Privacy Policy
Last updated: April 2026
Data Controller
The data controller responsible for personal information collected through Juanita’s Tarot 123 is:
PRISMATIKORBIT LDA
NIPC 515154970
Avenida Duque de Loulé 24, 7º Esqº
1050-086 Lisbon, Portugal
Email: support@merchsage.com
This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR) and other applicable laws.
Information We Collect
When you place an order or contact us, we collect:
- Contact information — name, email address, phone number (if provided)
- Shipping information — delivery address
- Payment information — processed securely by Stripe; we do not store full card details
- Order details — items purchased, sizes, quantities, order history
- Communications — emails and support messages you send us
- Technical data — IP address, browser type, device type, pages viewed (via cookies and server logs)
How We Use Your Information
We use your personal data to:
- Process and fulfill your order (legal basis: performance of a contract)
- Send order confirmation, shipping, and delivery notifications (performance of a contract)
- Respond to customer service inquiries (performance of a contract / legitimate interest)
- Comply with tax, accounting, and consumer-protection obligations (legal obligation)
- Detect and prevent fraud (legitimate interest)
- Improve our products and storefront experience (legitimate interest)
Processors and Third Parties
We share the minimum personal data required with the following processors, each bound by a written data-processing agreement:
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Printful | Print-on-demand fulfillment and shipping | Name, shipping address, email, order details | United States |
| Stripe | Payment processing | Name, email, billing address, card data (handled directly by Stripe) | United States / Ireland |
| Postmark | Transactional email delivery (order confirmations, shipping notices) | Name, email, order details | United States |
| Google (Gemini API) | AI-assisted design generation and product copy | No customer personal data; product/design metadata only | United States |
| Caddy / AWS | Web hosting and reverse proxy infrastructure | IP address, server logs | EU / United States |
We do not sell your personal information to third parties.
International Data Transfers
Some of our processors are located outside the European Economic Area (EEA), primarily in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the lawful transfer mechanism, supplemented by additional safeguards where required. You can request a copy of the SCCs in place by emailing support@merchsage.com.
Cookies
We use a small number of cookies. You can disable cookies in your browser settings, though some store features (such as the cart) may not work correctly without them.
| Cookie | Purpose | Type | Retention |
|---|---|---|---|
cart_id |
Keeps your shopping cart contents between visits | Strictly necessary | 30 days |
session |
Maintains your session while browsing the store | Strictly necessary | Session |
_ga |
Google Analytics — aggregate traffic measurement | Analytics | 2 years |
_gid |
Google Analytics — distinguish unique visitors | Analytics | 24 hours |
Data Retention
We keep personal data only as long as needed for the purposes described above:
- Order records: retained for 10 years to comply with Portuguese tax and accounting law
- Customer support communications: retained for 3 years after the last interaction
- Marketing consents and preferences: retained until you withdraw consent
- Server and access logs: retained for 90 days
When the retention period ends, we delete or irreversibly anonymise your personal data.
Your Rights
Under GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete personal data
- Erase your personal data ("right to be forgotten"), subject to legal retention obligations
- Restrict or object to processing of your personal data
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt
To exercise any of these rights, email support@merchsage.com. We will respond within 30 days.
Data Protection Contact
For all data-protection inquiries, including access requests, erasure requests, and complaints, contact us at support@merchsage.com.
Changes to This Policy
We may update this policy from time to time. Material changes will be posted on this page with a revised date.