Privacy Policy

01 — Who we are

buildstackstudio ("we," "us," "the studio") is the data controller for the personal data described in this policy. We're based at Av. Gen. Humberto Delgado 30, 2560-272 Torres Vedras, Portugal. You can reach us at support@buildstackstudio.com or +351 639 297 540 for any question about this policy or your data.

02 — What data we collect

When you contact us (the enquiry form on /contact): name, email address, and — if you choose to provide them — phone number, company name, and the details of your enquiry.

When you place an order (checkout on /checkout): name, email address, phone number (optional), company name (optional), billing address, and VAT/NIF number (optional, if you supply one for reverse-charge treatment). We do not collect or store payment card data — the checkout on this site is a demonstration flow; no real payment is processed, and no card details are ever transmitted to or stored by buildstackstudio.

When you browse the site: if you accept analytics cookies, Google Analytics 4 collects standard usage data (pages viewed, approximate location at country/region level, device type). This only happens after you actively consent — see §08.

We do not collect payment card numbers, government ID numbers, or any special category of data (health, biometric, etc.), and we ask that you don't include this kind of information in a free-text field like the enquiry message.

03 — Why we process it (lawful basis)

Enquiry and order data: processed to respond to your enquiry or fulfil an order you've placed — lawful basis: performance of a contract (or steps taken at your request prior to entering one), under Article 6(1)(b) GDPR.
Analytics data: processed only with your consent — Article 6(1)(a) GDPR. You can withdraw consent at any time via Cookie settings in the footer.
Security and fraud prevention (e.g. rate-limiting form submissions, honeypot spam filtering): legitimate interest — Article 6(1)(f) GDPR — balanced against your right to privacy; this processing is minimal and doesn't involve profiling.

04 — How long we keep it

Enquiry data (contact form submissions that don't become an order): kept for up to 24 months from your last contact with us, then deleted, unless you ask us to delete it sooner.
Order and invoice data: kept for 10 years from the date of the transaction, as required under Portuguese commercial and tax law for accounting records.
Analytics data: retained according to Google's standard Google Analytics 4 retention settings (event data held for 14 months by default) and only collected at all once you've consented.

We don't sell personal data, ever. We share it only with:

Service providers who process data on our behalf ("processors"): our hosting provider (to serve the website and store form/order submissions), and — only once you've consented — Google Ireland Limited, for Google Analytics 4. Once a real payment provider is live on this site, it will be added here and to this section before it processes any payment data.
Legal or regulatory authorities, only where we're required to by Portuguese or EU law.

06 — International transfers

Google Analytics 4 (used only with your consent) is provided by Google Ireland Limited and may involve data transfers outside the EU/EEA. Google processes this data under Standard Contractual Clauses and its own published data-processing terms. No other processor named in §05 transfers your data outside the EU/EEA.

07 — Your rights

Under the GDPR, you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data, subject to our legal retention obligations (e.g. invoice records, §04)
Restrict or object to certain processing
Data portability, for data you've provided to us
Withdraw consent at any time for anything based on consent (e.g. analytics), without affecting the lawfulness of processing carried out before the withdrawal

To exercise any of these rights, email support@buildstackstudio.com. We respond within one month, as required by the GDPR.

You also have the right to lodge a complaint with Portugal's supervisory authority, the CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the supervisory authority in your own EU country of residence.

08 — Cookies

We use cookies and similar technologies (including browser local storage) as described in full in the Cookie Policy. In short: strictly necessary technologies run the cart, checkout and your cookie choice, and always run. Google Analytics 4 is non-essential and loads only after you actively accept it via the cookie banner or Cookie settings.

09 — Children

This site and its services are intended for businesses and individuals acting in a professional capacity. We don't knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we'll delete it.

10 — Changes to this policy

We may update this policy as the site or our processing changes. The "Last updated" date at the top reflects the most recent revision. Material changes will be reflected here; we encourage checking back periodically.

11 — Contact & complaints

buildstackstudio · Av. Gen. Humberto Delgado 30, 2560-272 Torres Vedras, Portugal · support@buildstackstudio.com · +351 639 297 540

Supervisory authority: CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt).