Privacy Policy

This policy explains what personal data recomendas.me processes, why, on what legal basis, for how long, who it is shared with, how it is protected and how you can exercise your rights, under the General Data Protection Regulation (GDPR) and Portuguese law.

1. Introduction

Marvel Nest, Lda. ("Marvel Nest", "we", "us") operates the website www.recomendas.me and the recomendas.me mobile apps (together, the "Service").

We use personal data only to provide and improve the Service and to keep it secure. This policy forms part of the agreement between you and Marvel Nest, together with the Terms of Service. Terms defined in the Terms have the same meaning here.

2. Definitions

Personal data: any information about an identified or identifiable person, such as their name, email address or phone number.
Usage data: data collected automatically when you use the Service, such as your IP address or browser type.
Cookies: small files stored on your device by your browser.
Controller: whoever decides the purposes and means of processing personal data. For the Service, this is Marvel Nest.
Processor: whoever processes personal data on behalf of and following the instructions of the controller, such as a hosting or SMS provider.
Data subject: the person the data relates to. This may be a user of the Service or a professional recommended by someone else.

3. Controller

The controller is Marvel Nest, Lda., a Portuguese company with tax number (NIPC) 514880066, whose registered office is at Estrada da Portela, 5, Piso 4, Esc. 5, 2790-045 Carnaxide, Portugal.

For any privacy question or to exercise your rights, write to info@recomendas.me.

4. What data we collect

People asking for a recommendation

The name and email address on the account and, if you provide it, your phone number.
If you sign in with Google or Apple, your account identifier with that service and the name and email address it sends us. We never receive your password.
The content of each request: the category, the location and the description you write, and the answers you give when you close it.

People recommending

Your name, if you provide it, and whether you choose to show it to the person who made the request.
The details of the professional you suggest: name, phone number or email address, how you know them, how it went and the comment you write.
Your statement that the professional has authorised you to share their contact details.

Recommended professionals

If you have been recommended, your data reached us through the person who recommended you, who states that they have your permission. We process:

the name and phone number or email address provided, and the comment about your work;
the phone number or email address you confirm with a code, if you want to see how many times you have been recommended;
your verified contact details, if you click or tap "I'm interested" in the featured listing options.

Usage and technical data

The access and verification codes we send by email or SMS, stored only in encrypted form (hash).
Your IP address, the type and version of your browser or device and the date and time of each visit, used to keep you signed in, limit the number of requests and prevent abuse.
Statistics for each request (link views, shares and contacts opened), without identifying who generated them.
The signals that Google's reCAPTCHA v3 collects in your browser to tell people apart from automated programs.
Only if you accept analytics cookies: the pages you visit on the website, where you came from, your device type, your approximate region and a random identifier stored in a cookie, collected by Google Analytics.
The reports about content that you make on the Service.

5. How we use data and on what legal basis

We only process personal data when we have a legal basis under Article 6(1) of the GDPR:

Performance of a contract (point (b)): when processing is necessary to provide you with the Service you accepted by using it.
Consent (point (a)): when you give us permission for a specific purpose, which you can withdraw at any time.
Legal obligation (point (c)): when the law requires us to process or disclose data.
Legitimate interests (point (f)): when processing is necessary for our interests or those of third parties that do not override your rights.

Purpose	Legal basis
Creating and managing your account, publishing requests and receiving recommendations	Performance of a contract
Showing recommended professionals to the person who asked	Performance of a contract and, for the professional's data, legitimate interests in responding to the request, with the permission stated by the person recommending
Verifying a professional's contact details before showing them how many recommendations they have	Legitimate interests in preventing anyone from seeing another person's data
Recording interest in featured listings and contacting the professional again once they are available	Consent
Sending emails and SMS with codes and Service notices	Performance of a contract
Security and abuse prevention (codes, IP limits, reCAPTCHA, handling reports)	Legitimate interests
Aggregate request statistics and improving the Service	Legitimate interests
Measuring website usage with Google Analytics	Consent
Responding to requests from authorities and complying with legal obligations	Legal obligation

We do not send advertising without your prior and express consent, we do not sell personal data and we do not use it to build advertising profiles.

6. Processors and service providers

We use the providers below to deliver the Service. Each one processes data only for the stated purpose, following our instructions and under a contract in accordance with Article 28 of the GDPR.

Provider	Purpose	Data
Google	Sign in with Google, reCAPTCHA v3 and, with your consent, Google Analytics	Google account identifier, name and email address; browser signals and IP address; pages visited and analytics cookie identifier
Apple	Sign in with Apple in the mobile apps	Apple account identifier, name and email address
Twilio	Sending codes by SMS	Phone number and message content
Cloudflare	Website delivery and protection against attacks	IP address and technical request data
Hetzner (Germany)	Hosting the servers and the database, and sending the Service's emails	All Service data

Processing by Google and Apple is also subject to their own privacy policies, in particular the Google Privacy Policy. We keep this list up to date and will show any relevant change here.

7. Who we share data with

Within the Service, the person who made a request sees the professionals recommended to them and the name of the person who recommended them, only if that person chooses to show it. The description and location of an active request are visible to anyone who has the link.

Outside the Service, we only disclose personal data:

to the processors listed in section 6;
to authorities, when required by law or in response to a valid request from a public authority;
when necessary to protect the rights, safety or property of Marvel Nest, its users or third parties;
in connection with a merger, acquisition or transfer of the Service, in which case we will let you know before the data becomes subject to a different policy;
in any other case, only with your consent.

