This site is a catalog of authentic, legally imported pieces. There is no payment on the site and no account to create. No page asks for your name, email address or phone number.
The only personal data involved are the technical access records any website creates, a cookie that remembers the language the page was shown in, a record of whether you consented to measurement, whatever message you choose to send by WhatsApp or email, and site-usage measurement that does not identify you — cookie-based only if you give your consent; cookieless in aggregate, writing nothing to your browser. When a client agrees to be quoted, her testimonial — her name, city and state — appears on the site as well, published only with her recorded consent.
There are no advertising pixels, no trackers across other sites, and we never sell, rent or trade personal data.
Who answers for this policy
The controller of the data described here is Aura Chic Importados, which is responsible for the catalog published at aurachic.store and for the conversations that come out of it.
The communication channel for anything to do with personal data is the email address suyannemelexenko@gmail.com. Requests under article 18 of Law 13.709/2018 go there, along with questions about this policy and complaints, and the answer comes back from there.
Aura Chic is a small processing agent. Article 11 of CD/ANPD Resolution No. 2 of 27 January 2022 exempts a small processing agent from appointing a data protection officer, and none has been appointed. The role set out in article 41, paragraph 2, item I of the LGPD — receiving communications from data subjects and from Brazil’s data protection authority — is performed by the email address above.
What this site does not do
There is no checkout, no payment processing and no customer account to log into. No page has a sign-up form, a newsletter box or a contact form.
The database holds the catalog — pieces, brands, categories, images, and the price research behind our reference prices — along with client testimonials published only with each author’s recorded consent, and the short list of staff addresses allowed into the admin console. It holds no record of who visits.
Cookie-based audience measurement is loaded only if you explicitly choose to accept it — until then, nothing from PostHog is loaded or written. We also use two cookieless measurements: Ahrefs, which counts visits in aggregate, writing nothing to your browser and creating no visitor identifier — which is why your browser fetches that one script from Ahrefs’ domain on every visit — and two measurements by Vercel itself, which hosts the site: Speed Insights, which measures how long each page took to appear on your device and sends only that timing, in aggregate, to the site’s own address; and Web Analytics, which counts visits and page views (page address, referring page, country, device type and browser) without a cookie — each visit is recognized by a code derived from the request itself, which expires on its own within 24 hours and cannot follow you across days or across sites. Whatever you type into the catalog search is removed from the address before anything is sent. Beyond that, images and fonts are served from the site’s own address, and the only other outbound connections are the external links you choose to click, like WhatsApp or Instagram.
Technical access records
The site is delivered by Vercel, and the catalog and images live on Supabase. Like any hosting service, both keep records of the requests they receive. Those records usually hold the originating IP address, the date and time, the address of the page requested, the browser and system the device reports, and the referring page where there is one.
An IP address is personal data under the LGPD, which is why these records belong in this policy. They come from the infrastructure itself, they exist to deliver the page, keep the service up and contain abuse, and they are not used to build a profile of anyone. We do not export them, we do not cross-reference them with anything, and we keep no copy of our own.
Catalog filters and whatever you type into the search box travel in the page address, so they turn up in these records as well. They say which brand, category or price range someone filtered by, or what someone searched for. They do not say who.
Cookies and local storage
This site uses very little storage in your browser. By default, it writes only two technical records: one to remember your language and one to remember whether you agreed to measurement. We use no advertising cookies, and nothing here follows you across other sites.
If you choose to accept measurement, PostHog writes an anonymous identifier so we can tell visits apart. If you decline or make no choice, no measurement cookie is written, no script is downloaded from PostHog, and your browser makes no request to their servers.
PostHog’s measurement tool only writes cookies and local data if you tap “Accept.” If you decline, or simply don’t answer, nothing is sent to PostHog and no measurement file is created. When you do accept, alongside the pages you open and what you search for, we record: the approximate location of your connection (country, state and city — your IP address is used for that alone, at the moment of the visit, and discarded straight afterwards, never stored); your device type, system, browser and the language it asks for; and, if you arrived through a campaign link or from another site, where that link came from. None of it identifies you: it is all tied to a random number, never to your name, phone or email.
NEXT_LOCALE (cookie): written by the site to remember whether to show pages in Portuguese or English. Discarded when you close the browser. Essential for navigation; does not require consent.
admin-locale (cookie): written when someone taps the language switch in the site’s admin area, including on the staff sign-in page, to remember the language shown there (Portuguese or English). Sent only on /admin addresses, never on the shop pages, and expires after 365 days. A technical language preference; does not require consent.
ac:cookie-consent (local storage): written by the consent banner or the controls on this page to record whether you accepted or declined measurement, along with the date. Stored until you change or clear it, so the banner does not ask on every visit. Does not require consent.
aurachic.cart.v1 (local storage): written when you add a piece to your bag, so your picks are waiting for you even if you come back another day. It stays on your device until you remove them yourself or clear your browser data, and it never reaches us. Essential to a feature you chose to use; does not require consent.
ph_<token>_posthog (cookie and local storage): written only if you click accept. Holds a random anonymous visitor ID and session ID — no name, email or phone number. The cookie expires in 365 days; local storage remains until you clear it or decline measurement. Requires your consent.
