Privacy Policy

1. Data controller

Tidemove Lda. (in incorporation), operating at tidemove.com, is the data controller for personal data collected through this website.

2. Data we collect

We collect what you send us, plus what an order needs. Card details never reach this site or our servers — checkout runs on Shopify and payment is handled by their payment providers.

• —Contact form — first and last name, email address, optional phone number, enquiry topic and your message. We also record which page the enquiry came from, so we know what you were looking at.
• —Newsletter — email address.
• —WhatsApp — if you use the WhatsApp button, your message and phone number are processed by WhatsApp Ireland Ltd. under their own privacy policy, not ours.
• —Anti-spam — Cloudflare Turnstile receives your IP address and a challenge token to confirm you are not a bot. Your IP address is also held briefly in memory to rate-limit repeated submissions.
• —Analytics — browsing behaviour, only after you consent (see section 5).
• —Orders — if you buy from the catalogue, Shopify processes your name, delivery and billing address, email, phone number and order contents on our behalf, and shares them back with us so we can fulfil and support the order. Card data is handled by Shopify's payment providers; we never see or store it.

3. Legal basis (GDPR)

• —Legitimate interest — answering an enquiry you sent us, preventing spam and abuse, and keeping the website secure.
• —Consent — analytics and advertising cookies, and marketing emails. You can withdraw consent at any time.

4. Processors we share data with

We do not sell your data and we do not share it for third-party advertising.

• —Shopify (Shopify International Ltd., Ireland) — our store platform: the product catalogue, the hosted checkout, payment processing and order records.
• —Resend (Plus Five Five, Inc., USA) — delivers contact form notifications to us and the confirmation email to you. Transfers rely on the EU–US Data Privacy Framework and standard contractual clauses.
• —Vercel (USA) — website hosting and privacy-friendly, cookieless analytics.
• —Cloudflare (USA) — Turnstile bot protection.
• —Google (Ireland/USA) — Tag Manager and Analytics 4, only after you consent.
• —Neon (EU region) — the database behind our editorial content. It holds no customer data.

5. Cookies and consent

Analytics and advertising tags are governed by Google Consent Mode v2 and start in the denied state. Nothing is set until you choose “Accept” in the banner. Your choice is stored in a first-party cookie (tm_consent) for six months. If you choose “Reject”, no analytics or advertising cookies are written. Vercel Analytics is cookieless and does not identify you.

6. Data retention

Contact enquiries and the emails they generate are kept for 24 months so we can follow up on a quote, then deleted. Newsletter subscriptions are kept until you unsubscribe. Analytics data is retained by Google for up to 14 months. Rate-limiting records are held in memory for 10 minutes and never written to disk.

7. Your rights

Under the GDPR (Regulamento Geral sobre a Proteção de Dados) you have the right to access, rectify, erase, restrict and port your data, and to object to processing. Contact contact form to exercise these rights. You may also complain to the Comissão Nacional de Proteção de Dados (CNPD).

8. Contact

Questions or requests: contact form