Legal

Privacy policy

Last updated: 6 November 2026. This policy explains which personal data ProvenDrop processes, why, and what your rights are under the General Data Protection Regulation (GDPR).

1. Controller

The controller is [A COMPLETAR PELO AFONSO: nome legal], tax number (NIF) [A COMPLETAR PELO AFONSO: NIF], [A COMPLETAR PELO AFONSO: morada completa], Portugal. Contact: WhatsApp +351 920 414 823.

2. What we collect and why

• E-mail address (and name, if you type it at checkout): to create your subscription, send your sign-in links, the daily collections and service messages. Legal basis: performance of the contract.
• Phone number (Click plan only, asked by Stripe at checkout): so that you can be added to the Click Dynamics WhatsApp group. Legal basis: performance of the contract.
• Payment data: card details are entered on Stripe's pages and handled by Stripe. We receive only the status of the payment and subscription, the Stripe customer and subscription identifiers, the amounts, the last digits of the card and any refund or dispute. Legal basis: performance of the contract and legal obligations (invoicing, accounting).
• Preferences (niche and countries) and whether you have seen the first-visit guide: to order the collections for you. Legal basis: performance of the contract.
• Technical data: sign-in events, Stripe webhook events, server logs and, for the "fix my e-mail" feature on the welcome page, a hashed version of your IP address kept for rate limiting. Legal basis: our legitimate interest in keeping the service secure and preventing abuse.
• E-mail corrections: if you correct the e-mail typed at checkout, we keep a record of the old and the new address, the checkout session and the date. Legal basis: legitimate interest (fraud prevention and support).

We do not use advertising cookies, analytics trackers or profiling. We never sell personal data.

3. Who processes data for us

• Stripe (Stripe Payments Europe, Ltd.): payments, subscriptions, invoices and the customer portal. Stripe privacy policy.
• Supabase: database, authentication (sign-in links) and the functions that run the service. [A COMPLETAR PELO AFONSO: região do projeto Supabase (ex.: EU, Frankfurt) — confirmar em Project Settings].
• Resend: sending of transactional e-mails (welcome, daily collections, alerts).
• GitHub Pages: hosting of this website and of the member area pages.
• Google Fonts: the typeface of this website is loaded from Google's servers, which receive your IP address when the page loads.
• WhatsApp (Meta): if you contact us on WhatsApp or subscribe to the Click plan, your messages and number are processed by WhatsApp under its own terms.
• Click Dynamics (Click plan only): our partner that runs the WhatsApp group receives the e-mail and phone number you give at checkout, to add you to the group and to confirm your subscription.

Some of these providers are established outside the European Economic Area, or may transfer data outside it. In those cases the transfer relies on the European Commission's standard contractual clauses or an adequacy decision.

4. How long we keep data

• Subscription and account data: while your subscription is active and for [A COMPLETAR PELO AFONSO: prazo, ex.: 12 meses] after it ends, so that you can come back without losing your preferences.
• Invoicing and payment records: for the period required by Portuguese tax and accounting law [A COMPLETAR PELO AFONSO: confirmar o prazo (10 anos) com o contabilista].
• Webhook events and technical logs: up to 12 months. Rate-limiting records (hashed IP): 24 hours.
• E-mail correction records: 12 months.

5. Your rights

You can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and you can withdraw consent where consent is the legal basis. To exercise these rights, contact us using the details in section 1; we answer within one month. You also have the right to complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or to the authority of the EU country where you live.

6. Cookies and local storage

This website does not set tracking cookies. The member area stores your sign-in session in your browser's local storage, which is strictly necessary for you to stay signed in; it is removed when you sign out. Stripe's checkout and portal pages set their own cookies under Stripe's policy.

7. Security

You sign in with a personal link sent to your e-mail, so there is no password to steal. Access to data in the member area is enforced on the server, per subscriber. We never store card numbers. Our e-mails and daily lists never contain store links or kits; those are only available after you sign in.

8. Who can subscribe

ProvenDrop is a service for businesses and for adults who run or plan an online store. It is not intended for anyone under 18.

9. Changes

We may update this policy. The date at the top shows the current version. Material changes are announced by e-mail.