__ph_opt_in_out_<token> (local storage): PostHog’s own note of whether capture is switched on, written when you change your choice — accepting again after a decline, for instance. The site deletes it whenever you decline. Requires your consent.
ph_<token>_window_id, ph_<token>_primary_window_exists and ph_<token>_session_registered_properties (session storage): written only if you accept measurement, so PostHog can tell which browser tab a visit belongs to. Limited to that tab and cleared the moment you close it. Requires your consent.
Cookie policy
In line with guidance from Brazil’s National Data Protection Authority (ANPD), here is what you need to know about cookies on this site. We use two kinds of storage: strictly necessary items that make the site work — a cookie that remembers your language, a local storage key for your consent choice, and another that keeps your bag exactly as you left it — and optional audience measurement from PostHog, which only loads once you accept it and writes a cookie plus a couple of tab-only entries.
Necessary storage is used to display pages in your preferred language, to remember your measurement choice without re-prompting on every page, and to keep the pieces in your bag from one visit to the next. The optional measurement storage lets PostHog record how the shop is used — which pieces draw attention, what people search for — under a random identifier, to help us improve it. The language cookie vanishes when your browser closes; the consent choice and your bag stay until you clear them yourself; the measurement cookie expires after 365 days, its tab-only entries disappear when you close the tab, and events are retained for up to one year.
You can manage your preferences at any time in the “Your cookie preferences” section just below, where you can accept, decline, or reset your measurement choice. You can also block or clear cookies directly in your browser settings.
Your current measurement preference is shown below. You can change your choice here at any time.
Selecting decline immediately stops measurement, disables future tracking, and removes all PostHog cookies and storage from your browser. Choosing “Ask me again” clears your preference so the consent dialog appears again. Withdrawing consent does not undo processing already carried out (article 8, paragraph 5 of Law 13.709/2018) — a measurement recorded moments before you declined may still complete its delivery.
The messages you choose to send
The contact buttons on this site send nothing. The WhatsApp one opens a conversation in your own app with the text already typed; the email one opens your own mail program with the subject filled in. Either way you are the sender, from your own device, and you can rewrite or delete the text before it goes. The site does not see, copy or store what you wrote.
Once a message arrives we have what you sent: the content of the conversation and whatever the channel shows about the sender, meaning the number and profile name on WhatsApp, or the address and name on email. We use it to reply, to say whether the piece is available, and to arrange the sale.
WhatsApp is operated by Meta, and your email by whichever provider you chose. The conversation happens inside those services, under their privacy policies, which are not ours.
Purposes and legal bases
Each kind of processing described above has a purpose and a legal basis under article 7 of Law 13.709/2018:
Technical access records, to deliver pages, keep the service available and contain abuse. Legal basis: legitimate interest, item IX.
The language cookie, to display pages in the requested language. It is a technical cookie, necessary for the site to work. Legal basis: legitimate interest, item IX.
The consent record, to remember your choice about measurement and avoid asking repeatedly. Legal basis: legitimate interest, item IX.
Audience measurement, to understand which pieces draw interest, what visitors search for, which part of the country they visit from, what device they browse on and how they found the site — all of it to improve the catalog and to know where it is worth showing up. Cookie-based measurement (PostHog) is carried out solely with your prior permission, which you can withdraw at any time — legal basis: consent, article 7, item I. The cookieless measurements (Ahrefs and Vercel Web Analytics for audience, Vercel Speed Insights for page-load speed) are aggregate, do not identify you and write nothing to your browser — legal basis: legitimate interest, article 7, item IX.
A client’s testimonial — her name, city, state and words — published on the site so future clients can hear from someone who has already bought. Legal basis: consent, item I; nothing is published without it, and it can be withdrawn at any time.
WhatsApp and email messages, to reply to your questions and carry the conversation that may lead to a purchase. Legal basis: preliminary steps towards a contract, at the data subject’s request, item V. Once a purchase is agreed, the basis becomes performance of that contract under the same item.
Legal or regulatory obligations, item II, where the law requires records to be kept, such as tax receipts for completed sales.
Who else these data reach
We do not sell, rent or trade personal data with anyone. No advertising networks or data brokers are connected to this site.
