketing purposes. We do not disclose personal information for third-party direct marketing and therefore have no information to provide in response to such requests.

Authorized Agent

You may designate an authorized agent to submit CCPA/CPRA requests on your behalf. We may require written proof of authorization and may verify your identity before processing the request.

To submit any CCPA/CPRA request: email [email protected] with the subject line "California Privacy Request." We will respond within 45 days (with one 45-day extension if necessary, with notice).

California Invasion of Privacy Act (CIPA) — Analytics Consent Disclosure

California Penal Code § 631 (the California Invasion of Privacy Act) prohibits the unauthorized interception of electronic communications. We take this law seriously and have implemented technical controls to comply with it for all visitors, including California residents.

What we do: This site uses Google Analytics 4 (GA4). GA4 is configured with Google Consent Mode v2, which means the analytics script is loaded in "denied" mode by default. In denied mode, GA4 does not set tracking cookies, does not capture user identifiers, and does not send identifying behavioral data to Google's servers. No third-party script on this site reads, intercepts, or transmits the content of your communications, keystrokes, or form entries to any unauthorized third party without your consent.

Before you consent: If you have not yet interacted with the cookie banner, or if you click "Decline," our analytics remain in denied/limited mode. Your visit generates only anonymous, aggregate signals that cannot be used to identify you.

After you accept: If you click "Accept" on the cookie banner, GA4 switches to full analytics mode. You can withdraw this consent at any time by contacting us or clearing your browser's local storage for this site.

Session replay and chat intercept tools: We do not use session-replay software (such as Hotjar, FullStory, or Microsoft Clarity), keystroke-logging tools, live-chat widgets that forward conversations to third parties, or any other technology designed to intercept or record your communications in real time without your express, informed consent. If this ever changes, this policy will be updated and the consent banner will be modified to seek your specific consent before any such tool activates.

This disclosure is provided pursuant to California Penal Code § 631 and the evolving CIPA case law as applied to web-based analytics. If you have questions or concerns about our analytics practices, please contact us at [email protected].

General Data Protection Regulation (GDPR) — EU & EEA Visitors

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation and/or UK GDPR applies to our processing of your personal data. Our legal bases for processing are:

• Consent — for analytics cookies and optional marketing communications (you may withdraw at any time).
• Legitimate interests — for security monitoring, fraud prevention, and basic server logging necessary to operate the site, provided these interests are not overridden by your rights.
• Contract — where processing is necessary to respond to your inquiry or fulfill a service you have requested.

Under the GDPR you have the right to: access your data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability, object to processing based on legitimate interests, and not be subject to solely automated decision-making with legal or similarly significant effects (we do not conduct automated decision-making). You also have the right to lodge a complaint with your national data protection supervisory authority (for EU residents: your national DPA; for UK residents: the ICO at ico.org.uk).

We do not transfer your personal data to countries outside the EEA, UK, or Switzerland except where appropriate safeguards are in place (including the EU-U.S. Data Privacy Framework for data transfers to Google, which is a certified participant). To exercise your GDPR rights, contact us at [email protected].

Lei Geral de Protecao de Dados (LGPD) — Visitantes do Brasil

Se voce esta localizado no Brasil, a Lei Geral de Protecao de Dados (LGPD, Lei n. 13.709/2018) confere a voce direitos sobre seus dados pessoais, incluindo: confirmacao do tratamento, acesso, correcao, anonimizacao ou bloqueio, portabilidade, eliminacao, informacao sobre compartilhamento, revogacao do consentimento e peticao a ANPD (Autoridade Nacional de Protecao de Dados).

Nossa base legal para o tratamento de dados pessoais e o consentimento (para cookies de analitica) e o legitimo interesse (para operacao e seguranca do site). Para exercer seus direitos ou revogar o consentimento, entre em contato pelo e-mail [email protected]. Responderemos no prazo de 15 dias uteis conforme exige a LGPD.

ADA Accessibility Statement

JoaRio is committed to ensuring that its website is accessible to people with disabilities in accordance with the Americans with Disabilities Act (ADA), Section 508 of the Rehabilitation Act, and the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, to the greatest extent feasible. We are continuously working to improve the accessibility of our site and to ensure we provide an equal experience for all users.

Our accessibility efforts include: providing text alternatives for non-text content, ensuring sufficient color contrast, making all functionality available from a keyboard, providing captions and audio descriptions for multimedia content where applicable, and designing pages to avoid content that could cause seizures.

Known limitations: While we strive to meet WCAG 2.1 AA, some older or third-party content on this site may not yet fully conform. We are actively working to bring all content into compliance.

Request an accessible format: If you encounter any accessibility barriers, need information in an alternative format, or wish to provide feedback about our accessibility practices, please contact us at [email protected]. We will make reasonable efforts to provide the information you need in an accessible format within five (5) business days.

