Privacy policy

This notice is for people who visit this website or email us from it. If we emailed you about your store, read the prospect privacy notice.

Who we are

Merchant Checkpoint is a trading name of Emanuel José Vargas Luís, Avenida do Atlântico 16, 14º, Escritório 8, 1990-019 Lisboa, Portugal. NIF PT233800263. Contact hello@merchantcheckpoint.com.

Why we use data

• Replying to emails you send, and sending a scan you asked for. Legal basis: GDPR Article 6(1)(b), because these are steps at your request, or Article 6(1)(f) where that does not apply.
• Cookieless site analytics. Legal basis: Article 6(1)(f). The interest is to see, in aggregate, which pages are used.
• Keeping unsubscribe records, so we can honour an opt out and comply with email marketing rules. Legal basis: Article 6(1)(f).

IP address and user agent

Cloudflare processes the IP address and user agent of each request to serve the site and for analytics. Its HTTP request logs call these fields ClientIP and ClientRequestUserAgent (Cloudflare's log fields). Cloudflare Web Analytics does not use cookies (Cloudflare's GDPR page).

How long we keep it

• If you never reply to us: we delete your data 90 days after our last email.
• If you reply, contact us, or ask for a scan, but do not become a customer: we keep those emails and the scan request for 24 months after our last contact with you.
• If you become a customer: we keep accounting records for 10 years, the period Portuguese law requires us to keep accounting books, records and supporting documents (Decreto-Lei n.º 28/2019, article 19(1)).
• Unsubscribe records are kept as long as needed to honour the opt out.
• Analytics are aggregate.

Who processes it

• Cloudflare, Inc., United States: website hosting and analytics, and it stores unsubscribe requests.
• ALWAYSDATA SARL, France: email hosting. It sends and receives our email.
• Anysphere, Inc., United States: Cursor, the platform our AI assistants run on. Those assistants read email and draft replies.

Transfers to the United States

• Cloudflare, Inc. is certified under the EU U.S. Data Privacy Framework. You can check that certification at dataprivacyframework.gov/participant/5666. Cloudflare's privacy policy says that if the certification lapses, it uses the European Commission's standard contractual clauses: cloudflare.com/privacypolicy.
• Anysphere, Inc. transfers rest on the European Commission's standard contractual clauses (Decision (EU) 2021/914), which are part of its data processing addendum at cursor.com/terms/dpa. This notice does not claim the Data Privacy Framework for Anysphere.

ALWAYSDATA SARL is in France, inside the European Union.

Your rights

You can ask to access, correct, or delete personal data we hold about you, to restrict its use, or to receive it in a portable form, and you can object to how we use it. Email hello@merchantcheckpoint.com. You can also complain to the Portuguese data protection authority, CNPD, at cnpd.pt.

Last updated 17 October 2026