Privacy policy

1. Data controller

Where's Hype Software, NIF (Portuguese tax number) 516834797, with registered office in Vila Franca de Xira, Lisboa, which operates Ao Lume (aolume.com). For any question about your data: [email protected].

2. What data we process

Clients: name, email, mobile number, address of the service (when it takes place at home or involves delivery), day, menu and number of people, notes for the chef, messages in the booking chat and reviews.

Chefs: account data, public profile (name, area, biography, menus, prices, photographs, Instagram or website), availability, travel and delivery settings, and documents sent for verification (for example, certificates).

Payments: the amount, method and status of each payment, the EuPago reference and, for MB WAY, the mobile number used (stored masked). We do not store card details: payment is processed by EuPago.

Chefs' tax and bank details: legal name, NIF, tax address, VAT regime, IBAN and account holder and, as required by law, date and place of birth (sole traders) or commercial registration number (companies). The IBAN is stored encrypted and is never shown in full on the platform.

Clients' bank details: only when we need to refund a payment made by Multibanco reference, which the bank does not allow to be reversed. We ask for the IBAN on the booking page, store it encrypted and delete it as soon as the refund has been made.

Technical data: IP address and access logs, needed for the security of the service, and the cookies described in Cookies and storage on your device.

Allergies and dietary restrictions: only if you state them in the notes to your request. They are health data: we process them on the basis of your explicit consent, solely so that the chef can prepare the service safely.

3. What we use the data for and on what legal basis

• Managing requests and bookings, the conversation with the chef and the emails about the request: performance of a contract (Article 6(1)(b) GDPR (RGPD)).
• Accounts and chef profiles, including publishing the profile: performance of a contract.
• Receiving the deposit, deducting the commission and paying the chef, including the payment documents: performance of a contract (Article 6(1)(b) GDPR (RGPD)).
• Complying with tax and accounting obligations and reporting annually to the Portuguese Tax and Customs Authority (Autoridade Tributária) the chefs' data and amounts required by Decreto-Lei n.º 20/2022 (DAC7): legal obligation (point (c)). These data cannot be erased on request while the legal retention period lasts, and we inform each chef of what has been reported.
• Preventing fraud in payments, in particular checking changes of IBAN: legitimate interest (point (f)) in not allowing a chef's money to be diverted.
• Verifying chefs (photographs, social media and certificates) and moderating reviews: legitimate interest in keeping the platform safe and reliable.
• Asking for a review after the service: legitimate interest. You may object at any time.
• Security and fraud prevention (access logs, request limits): legitimate interest.
• Measuring our adverts on Facebook and Instagram, if you accept the cookie notice: consent (Article 6(1)(a)). You may withdraw it whenever you wish, under Cookies.
• Complying with legal obligations, such as responding to authorities and, in the case of cooks and chefs, reporting to the Portuguese Tax and Customs Authority (Autoridade Tributária) the information required by Lei n.º 36/2023 (DAC7): legal obligation (Article 6(1)(c)).

4. People interested in cooking on Ao Lume

If you leave your contact details in a sign-up form (for example, in an advert on Facebook or Instagram), we receive your name, telephone number, email, area, what you cook, whether you already sell and, if you provide it, your Instagram or Facebook link.

We use these data only to contact you, explain Ao Lume and help you create your profile, because that is what you asked for (steps prior to entering into a contract, Article 6(1)(b) GDPR (RGPD)). The advert forms belong to Meta Platforms Ireland, which passes the data on to us.

If you create a profile, the data are then processed as account data. If you do not go ahead, we delete them within 12 months of the last contact, or sooner if you ask us to.

5. Who we share data with

With the chef of your booking: name, contact details, address of the service and notes, to prepare and provide the service. The chef processes those data as an independent controller and may only use them for that purpose.

With providers who work for us, under contract and only on our instructions:

• Supabase: database, authentication and file storage.
• Resend: sending emails.
• Komoot (Photon): suggestions of addresses and areas; it receives the text you type in the search.
• OpenFreeMap: maps; it receives your IP address when the map loads.

With Meta Platforms Ireland, only if you accept the cookie notice: the pixel tells Meta that you visited the site, with your IP address and the cookie identifier, so that we can measure our adverts. For that collection we are joint controllers with Meta, which then processes the data as a controller in its own right. Without your permission, the pixel does not load and nothing is shared.

We do not sell personal data. We only share it for advertising if you accept the cookie notice.

6. Who processes payments

Payments are processed by EuPago (Moving Forward Together, S.A.), a payment institution authorised and supervised by the Banco de Portugal, which processes the data needed for the transaction as a controller in its own right. Transfers to chefs are made by our bank. The Portuguese Tax and Customs Authority (Autoridade Tributária) receives what the law requires us to report.

7. Transfers outside the EEA

Some providers may process data outside the European Economic Area, for example in the United States (as is the case with Meta, if you accept the cookie notice). In those cases, the transfer is made with the safeguards provided for in the GDPR (RGPD), such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

8. How long we keep data

• Account and profile: while the account is active; deleted within 30 days of your request to close it.
• Requests, bookings and messages: up to 3 years after the date of the service, to deal with complaints and any disputes.
• Verification selfie: deleted when the profile is approved.
• Verification documents: while the profile is active; deleted within 6 months of closure.
• Reviews: while the chef's profile is published, without the reviewer's contact details.
• Access links to requests made without an account: stop working after 90 days.
• Payments, payment documents and chefs' tax data: 10 years, as required by Portuguese tax and accounting law. This period prevails over a request for erasure.
• A client's IBAN given for a refund: deleted as soon as the refund has been made.
• Support messages: up to 3 years after they are closed.
• Access logs: up to 12 months.

9. Your rights

You may request access to your data, its rectification or erasure, restriction of processing and portability, object to processing based on legitimate interest and withdraw your consent at any time, without affecting processing already carried out.

To exercise these rights, write to [email protected]. We reply within one month. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados, the Portuguese data protection authority (CNPD) (www.cnpd.pt).

10. Cookies and storage on your device

For the site to work we use only what is strictly necessary, without asking for consent:

• Session cookies, to keep you signed in.
• One cookie for each request made without an account, to open that request on this device.
• A list of your recent requests, stored only in your browser, so you can find them under “Track a request”.

With your permission, we also use the Meta Pixel (Facebook and Instagram) to measure whether our adverts work, for example how many people create an account after seeing an advert. It is only activated if you click “Accept” on the cookie notice, and you can change your choice at any time under “Cookies”, at the bottom of every page. Meta processes these data in accordance with its own privacy policy.

• Meta cookies: _fbp and, if you arrive from an advert, _fbc. They last about three months.
• Your answer to the notice is stored only in this browser (aolume-consent), so that we do not ask again.

We do not use audience analytics cookies.

11. Security

Connections are encrypted (HTTPS), access to data is restricted by rules in the database itself (each person only sees what concerns them) and verification documents are kept in private storage, accessible only to the chef concerned and the team.

12. Minors

Ao Lume is not intended for people under 18, who must not create an account or request bookings.

13. Changes to this policy

We may update this policy. The version in force is the one published on this page, with the date of the last update. Significant changes are notified by email to account holders.