Privacy policy

1. Data controller

Hugo da Costa Nunes do Amaral, Sole trader, tax number (NIF) 216869218, Rua Prof. Bento de Jesus Caraça, 50, R/C Dto., 1600-605 Lisboa, Portugal. For privacy matters: hugocnamaral@gmail.com.

2. What data we process

Account: email, password (stored encrypted), name or brand and seller type.

Orders: products bought, amounts, name, delivery address, phone and email.

Sellers: the data needed for payouts, collected directly by Stripe.

Reviews and return requests you write.

Minimal technical data: IP address and access logs, for security.

3. Why we use it and on what legal basis

Performance of the contract: creating your account and processing orders, payments, shipments and returns.

Legal obligations: invoicing, tax (including reporting seller data to the Portuguese Tax Authority under DAC7) and fraud prevention.

Legitimate interest: platform security and dispute resolution.

We do not sell personal data or run personalised advertising.

4. Who we share it with

The seller of your order: name, address, phone and the items you bought from them, only for shipping.

Service providers processing data on our behalf: Supabase (database and authentication, servers in the EU), Stripe (payments), Vercel (website hosting) and Resend (email delivery).

Some of these providers may process data outside the EU; in that case, under the European Commission's standard contractual clauses or an adequacy decision.

Authorities, when required by law.

5. How long we keep it

Account data: while your account is active. Order and invoicing data: 10 years, as required by tax law. Technical logs: up to 12 months.

6. Your rights

You can request access, rectification, erasure, restriction, portability, or object to processing by writing to hugocnamaral@gmail.com.

You have the right to lodge a complaint with the Portuguese Data Protection Authority, CNPD (www.cnpd.pt), or with the authority of your country.