Privacy Policy

California Privacy Rights — CCPA & CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights with respect to your personal information. We take these rights seriously and have built our site specifically to support them.

Do Not Sell or Share My Personal Information

We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising without your consent. As a California resident you have the explicit right to opt out of the sale or sharing of your personal information at any time.

How to exercise this right: When you first visit this site, a cookie-consent banner appears at the bottom of your screen. Clicking "Decline" immediately prevents Google Analytics and all other optional tracking scripts from loading or sending any data about your visit. This is our designated opt-out mechanism. If you have previously accepted cookies and wish to change your choice, please clear your browser's local storage for this site (or contact us at [email protected] and we will reset your preference). You may also install a browser-level opt-out extension such as the Google Analytics Opt-out Browser Add-on.

Right to Know

You have the right to request disclosure of: (a) the categories and specific pieces of personal information we have collected about you; (b) the categories of sources from which personal information was collected; (c) our business or commercial purpose for collecting, selling, or disclosing personal information; and (d) the categories of third parties to whom we disclose personal information.

We collect the following categories of personal information: identifiers (name, email, IP address), internet or electronic network activity information (pages visited, time on site, device type, browser), and geolocation data (approximate location derived from IP address). We collect this information directly from you via forms and automatically via analytics tools when you consent.

Right to Delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (such as information needed to complete a transaction you requested, detect security incidents, or comply with a legal obligation). We will honor verified deletion requests within 45 days.

Right to Correct

You have the right to request correction of inaccurate personal information we hold about you.

Right to Limit Use of Sensitive Personal Information

We do not collect sensitive personal information (as defined by the CPRA) through this website.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your California privacy rights. You will receive the same quality of service regardless of whether you accept or decline cookies.

Shine the Light (California Civil Code § 1798.83)

California residents may request information about our disclosure of personal information to third parties for their direct-marketing purposes. We do not disclose personal information for third-party direct marketing and therefore have no information to provide in response to such requests.

Authorized Agent

You may designate an authorized agent to submit CCPA/CPRA requests on your behalf. We may require written proof of authorization and may verify your identity before processing the request.

To submit any CCPA/CPRA request: email [email protected] with the subject line "California Privacy Request." We will respond within 45 days (with one 45-day extension if necessary, with notice).

California Invasion of Privacy Act (CIPA) — Analytics Consent Disclosure

California Penal Code § 631 (the California Invasion of Privacy Act) prohibits the unauthorized interception of electronic communications. We take this law seriously and have implemented technical controls to comply with it for all visitors, including California residents.

What we do: This site uses Google Analytics 4 (GA4). GA4 is configured with Google Consent Mode v2, which means the analytics script is loaded in "denied" mode by default. In denied mode, GA4 does not set tracking cookies, does not capture user identifiers, and does not send identifying behavioral data to Google's servers. No third-party script on this site reads, intercepts, or transmits the content of your communications, keystrokes, or form entries to any unauthorized third party without your consent.

Before you consent: If you have not yet interacted with the cookie banner, or if you click "Decline," our analytics remain in denied/limited mode. Your visit generates only anonymous, aggregate signals that cannot be used to identify you.

After you accept: If you click "Accept" on the cookie banner, GA4 switches to full analytics mode. You can withdraw this consent at any time by contacting us or clearing your browser's local storage for this site.

Session replay and chat intercept tools: We do not use session-replay software (such as Hotjar, FullStory, or Microsoft Clarity), keystroke-logging tools, live-chat widgets that forward conversations to third parties, or any other technology designed to intercept or record your communications in real time without your express, informed consent. If this ever changes, this policy will be updated and the consent banner will be modified to seek your specific consent before any such tool activates.

This disclosure is provided pursuant to California Penal Code § 631 and the evolving CIPA case law as applied to web-based analytics. If you have questions or concerns about our analytics practices, please contact us at [email protected].

General Data Protection Regulation (GDPR) — EU & EEA Visitors

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation and/or UK GDPR applies to our processing of your personal data. Our legal bases for processing are:

• Consent — for analytics cookies and optional marketing communications (you may withdraw at any time).
• Legitimate interests — for security monitoring, fraud prevention, and basic server logging necessary to operate the site, provided these interests are not overridden by your rights.
• Contract — where processing is necessary to respond to your inquiry or fulfill a service you have requested.

Under the GDPR you have the right to: access your data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability, object to processing based on legitimate interests, and not be subject to solely automated decision-making with legal or similarly significant effects (we do not conduct automated decision-making). You also have the right to lodge a complaint with your national data protection supervisory authority (for EU residents: your national DPA; for UK residents: the ICO at ico.org.uk).

We do not transfer your personal data to countries outside the EEA, UK, or Switzerland except where appropriate safeguards are in place (including the EU-U.S. Data Privacy Framework for data transfers to Google, which is a certified participant). To exercise your GDPR rights, contact us at [email protected].

Lei Geral de Protecao de Dados (LGPD) — Visitantes do Brasil

Se voce esta localizado no Brasil, a Lei Geral de Protecao de Dados (LGPD, Lei n. 13.709/2018) confere a voce direitos sobre seus dados pessoais, incluindo: confirmacao do tratamento, acesso, correcao, anonimizacao ou bloqueio, portabilidade, eliminacao, informacao sobre compartilhamento, revogacao do consentimento e peticao a ANPD (Autoridade Nacional de Protecao de Dados).

Nossa base legal para o tratamento de dados pessoais e o consentimento (para cookies de analitica) e o legitimo interesse (para operacao e seguranca do site). Para exercer seus direitos ou revogar o consentimento, entre em contato pelo e-mail [email protected]. Responderemos no prazo de 15 dias uteis conforme exige a LGPD.