We use service providers who act as processors under article 5, item VII of the LGPD: Vercel, which hosts and delivers the site and measures, without cookies, how fast its pages appear and how often they are viewed; Supabase, which stores the catalog and images; PostHog Inc., which provides cookie-based audience measurement only if you have consented to it; and Ahrefs Pte. Ltd., which provides cookieless measurement, receiving aggregate visit data with no visitor identifier and writing nothing to your browser.
Beyond these service providers, data is disclosed only when required by law or by an order from a competent public authority.
Processing outside Brazil
The Vercel and Supabase infrastructure serving this site sits outside Brazil, so technical access records are processed abroad. Under the LGPD, this is an international data transfer. The legal basis is article 33, item IX read with article 7, item V: the transfer is necessary to deliver the page you requested.
If you accept audience measurement, usage events tied to a random identifier — no name, email or phone number — are processed by PostHog Inc. in the United States. The legal basis for this transfer is your specific and highlighted consent, given after notice of the international nature of the processing, under article 33, item VIII of Law 13.709/2018.
If you want to know more about the safeguards surrounding these transfers, write to suyannemelexenko@gmail.com and we will share the details we have.
Messages you send by WhatsApp or email also travel through international infrastructure managed by Meta and your email provider, under their respective privacy policies.
How long each thing is kept
Technical access records: held by Vercel and Supabase for the duration defined in their respective retention policies. We do not configure these logs and keep no separate copy.
Part of that retention is required by law: article 15 of Law 12.965/2014 (Marco Civil da Internet) requires application access logs to be stored for six months. Deletion requests during this window may be refused on that basis alone, under article 16, item I of Law 13.709/2018 (compliance with a legal obligation).
The language cookie: discarded when you close your browser, or sooner if you clear cookies.
The consent record: stored in your browser’s local storage until you change your preference or clear site data.
Measurement data: if you accept measurement, the PostHog cookie is kept for 365 days, and the events are stored by PostHog for up to one year before being automatically deleted.
Messages: kept in our email inbox and WhatsApp account for as long as they are relevant to customer inquiries and purchase history. You may ask us to delete them at any time, except for records we must retain by law under article 16 of the LGPD.
Security
The site is served over HTTPS only, with HSTS, and sends security headers that prevent pages from being embedded in other domains and block MIME-type sniffing.
Our strongest protection is structural: because the site requires no account, processes no payments and asks for no personal details, there is no customer database to compromise. Measurement, when you allow it, does not identify you.
Your rights
Article 17 of Law 13.709/2018 confirms that your personal data is yours. Article 18 lists what you may ask for, at any time and at no cost. Because this site keeps so little, the answer to several of these will be that we hold nothing at all, and that answer is itself something you are entitled to receive.
Confirmation that processing exists, and access to the data: article 18, items I and II.
Correction of data that is incomplete, inaccurate or out of date: item III.
Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law: item IV.
Portability to another provider, subject to commercial and industrial secrecy: item V.
Deletion of data processed on the basis of your consent, within the exceptions of article 16: item VI.
Information about the entities with which we have shared data: item VII.
Information about the option not to give consent and about what follows from refusing: item VIII.
Withdrawal of consent: item IX.
Information about the safeguards around the international transfer of your data: articles 33 to 35.
Objection to processing founded on any basis other than consent, where the law has not been complied with: article 18, paragraph 2.
Petition against the controller before Brazil’s data protection authority: article 18, paragraph 1. The same right may be exercised before the consumer protection bodies: paragraph 8.
Review of decisions taken solely by automated processing: article 20. We take none; there is no automated decision about people on this site.
The guarantee that your data will not be used to your detriment, and that you may defend it in court, individually or collectively: articles 21 and 22.
How to ask for any of it
Write to suyannemelexenko@gmail.com and say what you want. There is no form to fill in, no account to create and no charge. If you would rather, the same request reaches us on the shop’s WhatsApp.
Since there is no account on this site, the only thing tying a request to any data is the conversation itself. So send the request from the same email address or the same WhatsApp number you used to reach us. If there was no earlier conversation, we almost certainly hold nothing of yours — and that is exactly what we will tell you.
The deadlines are the ones in CD/ANPD Resolution No. 2/2022: up to 15 days to confirm that processing exists and to give access in simplified form, and up to 30 days for the full declaration and for a request that needs more digging. You may also take the matter straight to Brazil’s data protection authority, the ANPD, or to the consumer protection bodies, without speaking to us first.
Children and adolescents
The catalog is meant for adults, and we ask nobody of any age for data. We do not knowingly process data belonging to children or adolescents. If we learn that a message came from a minor without the authorization of whoever represents them, we delete the record.
When this policy changes
If the site changes, this page changes with it, and the date at the top is updated at the same time. If we ever start collecting anything beyond what is described here, it will be written here before it starts.