Política de Privacidade · Privacy Policy

Status: Draft. This is a working draft to be reviewed by a lawyer (or a competent privacy adviser) before going to production. It is structured for the chia setup (manual payments Phase 1, magic-link customer access, Plausible analytics, Cloudflare R2 storage, Resend email) and reflects RGPD (the Portuguese implementation of GDPR). Translate to PT-PT for the customer-facing version; the EN version remains here as a reference for the artist and content collaborator.

1. Who we are

An individual artist based in Portugal, trading as chia. The artist's legal name and tax identification are confirmed in writing upon order (artistic activity registration / Atividade Independente).

Contact for privacy questions: write to us at the address on the Contacto page.

When this document says "we", it means the artist personally.

2. What data we collect, and why

When you place an order on a chia storefront

We collect:
- Your name, email, phone, shipping address, and postcode. To fulfil and ship your commission.
- Photographs you upload of your pet. As the reference for the artwork. These are private to you and the artist.
- Any notes you provide. To inform the artwork.
- The marketing source you came from (UTM parameters in the URL, e.g., from a TikTok or Instagram link). To understand which campaigns lead to orders. Stored on the order record itself.
- A session cookie that holds your draft order while you complete the 3-step flow.

We do not collect:
- Payment card data. Phase 1 payments are arranged out-of-band (bank transfer, MB WAY). Phase 2 will use Stripe and Ifthenpay, which collect payment data on their own infrastructure — we never see it.
- IP address logs beyond what our hosting provider keeps for security and operational purposes.
- Any data about visitors who don't submit an order, beyond aggregate analytics (see §4).

When you fill in the portal contact form

We collect your name, email, and message to reply to you.

Analytics (Umami)

We use Umami Analytics to count visits to the site. Umami is privacy-friendly and does not use cookies, does not track you across sites, and does not collect personal data. Aggregate counts of page views, referring sites, and rough geographic origin (country) are all we see.

3. How long we keep your data

Order records (name, email, phone, shipping): Kept for the duration of legal accounting requirements in Portugal (currently 10 years for invoicing-related records). You may request anonymisation at any time — see §6.
Pet photographs: Deleted once your portrait is delivered and you confirm satisfaction, unless you explicitly ask us to keep them as portfolio reference.
Marketing attribution (UTM data): Aggregated after one year; individual order-level attribution is anonymised then.
Contact form messages: Kept for two years after the last reply, then deleted.

4. Who we share your data with

We do not sell, rent, or share your data with advertising networks. Period.

We use the following service providers to operate the site, and your data may transit through them:

Provider	What they handle	Where
Fly.io	Application hosting	Madrid, Spain (EU)
Cloudflare R2	Image storage (your pet photos, our portfolio)	EU jurisdiction
Resend	Sending you order-confirmation emails	EU jurisdiction (data processor)
Plausible	Aggregate analytics	EU (Germany)

All of these are RGPD/GDPR-compliant data processors operating in or under EU jurisdiction. We have a Data Processing Agreement with each where applicable.

In Phase 2 (when online payments launch), Stripe and Ifthenpay will be added to this list, handling payment data only.

5. Cookies and tracking

We use:
- A session cookie to remember your draft order while you complete the order flow. Cleared when you close your browser.
- A language-preference cookie to remember whether you chose Portuguese or English. Cleared after a year of inactivity.

We do not use:
- Advertising cookies.
- Cross-site tracking pixels.
- Meta (Facebook/Instagram) Pixel.
- TikTok Pixel.
- Google Analytics or any Google tracking.

Because we only use strictly necessary cookies, no cookie banner is required under RGPD.

6. Your rights

Under RGPD, you can:

Access the data we hold about you. Email us at [contact above] and we'll send you a copy.
Correct any data that's wrong. Reply to your order email or use the contact form.
Delete your data ("right to be forgotten"). Email us. We'll anonymise your orders within 30 days. Financial records (date, amount, currency) are retained for legal accounting; everything else is removed.
Restrict processing while a complaint or correction is being handled.
Object to processing — though for the data we collect (order fulfilment), processing is necessary for the contract you entered with us.
Port your data to another service if you ever need to. Email us; we'll send you a structured export.
Complain to the supervisory authority — in Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).

7. Security

Customer-uploaded photos are stored in a private Cloudflare R2 bucket. Direct URLs return 403; access is granted only via short-lived signed URLs to the artist (via admin login) or to you (via the magic-link in your order confirmation email).
The database is encrypted at rest by Fly.io's infrastructure.
All traffic to the site is HTTPS-only.
We do not log into the artist's admin from public Wi-Fi without a VPN.

If a security incident affects your data, we will notify you within 72 hours of becoming aware of it (RGPD Article 33-34).

8. Children

We do not knowingly process data from anyone under 16. If you believe we have data from a minor, contact us and we will delete it.

9. Changes to this policy

We may update this policy as the site evolves (Phase 2 payments, new tools). Material changes will be announced at the top of this page and dated. The version history lives in the project's git repository.

Last updated: 2026-05-31
Version: 1.0 (Phase 1 / pre-launch draft)