Effective: October 7, 2026

Privacy Policy

This policy explains how Father & Son Works handles personal information when you visit fatherandsonworks.com, purchase a digital workbook or contact us.

1. Who is responsible

Father & Son Works is operated by Henrique Lara de Morais Matos, an individual seller based in Brazil and the controller responsible for the personal information described in this policy.

CPF (Brazilian taxpayer registration): 103.712.286-03.

Contact address: Avenida Paulo Camilo Pena, 585, Belvedere, Belo Horizonte, MG, 30320-380, Brazil.

For privacy questions or requests, contact hello@fatherandsonworks.com.

2. Information used in providing the service

• Checkout and payment information: Stripe collects the information needed to process your purchase, which may include your name, email, billing details and payment information. Our payment integration receives order identifiers, payment status and purchase details. Our website application does not store your full card number or security code.
• Order delivery: our delivery system stores the purchase email address, order and payment-event identifiers, the delivery message request, delivery status, timestamps and retry information. Payment diagnostics include transaction identifiers, amounts, currency and limited error codes.
• Visit and campaign information: our hosting provider processes technical information needed to serve and secure the site, which may include IP address, browser/request information and logs. We use an approximate country supplied by the hosting service to select the checkout currency. Campaign labels in links, such as the referring channel and campaign name, may be associated with the order.
• Support: when you contact us by email or our support form, we receive the information you provide and use it to address your request. Please do not send full card details, passwords or unnecessary information about children.

3. Purposes and legal grounds

We use information to arrange and fulfil purchases, deliver access, resolve support requests, process refunds, prevent duplicate fulfilment, protect the service, understand campaign attribution and meet applicable legal obligations. Where the LGPD applies, we rely on steps necessary to enter into or perform a contract for purchases and delivery, legal obligations for required records, and legitimate interests for proportionate security, troubleshooting and limited campaign attribution, subject to the rights and interests of individuals. If an optional use requires consent, we will obtain it before that use begins.

4. Service providers and international processing

We use Stripe for checkout and payment processing, Resend for transactional email, and Netlify for hosting, application storage and support-form submissions. These providers process information needed to deliver their services. Information may be processed in Brazil, the United States or other countries where providers operate, whose privacy laws may differ from those in your country. Providers may also process information under their own policies for legal compliance, payment security and fraud prevention. Contact us for information about the providers and international processing relevant to your purchase.

Stripe privacy information · Resend privacy information · Netlify privacy information

5. Cookies, advertising and email

Our sales and order confirmation pages use Meta Pixel (ID 1610447330876412) to record page visits, checkout starts and confirmed purchases, and measure advertising performance. A purchase event includes the actual amount and currency, product identifier and an opaque event identifier used to avoid duplicate reporting. Meta may receive your IP address, browser/device information, page URL and advertising cookie identifiers. We do not configure automatic advanced matching or send purchase emails, raw Stripe order/session identifiers, card details or checkout email addresses through this Pixel. We retain opaque purchase event identifiers in your browser to prevent repeat reporting; clearing browser storage may allow a repeat event. The order credential is kept in tab storage and removed from the page URL before loading the Pixel. For visits identified by our hosting provider as coming from the United States, advertising measurement is enabled by default unless you have opted out or your browser sends a Global Privacy Control signal. The hosting provider uses the request IP address to determine the country; our privacy-context endpoint returns only whether default measurement is enabled, and does not store your location. For other countries, or when location cannot be determined, the Pixel requires your permission. You can disable advertising measurement or change your choice through “Privacy choices — Do not sell or share my personal information” in the footer. We respect Global Privacy Control signals and previously recorded refusals. Permission is remembered for up to 180 days; a refusal remains until you change it or clear browser storage. Campaign labels are also carried from the current page to checkout. Stripe’s hosted checkout is a separate service and may use cookies or similar technologies described in its policies. Meta privacy information.

The current purchase flow sends transactional access messages; it does not enrol buyers in an active newsletter through this website. Advertising measurement is optional; disabling it does not prevent purchases. Where prior consent is required, tracking stays off until you grant permission. Withdrawing permission stops future tracking on this site but does not erase information previously received by Meta.

6. Retention

We retain purchase and delivery records to fulfil orders, provide access support, prevent duplicate delivery, handle refunds or disputes and meet applicable accounting and legal requirements. Support correspondence is retained as needed to resolve requests and related claims. Security and payment diagnostics are retained for troubleshooting, fraud prevention and the establishment or defence of legal claims.

The appropriate retention period depends on the purpose of the record, whether the order or a dispute remains open, applicable statutory retention periods and any legal hold. Records are not automatically erased when the 30-day guarantee expires. You may contact us to request deletion; information that must be retained for legal obligations or ongoing claims may be excluded from deletion. Payment and service providers may have separate retention obligations.

7. Your choices and rights

Depending on the laws that apply to you, you may have rights to information about processing, access, correction, deletion, portability, objection, restriction or withdrawal of consent, and to complain to a competent authority. Some records may need to be retained to meet legal duties or protect legal rights.

Send requests to our contact email or support form. We may ask for proportionate information to verify the request and protect your information, and will respond within applicable legal time limits. Contacting us does not waive any right to contact a regulator.

8. Children and security

Our sales and support services are intended for adult purchasers. We do not ask children to create accounts or submit personal information through the purchase flow. If you believe a child has sent us personal information, contact us so we can assess and address the situation. Please do not send photos, videos or identifying details of children to request a purchase refund.

We use HTTPS and access controls in our application. No online service can guarantee absolute security. Please keep purchase and download links private.

9. Changes

We will publish material changes with an updated effective date and provide additional notice or choices when required by applicable law.