What we do with your data.

To process orders, send order-related emails, improve the site, and meet tax obligations (Portuguese tax authority requires us to keep invoices for 10 years). If you have bought on Lavora before and leave pieces in your basket for more than a day, we send you a single reminder with those pieces, because you are already a customer. If you have not bought yet, we only send it if you ask for it at checkout. Also as a customer, we let you know at most once a week when a piece in your favourites drops in price or is running out. You can turn off each of these alerts in your account or in the email itself. Nothing else.

The producer fulfilling your order (name, address, phone if needed). Stripe (payments). The courier delivering the parcel, which receives the name, address, email and phone needed for delivery. When Lavora arranges the shipment, those details go through Eurosender (Luxembourg), which handles collection and tracking on the platform's behalf. We also rely on technical providers that process data on our behalf (subprocessors). They are Supabase (database and authentication), Vercel (site hosting and aggregate analytics), Cloudflare (anti-spam protection on forms), Upstash (request limits per IP address, against abuse), Zoho (sending emails), Google (address autocomplete and, in the mobile app, notifications through Firebase if you turn them on), OpenAI (search by description, the shopping assistant, content translation, and internal support for the team when reading applications and complaints), and PostHog (usage analytics, only with your consent). If you accept marketing cookies, Meta (Facebook and Instagram) receives the browsing data described in the cookie policy, so we can measure our ads. With the same consent, when you complete a purchase or submit a producer application, Lavora also sends that event to Meta from its servers, with your email and phone in an irreversibly encrypted form (hashed), the Meta cookie identifiers, your IP address and your browser. We never send your name or your address. We don't sell or swap data with third parties for marketing. With renewed marketing consent, OpenAI also receives public-page and product views and confirmed purchases for ChatGPT ad measurement, including the EUR amount, available ad/browser references and a SHA-256 email hash. See the cookie policy for fields, automatic matching and consent withdrawal.

Account data while your account exists. Order data for 10 years (tax obligation). Marketing data (newsletter) until you withdraw consent. A saved basket is deleted after 30 days without changes. Ad measurement data kept for a purchase (Meta cookie identifiers, IP and browser) is deleted when the event is sent to Meta, and after 8 days at most.

Email ola@lavora.pt, we reply within 30 days. To delete your account, go to /conta and use the "Delete account" button in the Profile section.