ADA Accessibility Statement

BuyInRio is committed to ensuring that its website is accessible to people with disabilities in accordance with the Americans with Disabilities Act (ADA), Section 508 of the Rehabilitation Act, and the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, to the greatest extent feasible. We are continuously working to improve the accessibility of our site and to ensure we provide an equal experience for all users.

Our accessibility efforts include: providing text alternatives for non-text content, ensuring sufficient color contrast, making all functionality available from a keyboard, providing captions and audio descriptions for multimedia content where applicable, and designing pages to avoid content that could cause seizures.

Known limitations: While we strive to meet WCAG 2.1 AA, some older or third-party content on this site may not yet fully conform. We are actively working to bring all content into compliance.

Request an accessible format: If you encounter any accessibility barriers, need information in an alternative format, or wish to provide feedback about our accessibility practices, please contact us at [email protected]. We will make reasonable efforts to provide the information you need in an accessible format within five (5) business days.

Third-party tools: Portions of this site may use third-party tools or plug-ins that are not within our direct control. We encourage vendors to follow WCAG 2.1 AA standards and will replace tools that are persistently inaccessible.

Cookie Policy — Detailed Breakdown

A cookie is a small text file stored in your browser when you visit a website. This site uses local storage (a similar technology) to remember your cookie consent choice. Here is a complete breakdown of what we use:

How to manage cookies: You can delete or block cookies at any time through your browser settings (Chrome: Settings → Privacy → Cookies; Safari: Preferences → Privacy; Firefox: Options → Privacy & Security). Note that blocking all cookies may affect site functionality. The cavConsent item lives in local storage, not cookies — to clear it, use Developer Tools → Application → Local Storage and delete the cavConsent key for this site's domain.

Third-Party Services — Full Disclosure

The following third-party services may receive or process personal data when you use this site:

• Google Analytics 4 (Google LLC, USA) — website analytics. Data sent only after consent. Governed by Google's Privacy Policy. Google is certified under the EU-U.S. Data Privacy Framework. You may opt out globally via the GA Opt-out Add-on.
• Cloudflare, Inc. (USA) — content delivery network, DDoS protection, WAF, and SSL/TLS. Processes IP addresses and HTTP request metadata for every visitor. Governed by Cloudflare's Privacy Policy. Data is processed under Cloudflare's DPA (GDPR-compliant Standard Contractual Clauses).
• Cavmir CRM capture script (Trousdale Technologies / Cavmir) — a small script that captures form submissions site-wide and routes them to our internal CRM for follow-up. This script is consent-gated and only loads after you accept cookies. No form data is transmitted without prior activation. Data is stored on Cloudflare D1 (a US-based database) and is used solely to respond to your inquiry.
• Google Fonts (where applicable) — typeface delivery. Your browser may contact Google's servers to download fonts, sending your IP address. Governed by Google's Privacy Policy above. We serve fonts locally on some sites to avoid this.

Data Retention Schedule

• Contact form submissions & inquiries: Retained for 3 years from the date of submission, then permanently deleted from our CRM.
• Google Analytics data: Retained for 14 months (our GA4 setting), after which it is automatically deleted by Google.
• Server logs (Cloudflare): Retained per Cloudflare's standard data-retention policies (generally up to 30 days for free/Pro plans).
• Cookie consent record (cavConsent): Stored in your browser's local storage until you clear it or it is replaced.
• Email correspondence: Retained for 5 years for business-record purposes, then permanently deleted.

Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include: HTTPS/TLS encryption for all data in transit, Cloudflare DDoS mitigation and WAF for all traffic, access controls limiting who can view CRM data, and regular review of our security practices. However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security, and we are not liable for unauthorized access resulting from circumstances beyond our reasonable control.

Your Rights — How to Submit a Request

To exercise any of the rights described in this policy — including the right to access, delete, correct, restrict, or port your data; to opt out of analytics; or to file a complaint — please contact us at:

• Email: [email protected]
• Subject line: "Privacy Rights Request — [your jurisdiction]" (e.g., "Privacy Rights Request — California")

We will verify your identity before processing your request and will respond within the legally required timeframe for your jurisdiction (45 days for CCPA, 30 days for GDPR, 15 business days for LGPD). If we need more time, we will notify you. All requests are free of charge unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, with explanation.

Children's Privacy (COPPA & International Equivalents)

This website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have inadvertently collected data from a child under 13, please contact us immediately at [email protected] and we will delete the information promptly. This site is also not designed for or directed at persons under 18 years of age. In jurisdictions with higher age thresholds for data processing (e.g., age 16 under GDPR Article 8 in some EU member states), we do not knowingly process the data of minors below that threshold without verifiable parental consent.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will update the effective date at the top of this page and, where required by law, notify you by email or by a prominent notice on our website prior to the change becoming effective. We encourage you to review this policy periodically. Your continued use of this website after the effective date of any changes constitutes acceptance of the updated policy. Prior versions of this policy are available upon request.

Contact & Data Controller Information

The data controller for personal information collected through this website is:

Trousdale Technologies LLC (operating as BuyInRio / Cavmir)
25 SE 2nd Avenue, Suite 504, Miami, FL 33131, USA
Email: [email protected]
Website: cavmir.com

For data protection matters involving EU/EEA residents, our representative within the EU (where required under GDPR Article 27) can be reached at the same email address. For data protection matters involving UK residents, our UK representative can similarly be reached at the above email address.