8. International transfers

Some providers may process data outside the European Economic Area (EEA). In that case, we ensure a level of protection equivalent to the GDPR through at least one of these safeguards:

an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified companies;
standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914);
supplementary measures, technical or contractual, where the assessment of the case calls for them.

To find out which safeguard applies to each transfer, write to info@recomendas.me.

9. How long we keep data

We keep data only for as long as necessary for the purposes of this policy. The periods below are applied by daily automated processes.

Data	Period
Access and verification codes	Up to 24 hours after they expire
The professional's verified contact details in the session	For as long as the browser session lasts
Account (name, email address and phone number)	Until you delete it or after 24 months of inactivity, with an email notice 30 days beforehand
Active request	For as long as it is active; it is closed automatically after 6 months of inactivity
Request description and location, and the free text note added on closing	12 months after the request is closed
Recommendations and recommended professionals' data	24 months after the request is closed
Request statistics	12 months
Google Analytics data	14 months, or until you delete the analytics cookies
Interest in featured listings	12 months after the last registration, or until you withdraw your consent

When you delete your account, we erase your data, your requests and the recommendations they received. We may keep data for longer only where the law requires it or to defend a right in ongoing proceedings.

10. Security measures

We apply technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR:

Encryption in transit: all connections use HTTPS.
Encryption at rest: names, email addresses, phone numbers, comments and notes are encrypted in the database; searches use blind indexes, without exposing the data.
Protected codes: access and verification codes are stored only as a hash and expire quickly.
Access control: access to data is restricted to the people who need it, who are bound by a duty of confidentiality.
Abuse protection: request limits per IP address, reCAPTCHA and browser security policies.
Data minimisation: we collect only the data we need and erase it within the periods in section 9.

No system is completely secure, but we review and test these measures regularly.

11. Personal data breaches

If a personal data breach occurs, we will notify the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights.

If the breach is likely to result in a high risk to your rights, we will inform you directly, without undue delay, of the nature of the breach, its likely consequences and the measures taken.

12. Your rights

Under the GDPR, you have the right to:

Access (Art. 15): find out whether we process your data and obtain a copy.
Rectification (Art. 16): correct inaccurate or incomplete data.
Erasure (Art. 17): ask us to erase your data. You can delete your account at any time in your settings.
Restriction of processing (Art. 18): ask us to suspend processing in certain situations.
Portability (Art. 20): receive the data you gave us in a structured, machine-readable format.
Object (Art. 21): object to processing based on legitimate interests, including when you were named as a professional in a recommendation.
Withdraw consent (Art. 7(3)) at any time, without affecting processing carried out before then.
Not be subject to automated decisions (Art. 22). reCAPTCHA may block a submission that looks automated, but we do not make automated decisions with legal effects on you; if a submission is blocked, you can try again or contact us.
Lodge a complaint (Art. 77) with the Comissão Nacional de Proteção de Dados, at www.cnpd.pt, or with the supervisory authority of the country where you live.

To exercise these rights, write to info@recomendas.me. We reply within one month. In complex cases, this period may be extended by two further months, and we will let you know within the first month. We may ask you to confirm your identity, for example with a code sent to the contact details in question, so that we do not hand over or erase another person's data.

13. Cookies

We use cookies that are strictly necessary for the Service to work, which do not require consent:

Cookie	Purpose	Duration
Session	Keeping you signed in while you browse	Browser session
CSRF protection	Preventing forged requests made in your name	Browser session
"Keep me signed in"	Keeping you signed in, only if you choose it	Until you sign out
reCAPTCHA (Google)	Detecting automated programs and abuse	Set by Google
Cookie preference	Remembering whether you accepted or declined analytics cookies, stored in your browser's local storage	6 months

With your consent, we also use Google Analytics cookies, loaded through Google Tag Manager, to find out how many people visit the website and which pages they use, so we can improve the Service. They are only stored after you click "Accept" in the cookie notice. If you decline, the website works just the same.

Cookie	Purpose	Duration
`_ga` (Google)	Distinguishing visitors, without identifying them	2 years
`_ga_<id>` (Google)	Keeping the state of the visit	2 years

Without consent, Google Tag Manager may still send Google cookieless signals, such as a page load, which do not allow you to be recognised across visits. We do not use advertising cookies.

You can change your choice at any time using the "Cookies" link in the footer or here. If you decline, we delete the analytics cookies from your browser. You can also set your browser to refuse cookies, but without the necessary ones some parts of the Service, such as signing in, will stop working.

14. Children

The Service is intended for people aged 18 or over and we do not knowingly collect data from children. If you become aware that a child has given us personal data, write to us and we will erase it.

15. Links to other sites

The Service may contain links to third-party sites that we do not control. When you open one of those links, the processing of your data is governed by that site's policy, which we recommend you read.

16. Changes to this policy

We may update this policy. The date of the last update is always shown at the top of this page. If the changes are significant, we will let you know on the Service or by email before they take effect.

17. Contact

For any question about this policy, contact us:

Email: info@recomendas.me
Controller: Marvel Nest, Lda., NIPC 514880066
Address: Estrada da Portela, 5, Piso 4, Esc. 5, 2790-045 Carnaxide, Portugal