Privacy policy

1. Who the controller is and how to reach them

The controller, meaning whoever decides how the data processed on this site is used, is Abasse Crystal. Contact for anything about privacy: WhatsApp +18624596366.

2. Data protection officer and communication channel (LGPD art. 41)

Communication channel with data subjects: WhatsApp +18624596366.

This contact receives complaints and communications from data subjects, provides clarifications and takes action.

3. What data we process

• Browsing: the site needs no sign-up or visitor account. We do not use advertising cookies, audience-analytics cookies or third-party trackers.
• Click counter: when you tap a contact button (WhatsApp, SMS or email) or scan a piece’s QR code, we record only a random reference code, which button was used, the page, the piece, the language and the date and time. We do not store your IP address, device, browser or anything that identifies you.
• Storage in your browser: we only keep your language choice (cookie “NEXT_LOCALE”, for up to 1 year) so the site opens in the language you picked. It is a functional cookie with no tracking purpose. The administration area uses a session cookie that exists only for the shop’s staff.
• Contact and orders: if you reach us by WhatsApp, SMS or email, we process what you send (name, phone, email, messages). To complete a purchase we also record the delivery address, payment method, tracking code, order notes and, if any, photos of what was shipped.
• Newsletter: if you sign up on the site to be notified about new pieces or promotions, we keep your email address and the language of the site version you signed up on. We use it only to send those notifications, when the admin decides to send one. You can unsubscribe at any time, free of charge, through the link in the footer of every email you receive.
• Technical logs: the site’s hosting provider may log your IP address and access data for security and operation. We only access those logs as far as operating the site requires.

4. Data we need in order to sell to you

To handle and deliver an order we need data such as your name, a contact and the delivery address. Without it we cannot complete the purchase or ship the piece. You can exercise the rights described below at any time, through the contact given in this policy.

5. Why we use it and on what legal basis (LGPD art. 7; GDPR art. 6)

• To answer your contact and complete your purchase, including payment and shipping: performance of a contract and pre-contractual steps at your request (LGPD art. 7, V; GDPR art. 6(1)(b)).
• To meet legal and tax obligations tied to sales (LGPD art. 7, II; GDPR art. 6(1)(c)).
• To measure, in aggregate and anonymously, which buttons and pieces draw interest, so we can improve the catalogue, and to keep the site secure: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)), respecting your rights and freedoms.
• To exercise rights in judicial, administrative or arbitration proceedings when needed (LGPD art. 7, VI).
• To send newsletter emails to those who sign up for them: consent (LGPD art. 7, I; GDPR art. 6(1)(a)), which you may withdraw at any time, free of charge, through the unsubscribe link in each email or the contact in this policy (LGPD art. 8, § 5).

6. Who we share it with, why, and who is responsible for what

We share data only when needed to run the business, and only the minimum, each for its own purpose:

• Carriers and postal services, to deliver the order (name, address and contact phone). They process the data as independent controllers, for the delivery.
• The payment methods you choose (for example Pix, PayPal, Wise or Stripe), to process the payment. They are also independent controllers, governed by their own policies.
• Technology providers that host the site and the database. They act as processors: they process data on our behalf and under our instructions.
• WhatsApp (Meta), when you contact us there: the conversation is then also covered by their privacy policy.

7. Transfers outside Brazil (LGPD art. 33)

Some providers (hosting, database, payment) may process data outside Brazil. When that happens, the transfer follows one of the cases of art. 33 of the LGPD, such as standard contractual clauses or the need to perform the contract you are party to. For visitors in the European Union, the GDPR transfer rules also apply.

8. Prices and the dollar exchange rate

Prices are set in US dollars. On the Portuguese version we show the conversion to reais at the day’s rate (the Brazilian Central Bank’s PTAX, with a market rate as a fallback). The rate lookup is made by our servers; your browser does not connect to any third-party service because of it.

9. How long we keep it (LGPD arts. 15 and 16)

Click-counter data does not identify anyone. Customer and order data is kept for as long as needed for service, warranty, legal and tax obligations (generally up to 5 years) and to defend ourselves in possible proceedings, then deleted or anonymised. You can ask for deletion sooner, except for data the law requires us to keep (LGPD art. 16, I).

10. Your rights (LGPD art. 18)

You have the right to obtain from us, at any time and on request:

• confirmation that we process your data;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• portability of the data to another service or product provider, on express request and according to the ANPD’s regulations;
• deletion of data processed on the basis of your consent, except in the cases of art. 16;
• information about the public and private entities we have shared data with;
• information about the possibility of not giving consent and the consequences of refusing;
• withdrawal of consent.
• Visitors in the European Union also have the GDPR rights of access, rectification, erasure, restriction, portability and objection.

11. How to exercise your rights

Send an express request to WhatsApp +18624596366 saying what you want; you may act through a legally appointed representative. It is free of charge.

Confirmation that we process your data and access to it: in a simplified format, immediately; or by a clear and complete statement (origin of the data, criteria and purpose of the processing) within 15 days of the request (LGPD art. 19).

If we cannot act immediately, we will tell you that we are not the processing agent for that data (pointing to who is, where possible) or the factual or legal reasons that prevent it (art. 18, § 4). When we correct, delete, anonymise or block data, we will inform the parties we shared it with, unless that is impossible or takes disproportionate effort (art. 18, § 6).

You may also lodge a complaint against us with Brazil’s data protection authority (ANPD) and with consumer protection bodies (art. 18, §§ 1 and 8) and, if you are in the European Union, with your country’s data protection authority.

12. Children and teenagers (LGPD art. 14)

The site is not aimed at children. Processing a child’s data requires the specific and prominent consent of at least one parent or legal guardian. If we learn of a child’s data collected without that consent, we will delete it.

13. Security and incidents (LGPD arts. 46 and 48)

We use technical and administrative measures to protect data against unauthorised access and accidental or unlawful destruction, loss, alteration or disclosure: restricted access to the administration area with a password and re-confirmation for sensitive actions; encrypted connections (HTTPS); a log of changes made in the panel; and deletion of customers’ personal data on request. No system is completely secure, but we work to reduce risk.

If a security incident occurs that may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected people within a reasonable time, describing the data involved, the risks and the measures taken (art. 48).

14. Changes to this policy

We may update this policy when the site changes or the law requires. The date of the last update is shown at the top of this page. If the purpose of a processing changes in a way that is incompatible with what we told you, we will tell you beforehand.