Data controller
Vitor Hugo Amado Rosa, operating in a personal capacity, Portuguese tax ID (NIF) 209676469.
Address: Estrada da Racoeira, n. 5, 2440-131. You can reach us using the contact in the footer.
Privacy Policy
Data collected
We collect name, email, mobile phone, delivery address and data required to manage orders. The address is stored with the order in the database; the form does not save it in browser storage.
We use these details to prepare and manage purchases, respond to requests and provide support (pre-contractual steps and performance of a contract), meet legal and tax obligations and protect against fraud and abuse. Accepting an order does not authorise marketing.
Your date of birth is transmitted over HTTPS and used only in memory to check your adult declaration. It is not stored in the database or cookie or logged by application code. The signed cookie contains only a version, issue/expiry times and a random value, not your birth date or identity.
The browser retains cart and retry information as explained in the cookie policy. We do not request copies of identity documents.
Your rights
You may request access, rectification, erasure, restriction, portability or object where applicable, by emailing contacto@arbustus.co. Erasure remains subject to statutory retention duties. You may complain to the Portuguese data protection authority (CNPD) at www.cnpd.pt.
Service providers and retention
The website uses Vercel for hosting and Supabase for the database and administrative authentication. Payments are processed by Stripe; card details are entered in Stripe Checkout and are not stored by this site. Order emails are sent through Resend. Billing details and an optional NIF are used by the seller to issue invoices manually. Contact and delivery details may be shared with the carrier needed to fulfil the order.
We retain data as needed to manage orders, provide support and defend rights; documents subject to tax obligations follow the applicable statutory periods. Data without a valid purpose should be erased or anonymised. Ask the controller about retention, recipients and international transfers.