Third-party tools: Portions of this site may use third-party tools or plug-ins that are not within our direct control. We encourage vendors to follow WCAG 2.1 AA standards and will replace tools that are persistently inaccessible.

Cookie Policy — Detailed Breakdown

A cookie is a small text file stored in your browser when you visit a website. This site uses local storage (a similar technology) to remember your cookie consent choice. Here is a complete breakdown of what we use:

How to manage cookies: You can delete or block cookies at any time through your browser settings (Chrome: Settings → Privacy → Cookies; Safari: Preferences → Privacy; Firefox: Options → Privacy & Security). Note that blocking all cookies may affect site functionality. The cavConsent item lives in local storage, not cookies — to clear it, use Developer Tools → Application → Local Storage and delete the cavConsent key for this site's domain.

Third-Party Services — Full Disclosure

The following third-party services may receive or process personal data when you use this site:

• Google Analytics 4 (Google LLC, USA) — website analytics. Data sent only after consent. Governed by Google's Privacy Policy. Google is certified under the EU-U.S. Data Privacy Framework. You may opt out globally via the GA Opt-out Add-on.
• Cloudflare, Inc. (USA) — content delivery network, DDoS protection, WAF, and SSL/TLS. Processes IP addresses and HTTP request metadata for every visitor. Governed by Cloudflare's Privacy Policy. Data is processed under Cloudflare's DPA (GDPR-compliant Standard Contractual Clauses).
• Cavmir CRM capture script (run for Art de Vivre by its web provider, Cavmir — Trousdale Digital Technologies LLC) — a small script that captures form submissions site-wide and routes them to our internal CRM for follow-up. This script is consent-gated and only loads after you accept cookies. No form data is transmitted without prior activation. Data is stored on Cloudflare D1 (a US-based database) and is used solely to respond to your inquiry.
• Google Fonts (where applicable) — typeface delivery. Your browser may contact Google's servers to download fonts, sending your IP address. Governed by Google's Privacy Policy above. We serve fonts locally on some sites to avoid this.

Data Retention Schedule

• Contact form submissions & inquiries: Retained for 3 years from the date of submission, then permanently deleted from our CRM.
• Google Analytics data: Retained for 14 months (our GA4 setting), after which it is automatically deleted by Google.
• Server logs (Cloudflare): Retained per Cloudflare's standard data-retention policies (generally up to 30 days for free/Pro plans).
• Cookie consent record (cavConsent): Stored in your browser's local storage until you clear it or it is replaced.
• Email correspondence: Retained for 5 years for business-record purposes, then permanently deleted.

Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include: HTTPS/TLS encryption for all data in transit, Cloudflare DDoS mitigation and WAF for all traffic, access controls limiting who can view CRM data, and regular review of our security practices. However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security, and we are not liable for unauthorized access resulting from circumstances beyond our reasonable control.

Your Rights — How to Submit a Request

To exercise any of the rights described in this policy — including the right to access, delete, correct, restrict, or port your data; to opt out of analytics; or to file a complaint — please contact us at:

• Email: [email protected]
• Subject line: "Privacy Rights Request — [your jurisdiction]" (e.g., "Privacy Rights Request — California")

We will verify your identity before processing your request and will respond within the legally required timeframe for your jurisdiction (45 days for CCPA, 30 days for GDPR, 15 business days for LGPD). If we need more time, we will notify you. All requests are free of charge unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, with explanation.

Children's Privacy (COPPA & International Equivalents)

This website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have inadvertently collected data from a child under 13, please contact us immediately at [email protected] and we will delete the information promptly. This site is also not designed for or directed at persons under 18 years of age. In jurisdictions with higher age thresholds for data processing (e.g., age 16 under GDPR Article 8 in some EU member states), we do not knowingly process the data of minors below that threshold without verifiable parental consent.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will update the effective date at the top of this page and, where required by law, notify you by email or by a prominent notice on our website prior to the change becoming effective. We encourage you to review this policy periodically. Your continued use of this website after the effective date of any changes constitutes acceptance of the updated policy. Prior versions of this policy are available upon request.

Contact & Data Controller Information

The data controller for personal information collected through this website is:

Art de Vivre (licensed Rio de Janeiro brokerage, CRECI RJ 009278/O)
Email: [email protected]

This website is built and hosted for Art de Vivre by Cavmir, a Trousdale Digital company (Trousdale Digital Technologies LLC), which handles form submissions only on Art de Vivre's behalf.

For data protection matters involving EU/EEA residents, our representative within the EU (where required under GDPR Article 27) can be reached at the same email address. For data protection matters involving UK residents, our UK representative can similarly be reached at the above email address.