Privacy and cookies
Version 1.0 · 18 October 2026
This policy explains what personal data we handle when you use faja.surf or order from Fajã Surf Labs, why, and what your rights are under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Portuguese Lei n.º 58/2019.
In short. This site has no accounts, no sign-up, no payment forms, no advertising and no analytics. It sets no cookies. Your contact with us happens on WhatsApp, Instagram or in person, and that is where we receive personal data. We keep it only to build, repair or teach what you asked for, and to meet our tax and accounting duties.
1. Who is responsible
The data controller is Sculpted Chronicles, Lda, NIPC 519412443, Avenida Marcos Marques Rosa, n.º 100 – Fajã da Areia Pico, 9240-040 São Vicente, Madeira, Portugal. You can reach us at fajasurflabs@gmail.com, on WhatsApp at +351 919 100 811 or through the Contact page. We have not appointed a data protection officer; the law does not require one for what we do.
2. Visiting the website
2.1 Server logs
The site is a static website hosted by Vercel Inc. (USA). When your browser requests a page, Vercel's servers process your IP address, the page requested, the time, and your browser's user-agent string, as every web server does, to deliver the page and protect the service against abuse. Vercel keeps these request logs for a short period. Legal basis: our legitimate interest in running a secure website (art. 6(1)(f) GDPR). Vercel acts as our processor under its Data Processing Agreement, with the EU Standard Contractual Clauses for transfers outside the EU and the EU–US Data Privacy Framework, to which Vercel is certified.
2.2 Cookies and local storage
We set no cookies, neither our own nor third parties'. We use no analytics, no tag managers and no advertising pixels, so there is no cookie banner because there is nothing to consent to.
Two tools keep a small amount of data in your own browser (local storage), never sent to us:
- the board configurator saves the board you are designing so that it is still there when you come back;
- ShaperLab Lite and the other free tools may save your last settings.
This storage is strictly necessary for the function you asked for. You can clear it at any time in your browser's site-data settings.
2.3 Fonts, videos and images
Fonts, videos and images are served from our own site or our hosting, not from Google Fonts, YouTube or other third parties, so no data is sent to them when you load a page.
2.4 Links to WhatsApp and Instagram
Buttons such as "Order on WhatsApp" open a link to WhatsApp (Meta Platforms Ireland Ltd) or Instagram. Nothing is sent until you choose to click. Once you are in those apps, their own privacy policies apply: WhatsApp · Instagram.
3. When you contact or order from us
When you write to us on WhatsApp, Instagram, e-mail or in person, we receive what you send: your name and phone number or handle, your messages, and, for an order, the details needed to build it, such as your height, weight, surfing level, the board specification, photos of a board to repair, and for delivery your address.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Answering your questions and quoting | name, contact, your messages | pre-contractual steps at your request (art. 6(1)(b)) | until the enquiry is closed, at most 12 months |
| Building, repairing or delivering what you ordered; running a workshop you booked | name, contact, order details, rider data, delivery address | performance of the contract (art. 6(1)(b)) | the life of the order plus the legal warranty period (3 years for goods) |
| Invoices and accounting | name, tax number if you give one, address, amounts | legal obligation (art. 6(1)(c); Portuguese tax and accounting law) | 10 years, as Portuguese law requires |
| Keeping your board's design file so we can rebuild or repair it later | board specification, your name | our legitimate interest and yours (art. 6(1)(f)) | until you ask us to delete it |
| Photos of your finished board on our Instagram or website | photos, your first name if you agree | your consent (art. 6(1)(a)); you may withdraw it at any time | until you withdraw consent |
We do not use your data for marketing, do not sell it, and make no automated decisions about you.
4. Who else sees your data
- Vercel Inc., hosting (see 2.1).
- Meta Platforms Ireland Ltd, as the operator of WhatsApp and Instagram, when you contact us there. Meta is an independent controller for its own services.
- Google Ireland Ltd, as the provider of the Gmail mailbox we read your e-mails in (processor).
- Our accountant and invoicing software provider in Portugal, for invoices (processors).
- Carriers, when a board is shipped to you (independent controllers).
- Public authorities, when the law requires it, for example the Autoridade Tributária.
We do not transfer your data outside the EU other than through Vercel and Meta as described above.
5. Your rights
You have the right to access the data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent you gave, all without affecting the lawfulness of what was done before. Write to fajasurflabs@gmail.com or on WhatsApp; we answer within one month.
If you believe we handle your data unlawfully you may complain to the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa · www.cnpd.pt.
6. Security
The site is served only over HTTPS. Our order records live on devices and accounts protected by passwords and two-factor authentication, and only the people who need them to build your board have access.
7. Children
Our services are for adults. We do not knowingly collect data from anyone under 16; a parent or guardian orders on their behalf.
8. Changes
When we change this policy we update the version and date at the top. The current version is always at faja.surf/legal/privacy.