Prelaunch legal draft. Live purchases are disabled until completion and review.

Privacy and service data

Controller and contact

Tiago de Bem Natel de Moura
R CAMINHO DO MONTE - URBANIZAÇÃO PLANALTO N 18
NIF/VAT: PT306236311
Contact: t.nateldemoura@gmail.com · +351 914024152

Account and catalog data

We process account email, password hashes, business identity, authorized store and feed URLs, compatibility evidence, billing references and reports to provide and administer the agreed service. Passwords are hashed; session and recovery tokens are stored as hashes. Supply business catalog information only, never shopper records or store passwords.

Providers

The application, PostgreSQL database and authorized monitoring worker run on the supplier's selected VPS. Stripe handles card entry and subscription billing; we do not store card numbers. InvoiceXpress is the fiscal-document provider. Google and Microsoft can provide optional sign-in using identity and email claims only; no mailbox, files or contacts access is requested. Passwordless email links expire in 15 minutes and are single-use. The selected email provider handles transactional mail, and private backup storage holds recovery copies. The final provider list, processing terms and applicable transfer information must be completed before customer launch.

Submission accountability records

For accountability, security and investigating authorized changes, we record the initiating user, server time, connection IP and request identity. Where product submissions are enabled, records include product/account/source references and before, proposed and observed values. Only the supplier owner can access the audit panel. Records are visible for 90 days from each event and are automatically removed from the active database after expiry while the service runs. Encrypted recovery copies have a separate 35-day rotation; some expired records may remain in a backup until its snapshot expires. Restored records are subject to the same expiry rules before application access. An IP may identify a shared network or VPN and does not prove a physical person. The Merchant connector is not activated in this prelaunch release.

Storage and choices

Essential login cookies keep the account signed in. There are no advertising trackers or third-party analytics. Catalog working files and reports are normally deleted or returned within 30 days of termination, subject to documented legal needs. Inactive enquiries are reviewed after 90 days; fiscal records follow statutory retention. Request access, correction, deletion, restriction or other applicable rights using the contact above. Complaints may be made to the Portuguese CNPD.

Read-only checks

We fetch the exact authorized product links, retain timestamps and observed product/variant/seller evidence, and report actual coverage and unresolved cases. Customer reports are restricted to their account and the supplier. Failed initial samples do not create a store request. Rate-limit and operational records support security and service operation.