Privacy Policy
Last updated: 2026-10-21
This policy describes processing of personal data when using rubenmoderno.xyz, under GDPR.
Data controller
Rúben Moderno. Contact: hello@rubenmoderno.xyz.
Data and purposes
Contact form and mentoring requests: name, email, message and — when you fill them in — phone and company, to reply to your request. Free mockup request: the business name, your name and email and, if you give them, the city, sector, mobile number and where the business is online, plus the answers and photos you send in the questionnaire — to build your mockup and email it to you. Your mobile number only appears on your website if you tick the box next to it. Downloadable materials (guides, PDFs): your email, to send you the file. Newsletter: only if you tick the subscription box, which is separate and optional. Analytics cookies: aggregated usage data, only if you accept in the banner. We also store a hashed (irreversible) form of your IP address on form submissions, solely to stop automated abuse.
Data about businesses we contact (prospecting)
If you run a local business, we may have collected public data about it — name, address, phone, email, opening hours, photos and reviews — from sources anyone can access: OpenStreetMap, the business's own website, booking platforms and commercial registers. We use that data to build a website mockup and offer you a service. The first contact is usually a call to the business's public phone number, on the basis of legitimate interest (GDPR art. 6(1)(f)). We only email you the mockup if you agree to receive it on that call: that email rests on consent (GDPR art. 6(1)(a) and art. 13-A(1) of Portuguese Law 41/2004), and we keep a record of when it was given, by whom and for which address. Without that consent, we only email legal persons (paragraph 2 of the same article), always with an unsubscribe link. We do not buy lists or use third-party data brokers. You can object or withdraw your consent at any time, without giving a reason: reply to any of our emails saying so, use the unsubscribe link where there is one, or write to hello@rubenmoderno.xyz — your contact then enters a permanent suppression register and you will not be contacted again, even if the business is rediscovered in public sources.
Data collected on our clients' websites
On websites we build for businesses — which live on the client's own domain — the reservation, booking, quote and review forms collect what the visitor types, and the visit statistics record how the site is used, without cookies and without identifying who was there. For that processing the business is the controller; we act as processor, under a contract that forbids us from using the data for our own purposes. We keep it on the business's behalf for as long as our contract with it lasts; at the end, we return it if the business asks within 90 days and delete it when that period ends. To exercise rights over that data, contact the business directly — or write to us and we will forward it.
Legal basis
Pre-contractual steps (replying to enquiries and proposals — art. 6(1)(b)). Consent, freely given and revocable (analytics cookies, newsletter, the mockup email you agreed to receive on the phone — (a)). Legitimate interest in business-to-business commercial communication and in protecting the service from abuse — (f). Compliance with legal, notably tax, obligations regarding invoicing data — (c).
Processors
Supabase (database), Vercel and Cloudflare (hosting, DNS and delivery), Resend (transactional email), Stripe (online payments), Cal.com (call booking), Google (Analytics 4 on this site of ours, Maps and Fonts on business sites) and Anthropic (AI assistance in drafting copy and proposals). All operate under contracts containing GDPR art. 28 clauses. Visit statistics on business sites run on self-hosted Umami, on our own server in the European Union — no cookies and no sharing with third parties. Google Analytics and the Meta pixel do not run on business sites by default: they exist only on sites with ad management, and there they run in the client’s own Google and Meta accounts, with the client as controller of that data.
Transfers outside the European Economic Area
Some of these providers are US-based and may process data outside the EEA. Those transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on certification under the EU-U.S. Data Privacy Framework. We choose European hosting regions wherever possible.
Retention
Contact form messages and mentoring requests: 24 months. Newsletter subscribers: until you unsubscribe. Mockup requests and prospecting: if the business does not become a client, all data about that business, mockup included, is deleted 24 months after the last contact. Client data under contract: for the duration of the relationship plus 10 years, as tax law requires. Suppression register (people who refused contact): permanent — that is precisely what guarantees you are not contacted again. Analytics: 14 months. Earlier deletion on request, except where the law requires retention.
Your rights
Access, rectification, erasure, objection, portability and withdrawal of consent — email hello@rubenmoderno.xyz. You can file a complaint with the Portuguese DPA (CNPD — cnpd.pt).