Legal
Privacy Policy
Preshh, Lda. ("Preshh", "we", "our") is the controller of the personal data collected through this website. This Privacy Policy explains what we collect, why, and how you can exercise your rights under GDPR (Regulation (EU) 2016/679) and applicable Portuguese law.
1. Data we collect
• Account data (name, email, hashed password, birthday, phone). • Order & payment data (billing/shipping address, order items, transaction identifiers — payment card data is handled directly by Stripe and PayPal, we never store it). • Support & conversational data (messages you send us or to our AI assistant Theo). • Technical data (IP, browser, device, cookies described in the Cookie section below).
2. Purposes & legal bases
• Fulfilling your orders and providing customer support — performance of a contract. • Sending transactional emails (order confirmation, shipping updates) — performance of a contract. • Loyalty benefits (birthday discount, referral credit) — consent expressed at registration. • Marketing communications (only if you opt in) — consent, withdrawable at any time. • Fraud prevention & legal compliance — legitimate interest & legal obligation.
3. Sharing with sub-processors
We share data only with vetted providers, under GDPR-compliant contracts: • Stripe (payments) — Ireland/US, SCCs. • PayPal (payments) — Luxembourg/US, SCCs. • Resend (transactional email) — US, SCCs. • Shippo (shipping labels) — US, SCCs. • MongoDB Atlas (hosted database) — EU region. • Emergent (AI Concierge infrastructure) — EU region.
4. Retention
Order data is retained for 10 years for tax purposes. Account data is retained while your account is active; you can request deletion at any time. AI conversation logs are retained for 12 months for quality assurance.
5. Your rights
You may request access, rectification, deletion, portability, restriction, and object to processing. You may also lodge a complaint with the Portuguese Data Protection Authority (CNPD, www.cnpd.pt). To exercise your rights, email privacy@preshh.com or support@preshh.com.br.
6. International transfers
When data leaves the EEA (e.g. Stripe US), we rely on Standard Contractual Clauses and, where relevant, additional technical safeguards.
7. Cookies
We use strictly necessary cookies (cart, session) at all times. Analytics and marketing cookies (Google Analytics, Meta Pixel) fire only after you accept them in the cookie banner. You can change your choices at any time by clearing cookies for this site.
8. Contact
Preshh, Lda. — support@preshh.com.br — privacy@preshh.com. Data Protection Officer: dpo@preshh.com.
Last updated: February 2026. This document was drafted by the Preshh team and should be reviewed by qualified legal counsel before final publication in each jurisdiction.