Privacy Policy (LGPD / GDPR)

Controller. The World Mural is the controller of the personal data processed on this website. Data Protection contact: support@theworldmural.com.

Data we collect. (a) Account data received from Google OAuth: name, e-mail address and profile picture URL; (b) Content you publish: messages and likes, which are public by nature; (c) Technical data: approximate country derived from your IP address (through the Cloudflare header) used only to pre-select your language, browser language, session cookie; (d) Advertising data collected by Google AdSense according to its own policies.

Legal bases. Performance of a contract (providing the mural to you), consent (cookies for advertising and language preference), legitimate interest (security, abuse prevention and service improvement) and legal obligation, as set by GDPR art. 6 and LGPD art. 7.

Purposes. Authenticating you, publishing and displaying your messages, showing likes, preventing abuse, presenting the interface in your language and financing the project through advertising.

Sharing. We share data with Google (authentication and advertising) and with our hosting and database providers, acting as processors. We never sell personal data.

Retention. Account data is retained while your account exists. After deletion, your account, messages and likes are erased from the production database immediately and from backups within 30 days. Records required by law may be kept for the legally mandated period.

Your rights. Access, rectification, deletion, portability, restriction and objection, plus the right to withdraw consent and to lodge a complaint with your supervisory authority (ANPD in Brazil, the competent DPA in the EU). You can exercise access, portability (JSON export) and deletion directly and immediately in “My panel”; other requests: support@theworldmural.com, answered within 15 days.

Cookies. We use a strictly necessary session cookie (twm_session), a preference cookie for language (twm_locale) and localStorage to remember that you have already seen the welcome window. Advertising cookies are set by Google AdSense and may be managed at adssettings.google.com.

International transfers. Data may be processed on servers outside your country under standard contractual clauses.

Minors. The service is not directed to children under 13 (16 in the EEA). If we learn of such an account, it is deleted.

Changes. Material changes to this policy will be announced through the global notice displayed at the top of the mural. Last updated: 2026.