Privacy Policy

Updated 27 October 2026

Your route and credencial are personal. We use them to make your poster, and treat them with care.

Who is responsible

Ultreia Keepsakes is operated by Rafael Sivelli de Miranda, at Rua Joaquim Mariz 172, 2.º Direito, 4740-405 Fão, Esposende, Portugal. This seller is the data controller. Contact [email protected] about your data.

What we need, and why

We process your contact and order details, GPX, credencial photos, names, dates, dedication and proof correspondence to fulfil your order or answer your request. Invoice records meet legal obligations. Payment details are handled by Stripe when you choose its checkout; we do not receive your full card number.

Please crop out unrelated information. If giving a gift, have permission to share the pilgrim’s files. Your material is never published or used for marketing without separate permission, which you can withdraw.

Who handles it

Only providers needed for hosting, payment, email, file handling, printing and delivery receive relevant information. A printer needs the approved artwork; a carrier needs delivery details, not your GPX.

Cloudflare hosts this site and the private order pages, stores order details in D1 and uploaded files in a private R2 bucket, and may process request metadata such as IP addresses for delivery and security. Stripe processes payment and fraud-prevention information at checkout under its own privacy terms.

Other providers and international transfer safeguards: Google (Gmail, for replies), Resend or Brevo (transactional order emails; the active provider is confirmed on request), Anthropic (Claude, for AI-assisted detection of stamps in your credencial photos, reviewed by a person), Printful (printing and shipping from EU facilities) and the carriers that deliver your order. Where a provider transfers data outside the EEA (for example Google, Cloudflare, Anthropic or Stripe in the United States), it relies on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

How long we keep it

We delete your GPX, photos, artwork and working copies within 30 days after delivery, including copies held for us by file-handling providers. Download and save your final PDF before then. Separately, invoices and order records are kept for the period required by Portuguese tax law (generally 10 years). If a dispute requires limited evidence to be kept longer, we explain what and why.

If you never submit your files, unfinished uploads and personal order details are deleted 90 days after payment, after a final reminder. Email Rafael if you need more time.

Your choices and rights

You may request access, correction, deletion, restriction, portability or object where applicable. Email us; we normally respond within one month. You may complain to Portugal’s CNPD or your local data protection authority. Read more about your EU data rights.

Cookies and tracking

This site sets no analytics or advertising cookies and includes no trackers, embedded social feeds or external fonts. The Stripe checkout has its own privacy policy.