Privacy

From people who just visit, none: the site has no accounts or analytics tools, and keeps nothing about the people who open it. The only exception is the newsletter, and only for those who sign up — it is explained in the next section.

If you sign up, we keep your email address and the date you confirmed, and use them only to send you our news, in Portuguese. The legal basis is your consent, given in two steps: you type your email on the site and confirm it through the link we send you. Without that confirmation, the address does not join the list; the only trace is the record of the confirmation email kept by the service that sends it (Resend). Every email includes a link to unsubscribe, which takes effect immediately: you stop receiving emails, and the address stays on the list marked as unsubscribed, so that it isn't emailed again by mistake. You can ask us at any time what data we hold about you, or ask us to delete it for good, using our contact details. The same email opens the secret menu: when you type it there, we only check whether it is on the list.

None that load code in your browser: fonts and images are served from this domain, and there are no embedded maps or social media buttons. Links to Google Maps and to social media are plain links, which only open if you click them. Newsletter emails are sent through Resend, which keeps the contact list on our behalf. To prevent abuse of the newsletter and secret menu forms, the server counts requests in Upstash: the network address they come from, for one hour, and the email, in a form that cannot be turned back into it, for 24 hours. In neither case does your browser talk to these services — the site's server does.

The site is hosted by Vercel, which logs requests to its servers in order to deliver and protect the site. Those logs belong to the platform, and we do not use them to identify anyone. When someone exceeds the form limits, the server log keeps the network address and the partly hidden email, so that abuse can be spotted.

Staff sign in to a private area with a code sent to their email. To do this, we use each staff member's email address to send them the code (through Resend), and we keep the sign-in record for up to 30 days (at Upstash) to limit attempts and recognise the device. None of this concerns visitors to the site.

Reach us through the details on the contact page. If you believe your data has not been handled properly, you also have the right to lodge a complaint with the Portuguese data protection authority (CNPD).