— data protection

Privacy & GDPR.

This policy explains what personal data we collect, why, for how long, and what your rights are. It is written in plain language. If anything is unclear, write to [email protected].

1. Who is responsible for your data

The data controller is MeiaNoite, Lda. — a Portuguese company with tax number (NIPC) 513 626 409, headquartered at Av. da República, 90 — 4º, 1050-191 Lisbon. You can contact our Data Protection Officer at [email protected].

2. What data we collect

We collect only the minimum necessary, depending on the service used:

Account & order: name, email, phone, address(es), payment data (tokenised by the gateways — we never see your card).
Guest purchase: email + address + shipping details.
Browsing: essential cookies; analytics cookies only with consent.
Support: the content of your messages, so we can reply and improve.

3. What we use your data for

Each use has a specific legal basis:

Performing the contract: processing your order, shipping, invoice.
Meeting legal obligations: accounting, certified tax (AT) invoicing, VAT.
Consent: newsletter, analytics cookies, review requests.
Legitimate interest: preventing fraud, improving the store (with aggregated data).

4. How long we keep it

Active account: for as long as your account exists.
Completed order: 10 years (legal obligation, accounting/AT).
Newsletter: until you unsubscribe.
Analytics cookies: up to 13 months.

5. Who we share with

We share with strictly necessary providers, all under a data processing agreement (DPA):

Carrier — CTT (shipping & tracking).
Payment gateways — Stripe, PayPal, Ifthenpay.
Transactional email — Postmark / SendGrid.
Hosting — VPS in Frankfurt (EU).

We never sell your data to third parties.

6. Your rights

Where applicable, you always have the right to:

Access your data (know what we hold about you)
Rectify incorrect data
Delete the account ("right to be forgotten")
Restrict or object to certain processing
Port your data (export it)
Withdraw consent
Lodge a complaint with the CNPD

To exercise any of these, write to [email protected]. We respond within 30 days.

7. Cookies

We use two types:

Essential — session, cart, age-gate, language. You can't disable these (the store doesn't work without them).
Analytics — only with your consent, and only aggregated. We use self-hosted Plausible (it doesn't send data to third parties).

You can change your preference by clicking "Cookies" in the footer.