Privacy Policy

1. Who processes your data

The data controller for data collected through this site is David Cruz, carrying out the Astromidnight activity as a sole trader, based in São Pedro da Gafanhoeira, Alentejo, Portugal (Tax ID: 205254128). For any question about your data, write to info@astromidnight.pt.

2. What data we collect and why

• Contact forms (general contact and rural stays): name, email and the message text, so we can reply to you.
• Session bookings: name, email and other data you fill in on the booking engine, to organize and confirm the session.
• Shop purchases: delivery and payment data, collected and processed directly by the external checkout platform — it doesn't pass through our servers or get stored by us.

3. Who we share data with

We use the following third-party services to run the site and our services:

• Web3Forms — processes and forwards contact-form messages by email.
• Cal.com / Cal.eu — booking engine and calendar; handles the data you fill in when booking a session.
• Supabase — stores the list of prints available in the shop (doesn't collect personal data while browsing).
• meteoblue — weather forecast widget embedded on the site.
• Google Analytics (Google Ireland Limited) — site usage statistics, only after you accept the cookie notice.

Each of these services has its own privacy policy, which applies to the data they process on Astromidnight's behalf. We do not sell or share your data with third parties for marketing purposes.

4. Cookies

We use Google Analytics to understand how the site is used (pages visited, where visits come from, aggregated data) — but only after you accept the cookie notice on your first visit; if you reject or ignore the notice, Google Analytics never loads. IPs are anonymized. You can change your mind at any time under "Manage cookies", in the site footer. More details in Google's privacy policy.

The booking engine (Cal.com/Cal.eu) and the weather widget (meteoblue), embedded on some pages, are essential to the site's operation and always load — they may set their own cookies when you use them, and we have no direct control over them.

5. Legal basis and retention period

We process your data based on the performance of a contract (when you book a session or buy a print) or on your consent (when you write to us on your own initiative). We keep contact and booking data for as long as necessary to provide the service and comply with tax obligations, and delete or anonymize it afterwards.

6. Your rights

Under the GDPR, you have the right to access, rectify, erase or restrict the processing of your data, to request its portability, and to object to processing. To exercise any of these rights, write to info@astromidnight.pt. You also have the right to file a complaint with Portugal's National Data Protection Authority (cnpd.pt).

7. Security

We take reasonable measures to protect the data we process directly, but no transmission over the internet is 100% secure. We recommend not sharing sensitive data (such as payment card details) by email or through the contact form.

8. Minors

This site is not directed at minors under 16 for the purposes of directly collecting data. Sessions involving minors must be booked by a responsible adult.

9. Changes to this policy

We may update this policy periodically. The version in force is always the one published on this page, with the update date shown at the top.