Privacy Policy

This policy explains how we handle personal data on christmassweets.online (150 Christmas Cookie & Sweet Treat Recipes).

1. Who is responsible

The team responsible for this website decides how the data described here is handled. For questions and requests about your data, email [email protected].

2. What data we use and why

• Browsing: IP address, device and browser type, pages viewed, clicks on the purchase button, where the visit came from (campaign parameters such as utm and fbclid) and approximate location based on the network (country, region and city). We use it to measure ad results, understand interest in the product and protect the site from automated traffic.
• Purchase: when you buy, the payment platform (Hotmart) sends us the order details: product, amount, payment method, status, name, email and phone. We use them to record the sale, deliver access, provide support and meet legal obligations.
• Contact: the data you send us by email, to reply and handle your requests.

We do not ask for health information. Card details are entered only on the payment platform and never reach us.

3. Cookies and identifiers

We use cookies and browser storage for: the Meta Pixel (cookies _fbp and _fbc), which measures visits and purchases coming from ads on Facebook and Instagram; and our own visitor identifier (_tjk), which links a visit to a purchase so we know which ad led to the sale. You can delete or block cookies in your browser settings and adjust your ad preferences in your Meta account settings.

4. Who we share data with

• Meta (Facebook and Instagram): through the Pixel and the Conversions API we send events such as visit, page view, checkout start and purchase. Data such as email, phone, name and city is sent only in hashed form (SHA-256), so Meta can measure and optimize the ads.
• Payment platform (Hotmart): processes payment and delivery under its own privacy policy. The purchase link carries the campaign parameters and the visit identifier.
• Technology providers: website hosting (Cloudflare) and our measurement system (Vercel servers and Supabase database, in Brazil).

Your data may be processed outside your country, including in Brazil, with the safeguards required by applicable law. We do not sell your data.

5. Legal basis

Measuring and improving ads and protecting the site: legitimate interest. Recording the purchase and delivering the product: performance of a contract. Keeping payment records: legal obligation.

6. How long we keep data

Browsing events: up to 90 days (after that only daily counts remain, which identify no one). Payment notices with your data: up to 90 days. Visitors who did not buy: up to 180 days. Sales records (amounts and products) are kept for the period required by law; your contact details in them are stored only in hashed form.

7. Your rights

You can ask to access, correct, delete or port your data, object to its use and withdraw consent where consent is the basis. California residents can also ask what personal information we collected and request its deletion; we do not sell or share personal information for cross context behavioral advertising beyond the measurement described above. Email [email protected] with the email used for the purchase. We reply within 15 days. You may also file a complaint with your local data protection authority.

8. Security

We use encrypted connections (HTTPS), restricted access to data, encrypted storage of credentials and hashing of the data sent to Meta.

9. Changes

This policy may be updated. The date of the last update is shown at the top of the page.