Privacy Policy
Last updated: 2026-07-25
This policy describes processing of personal data when using rubenmoderno.xyz, under GDPR.
Data controller
Rúben Moderno. Contact: hello@rubenmoderno.xyz.
Data and purposes
Contact form and mentoring requests: name, email, message and — when you fill them in — phone and company, to reply to your request. Downloadable materials (guides, PDFs): your email, to send you the file. Newsletter: only if you tick the subscription box, which is separate and optional. Analytics cookies: aggregated usage data, only if you accept in the banner. We also store a hashed (irreversible) form of your IP address on form submissions, solely to stop automated abuse.
Data about businesses we contact (prospecting)
If you run a local business, we may have collected public data about it — name, address, phone, email, opening hours, photos and reviews — from sources anyone can access: Google Maps, the business's own website, booking platforms and commercial registers. We use that data to build a demonstration website and present a B2B commercial proposal, on the basis of legitimate interest (GDPR art. 6(1)(f)). We do not buy lists or use third-party data brokers. You can object at any time, without giving a reason, through the unsubscribe link in every message or by emailing hello@rubenmoderno.xyz — your contact then enters a permanent suppression register and you will not be contacted again, even if the business is rediscovered in public sources. We only send email to legal persons, under art. 22(2) of Portuguese Decree-Law 7/2004.
Data collected on our clients' websites
On websites we build for businesses — which live on the client's own domain — the reservation, booking, quote and review forms collect what the visitor types, and the visit statistics record how the site is used, without cookies and without identifying who was there. For that processing the business is the controller; we act as processor, under a contract that forbids us from using the data for our own purposes. To exercise rights over that data, contact the business directly — or write to us and we will forward it.
Legal basis
Pre-contractual steps (replying to enquiries and proposals — art. 6(1)(b)). Consent, freely given and revocable (analytics cookies, newsletter — (a)). Legitimate interest in business-to-business commercial communication and in protecting the service from abuse — (f). Compliance with legal, notably tax, obligations regarding invoicing data — (c).
Processors
Supabase (database), Vercel and Cloudflare (hosting, DNS and delivery), Resend (transactional email), Google (Analytics 4 on this site of ours, Maps and Fonts on business sites) and Anthropic (AI assistance in drafting copy and proposals). All operate under contracts containing GDPR art. 28 clauses. Visit statistics on business sites run on self-hosted Umami, on our own server in the European Union — no cookies and no sharing with third parties. Google Analytics does not run on business sites: it exists only on the sites of clients who contract it separately, and then it runs in that client’s own Google account.
Transfers outside the European Economic Area
Some of these providers are US-based and may process data outside the EEA. Those transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on certification under the EU-U.S. Data Privacy Framework. We choose European hosting regions wherever possible.
Retention
Contact form messages and mentoring requests: 24 months. Newsletter subscribers: until you unsubscribe. Prospecting contacts with no reply: 24 months after the last contact. Client data under contract: for the duration of the relationship plus 10 years, as tax law requires. Suppression register (people who refused contact): permanent — that is precisely what guarantees you are not contacted again. Analytics: 14 months. Earlier deletion on request, except where the law requires retention.
Your rights
Access, rectification, erasure, objection, portability and withdrawal of consent — email hello@rubenmoderno.xyz. You can file a complaint with the Portuguese DPA (CNPD — cnpd.pt).