Privacy policy

Provisional text, not yet reviewed by a lawyer. This content is a development skeleton and must not go live as a legal document of Café Canastra without a lawyer looking at it — in particular on data protection (LGPD), the right of withdrawal and the returns policy. This is a translation provided for convenience. The Portuguese version is the one that legally applies, and the purchase is governed by Brazilian law.

Who answers for your data

The controller of your data is Boaventura Cafés Especiais Ltda, Rua Nivaldo Guerreiro Nunes, 701, Distrito Industrial, Uberlândia, Minas Gerais, Brazil.

Data subject requests, questions or complaints about personal data: [email protected]. That is the address that answers.

What we collect

• Name, e-mail, CPF (the Brazilian taxpayer number) and phone — to issue the nota fiscal, the Brazilian tax invoice, and to talk to you about your order.
• Address — to quote shipping and to deliver. It is frozen inside the order, as a photograph of what was agreed that day.
• What you put in the bag — so the bag survives between visits and between devices.
• The reviews you publish, with the name you choose to display.
• Your e-mail, if you sign up for the newsletter in the footer.
• Pages viewed and purchase events in Google Analytics 4 — only after you accept in the cookie notice.

We do not ask for your date of birth and we do not store card numbers: the card fields belong to Mercado Pago, and the number never reaches our servers.

Why we collect it

Every piece of data has a reason, and the reason is what the law calls a legal basis:

• To carry out the purchase you asked for — that is the contract between us.
• To issue the invoice and keep what Brazilian tax law requires us to keep — that is a legal obligation.
• To send news by e-mail and to measure use of the site — that is consent, and you can withdraw it.
• To prevent fraud and keep the store safe — that is the store's legitimate interest.

Withdrawing consent for e-mail does not affect your purchases, and it takes effect immediately. Use the form below.

If you delete your account, that e-mail leaves the list along with it — you do not have to ask for both.

Who we share it with

• Mercado Pago — payment for the order and the recurring charge of the Clube.
• Melhor Envio and the carriers — shipping quotes and delivery.
• Resend — sending the order status e-mails.
• Bling — registering the contact and issuing the nota fiscal for the order.
• Google Analytics 4 — usage measurement, only if you accept in the cookie notice.

We do not sell your data to anyone. Beyond those five, we only hand personal data to an authority when there is a legal order requiring it.

Data that leaves Brazil

Two of those services are run by companies outside Brazil: Resend, which sends the e-mails, and Google, which does the measurement.

When you receive an e-mail from us, or when you accept measurement, that data is processed outside the country. This is what the law calls an international transfer, and telling you about it is a duty under the LGPD, Brazil's data protection law.

Where the data lives

The account and the store's database live on our own server, with a self-hosted Supabase — not on a third-party database service.

Your password never reaches us: login is handled by GoTrue, and what is stored is a cryptographic digest, not the password.

Cookies and measurement

We use the cookies needed to keep you signed in and to hold your bag. Without them the store does not work, which is why they are not a choice.

Measurement cookies only load if you accept them in the notice that appears on your first visit.

Changed your mind? Review cookies — the notice comes back and measurement stops immediately. Your session and your bag keep working.

Security

The admin panel and the routes that read personal data require a login and administrator permission.

Card numbers do not pass through here, and the password is kept only as a cryptographic digest.

No system is impregnable. If there is a security incident with relevant risk to you, we notify you and the ANPD.

How long we keep it

• Account and registration: for as long as the account exists. You close it whenever you want.
• Order and nota fiscal: for the legal tax retention period, even after the account is closed — but without your name, CPF, e-mail and address, which are erased from the order.
• Clube subscription: cancelled the moment the account is closed, with no penalty.
• Newsletter: until you leave the list.
• Published review: it stays on the site, signed as Cliente Canastra, without your name.

Your rights

The LGPD — Lei Geral de Proteção de Dados, Brazil's data protection law — gives you a set of rights over your data. Below is where each one is exercised, and the difference between clicking and asking matters.

You do this on your own, right now:

• Erase your personal data and close the account — sign in to your account and use Close my account, at the bottom of the page. No request, no waiting.
• Leave the newsletter — the form in the Why we collect it section, above.
• Review your cookie consent — the Review cookies button, in the Cookies section.

You ask by e-mail, and we answer within 15 days:

• A copy of everything the store keeps about you, as a file — the right of access and the right to portability, served at once.
• Correction of your name, CPF, phone or address.
• Erasure of your data from past orders without closing the account.
• Knowing who we share data with, and what happens if you do not consent.
• Objecting to a specific processing activity.

Some data stays even after an erasure request, where there is a tax obligation: the nota fiscal has a legal retention period.

Children and adolescents

Buying here means entering into a contract, which is why the store is for people over 18.

We do not knowingly collect children's data. If that has happened, write to the address above and we will erase it.

Changes to this policy

When this policy changes, the date at the top changes with it.

A change that widens the use of your data only takes effect after you consent again.

Contact and the ANPD

Talk to us at [email protected] or +55 (34) 3226-2600.

You can also take a complaint about personal data to the ANPD, the Autoridade Nacional de Proteção de Dados — Brazil's national data protection authority.