Privacy Policy

1. Data controller

Renato André Ribeiro Madeira, tax number (NIF) 243310749, Rua Dr. Francisco Barbosa, 2040-247 Rio Maior, Portugal. For any question about your data: [email protected].

2. What data we process

• Account: email address, public name, password (stored encrypted — we never see it) and preferred language.
• Usage: favourites, unlocked stickers, credit balance and subscription status.
• Payments: handled by Stripe. We only receive the customer ID, the purchase status and the amount — never your card details.
• Security: IP address and technical request data, used to protect the site against attacks and bots.
• Support: the content of the emails you send us.

3. Why we use your data and on what legal basis

• Creating and managing your account and giving you access to what you bought — performance of a contract.
• Processing payments and meeting tax obligations — performance of a contract and legal obligation.
• Sending essential emails (account confirmation, password recovery, receipts, price change notices) — performance of a contract.
• Protecting the site against fraud, abuse and bots — legitimate interest.

We do not sell your data, we do not run personalised advertising and we do not use third-party analytics tools.

4. Service providers (processors)

We use the providers below, who process data only on our behalf and under appropriate contractual safeguards — including, where data leaves the European Economic Area, the standard contractual clauses approved by the European Commission:

• Supabase — database and authentication;
• Vercel — website hosting;
• Cloudflare — network, security and bot verification (Turnstile);
• Stripe — payments and invoicing;
• Resend — email delivery.

5. How long we keep your data

We keep account data for as long as the account exists. If you ask us to delete it, we delete the account and its data within 30 days, except for payment records, which Portuguese tax law requires us to keep for 10 years. Technical security logs are deleted automatically after a few weeks.

6. Cookies

We only use strictly necessary cookies and local storage: to keep you signed in, remember your language and protect forms against bots. We do not use advertising or analytics cookies — which is why we don't ask for cookie consent.

7. Your rights

You can ask at any time to access, correct, delete or port your data, and to object to or restrict its processing. Just write to [email protected]; we reply within one month at the latest.

If you believe your data has not been handled properly, you can lodge a complaint with a data protection authority — in Portugal, the CNPD (www.cnpd.pt), or the authority in your country of residence.

8. Minors

The service is intended for people aged 16 and over. If you know that a minor has given us data without permission, contact us and we will delete it.

9. Changes

If we make significant changes to this policy, we will let you know on the site or by email.