Short version: we collect very little, we don't sell your data, and the advertising pixel only runs if you say yes.
Who we are
Rico Mood is a brand of STRAVIA, Unipessoal Lda (NIPC 519206789), Viana do Castelo, Portugal — the data controller for this site, the newsletter and the delivery of your files. Full details in Legal information. Questions about your data: [email protected].
What we collect, and why
- When you buy. Paddle, our merchant of record, collects your email, country, payment details and whatever it needs for the invoice and for tax. Paddle is an independent controller for that data and has its own privacy policy (paddle.com/legal/privacy). We never see or store your card details. Paddle passes us your email address, the product bought and the order reference so that we can deliver the files and support you. Legal basis: performance of the contract (GDPR Article 6(1)(b)).
- When we deliver your files. Our delivery system stores your email, the product, a personal download link and the number of downloads used (up to 20 within 1 year), and sends the link by email through Resend, our transactional email provider (United States), under a data processing agreement that includes the EU standard contractual clauses. Legal basis: performance of the contract.
- Newsletter. Only your email address, with double opt-in: you get a confirmation email and nothing is sent until you click it. Every email has an unsubscribe link. Legal basis: your consent (GDPR Article 6(1)(a)). We use MailerLite to send it.
- Advertising cookies (only if you accept). The Meta pixel records the pages you view, when you start and complete a purchase (with its value), a browser identifier and your IP address, so we can measure our Facebook and Instagram ads and show ads to people who visited the site. Legal basis: your consent. Nothing loads before you accept, and you can change your mind at any time under “Cookies” in the footer.
- Hosting and security. The site runs on Cloudflare, which processes IP addresses and connection data in server logs to serve the pages and protect against attacks. Legal basis: our legitimate interest in running a secure website (GDPR Article 6(1)(f)).
- Email you send us. If you write to [email protected], we keep the exchange for as long as we need to help you and to keep a record of it.
How long we keep it
- Newsletter: until you unsubscribe (then MailerLite keeps a suppression record so we don't email you again).
- Purchase and delivery records: for as long as the download link is valid (1 year) and then for as long as Portuguese accounting and tax law requires (up to 10 years for billing records).
- Advertising cookies: _fbp for 3 months and _fbc for 3 months (only when you arrive through an ad). Your cookie choice is stored in your browser for 6 months.
Who we share it with
Only with the services we need to run Rico Mood: Paddle (payment, invoicing, tax — UK and US), MailerLite (newsletter — EU), Cloudflare (hosting — global network), Resend (transactional email with your download link — United States), and Meta Platforms Ireland Ltd. (advertising pixel, only with your consent; Meta may transfer data to the United States under the EU–U.S. Data Privacy Framework and the UK Extension). We do not sell your personal information, and we don't share it with anyone for their own marketing.
Your rights
Wherever you live, you can ask us to tell you what data we hold about you, correct it, delete it, give you a copy, or stop using it for marketing. Email [email protected]; we answer within one month, and we may ask you to confirm the email address the request is about. We won't treat you differently for exercising your rights.
- EU / EEA (GDPR): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. You can complain to the Portuguese data protection authority, CNPD (cnpd.pt), or to the authority in your own country.
- United Kingdom (UK GDPR): the same rights; you can complain to the ICO (ico.org.uk).
- California and other US states: the right to know, delete and correct, and to opt out of the sale or sharing of personal information. We don't sell personal information. The Meta pixel may count as “sharing” for cross-context behavioral advertising under California law; it only runs if you accept advertising cookies, and you can opt out at any time under “Cookies” in the footer.
- Australia (Privacy Act 1988): access and correction; complaints to the OAIC (oaic.gov.au).
- New Zealand (Privacy Act 2020): access and correction; complaints to the Office of the Privacy Commissioner (privacy.org.nz).
Cookies
Necessary cookies work without consent: your cookie choice (6 months), a local copy of the newsletter form to confirm your sign-up, and Paddle's cookies during checkout. Advertising cookies only work if you accept: Meta's _fbp (3 months) and _fbc (3 months, only when you arrive through an ad). Change your choice at any time under “Cookies” in the footer. We don't currently respond to browser “Do Not Track” signals; the cookie banner is the control.
Children
The site and the newsletter are not directed at children under 16, and we don't knowingly collect their data. If you think a child has given us data, email us and we'll delete it.
Changes
If we change this policy in a way that matters, we'll update the date below and, if you're on the newsletter, tell you by email.
Last updated: September 28, 2026.