Privacy policy

Last updated: 17 October 2026

Anna Lucas Maia Art ("we", "us") runs this online shop, hosted by Shopify. This policy explains what personal information we collect when you visit, buy from us or join the Mail Club, and how we use it.

What we collect

Contact and delivery details: name, email, phone (if given), billing and shipping address.
Order details: what you bought, delivery choice, order history and messages you send us.
Payment: payments are processed by Shopify Payments and its partners. We never see or store your full card details.
Device and usage data: IP address, browser and pages viewed, collected through cookies so the shop works and, only with your consent, for statistics and marketing.

Why we use it

To process, post and support your orders and Mail Club subscription (performance of a contract).
To keep accounting records (legal obligation).
To send you news and offers only if you signed up; you can unsubscribe at any time from any email (consent).
To keep the shop secure and prevent fraud (legitimate interest).

Who we share it with

Only with the services needed to run the shop: Shopify (hosting, checkout, payments), CTT Correios de Portugal (delivery), our accountant (bookkeeping) and email tools used to send Mail Club or order messages. We do not sell your personal information.

Shopify

Shopify processes data to provide the shop and checkout. See the Shopify Consumer Privacy Policy and the Shopify Privacy Portal. Where data leaves the European Economic Area, Shopify relies on approved safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

Order and invoice records are kept for as long as Portuguese accounting law requires. Newsletter data is kept until you unsubscribe. Other data is deleted when no longer needed.

Your rights

Under the GDPR you can ask to access, correct, delete or receive a copy of your data, object to or restrict its use, and withdraw consent at any time. Email site@annalucasmaia.com. You can also complain to the Portuguese data protection authority, the CNPD, or the authority in your own EU country.