Operational draft — pending legal review. This describes what we actually do with your data today, mapped to Brazil's LGPD. The controller's registration details and the appointed data protection officer are still to be filled in below.
Privacy Policy
Last updated 26 August 2026. Written to Brazil's Lei Geral de Proteção de Dados (Law 13.709/2018).
1 · Who controls your data
At Gangway, at Porto de Santos, São Paulo, Brazil, is the controller. Contact for anything on this page: help@atgangway.com.
Pending: CNPJ, registered address and the name of the appointed data protection officer (encarregado, LGPD art. 41).
2 · What we collect and why
Under the LGPD every piece of data needs a lawful basis. Here is ours, item by item — nothing is collected “just in case”.
| Data | Why | Legal basis |
|---|---|---|
| Name, e-mail, password | Your account and order history | Performance of the contract (art. 7, V) |
| Rank, vessel name, IMO, flag, nationality | Customs declaration for goods leaving Brazil as ship's stores. Without these the shipment cannot be cleared. | Legal and regulatory obligation (art. 7, II) |
| WhatsApp / telephone | Reaching you at the gangway. It is the only channel that works from a ship. | Performance of the contract (art. 7, V) |
| Home port | Which delivery grid applies to your order | Performance of the contract (art. 7, V) |
| Order contents, amounts, delivery photo | Fulfilling and proving delivery, tax records, and defending a dispute if one arises | Contract and legal obligation (art. 7, II and V) |
| Payment status and Stripe reference | Confirming payment and issuing refunds | Performance of the contract (art. 7, V) |
| Referral code and credit balance | Running the Captain programme you opted into | Consent (art. 7, I) |
| Wish list, recently viewed | Making the shop useful to you | Legitimate interest (art. 7, IX) |
We do not collect sensitive personal data as the LGPD defines it — health, religion, biometrics, union membership — and we ask you not to send any in an order note.
3 · Your card number
We never see it. Card details go straight to Stripe, which is PCI-DSS certified. What reaches us is whether the payment succeeded and a reference number.
4 · Who else processes it
- Brazilian customs (Receita Federal) and the accredited ship chandler — the declaration for on-board delivery. Legal obligation; we cannot deliver on board without it.
- Supabase — database and authentication, hosted in São Paulo (sa-east-1).
- Vercel — application hosting, served from São Paulo, company based in the United States.
- Stripe — payment processing, based in the United States and Ireland.
- Google — only if you choose to sign in with Google.
- Hostinger — the mail server that sends your order e-mails.
We do not sell your data, and we do not share it with advertisers.
5 · Data leaving Brazil
Your account and orders are stored in Brazil. Some of the processors above operate from outside it, so a limited transfer happens — LGPD article 33 allows this when it is necessary to perform the contract you asked for, which is the case here. Those processors are bound by their own contractual data-protection terms.
6 · How long we keep it
- Account data — while your account exists. Close it and we delete or anonymise, subject to the line below.
- Orders, invoices and customs declarations — five years, which is what Brazilian tax and customs rules require of us. This one we cannot delete on request.
- Delivery photos — two years, then deleted.
- Wish list and browsing preferences — until you clear them or close the account.
7 · Your rights
LGPD article 18 gives you the right to ask us, free of charge, to:
- confirm that we process your data, and give you access to it;
- correct anything incomplete, inaccurate or out of date;
- anonymise, block or delete data that is unnecessary, excessive, or processed outside the law;
- port your data to another provider, in a readable machine format;
- tell you who we have shared it with — the list in clause 4 is that answer, kept current;
- withdraw a consent you gave, at any time, without affecting what was lawful before you withdrew it;
- know what happens if you refuse to give a piece of data. For the customs fields, the honest answer is that we cannot deliver on board — but counter pickup and digital items stay open to you.
Write to help@atgangway.com and we answer within 15 days. Most of it you can also do yourself on your account page. If you are not satisfied, you may complain to the ANPD, Brazil's data protection authority.
8 · Cookies
- Session cookie — keeps you signed in. Strictly necessary; the site does not work without it.
- Cart — kept in your browser's local storage, not sent to us until you check out.
- We run no advertising or third-party tracking cookies. If that ever changes, we will ask for your consent first, and this page will say so before it happens.
9 · Security
Traffic is encrypted end to end. Passwords are hashed, never stored in readable form, and checked against known breach lists when you choose one. Access to order data is enforced at the database level, row by row, so one account cannot read another's. Delivery photos sit in private storage reachable only by you and our staff. If a breach ever affects you, we will tell you and the ANPD, as the law requires.
10 · Children
The store is for adults, and we do not knowingly collect data from anyone under 18. If you believe a minor has created an account, tell us and we will remove it.
11 · Changes
If we change how we handle your data in a way that matters, we update the date at the top and, when the change is significant, e-mail account holders before it takes effect. See also our Terms & Conditions.