Privacy Policy & Data Protection

Lisbon Palate ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store and share your information in full compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") and Portuguese Law no. 58/2019 of 8 August, which implements the GDPR in Portugal.

We collect only the data strictly necessary to operate the service:

• Authentication credentials — your email address and an encrypted password used to create and access your account.
• Payment and billing information — handled exclusively by our payment processor Stripe. Lisbon Palate does not store your raw card number, expiry date or CVC. We only retain a Stripe customer reference and the metadata Stripe returns to us (last 4 digits, brand, transaction history).
• Behavioral and analytics data — collected through our hosting and analytics provider Lovable. This includes approximate location (derived from IP address), in-app navigation history, pages viewed and traffic usage metrics.

Each category of data has a specific lawful basis under Article 6 GDPR:

• Credentials and payment data — processed on the basis of performance of a contract (Art. 6(1)(b) GDPR). Without them we cannot give you access to the service or process your subscription.
• Behavioral & analytics data — processed on the basis of our legitimate interest(Art. 6(1)(f) GDPR) in understanding how the service is used, improving it, and protecting it against abuse.

• Personal data is retained only for the minimum period legally required or strictly necessary for the purposes described above.
• Payment and billing records are kept for the period imposed by Portuguese accounting and tax law (currently 10 years).
• Behavioral and analytics data is kept according to Lovable's retention policy.
• Any data processed on the basis of your consent is deleted as soon as you withdraw that consent.

Under the GDPR you have the right to:

• Access your personal data;
• Rectify inaccurate or incomplete data;
• Request erasure ("right to be forgotten");
• Restrict processing;
• Data portability;
• Object / oppose to processing;
• Withdraw any consent previously given, at any time.

To exercise any of these rights, contact us at privacy@lisbonpalate.com (placeholder — replace with your support contact). We will respond within one month.

We rely on the following processors, each evaluated for GDPR compliance and bound by a data-processing agreement:

• Stripe — payment processing, PCI-DSS certified. See stripe.com/privacy.
• Lovable — application hosting and behavioral analytics processor.

Your personal data is hosted and processed within the European Economic Area (EEA). Where Stripe or Lovable need to transfer data outside the EEA, such transfers are carried out under the safeguards required by the GDPR (e.g. Standard Contractual Clauses or adequacy decisions of the European Commission).

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction — including encryption in transit (HTTPS/TLS), encrypted passwords, access controls and regular security review of our providers.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we commit to notify the Portuguese supervisory authority (CNPD) within 72 hours, as required by Article 33 GDPR, and to inform affected users when legally required.

We only set strictly necessary cookies (authentication, session, security). Behavioral analytics is collected by Lovable as described above. If we ever introduce additional cookie categories or change our practices, you will be notified and asked to renew your consent. For details and to manage your preferences, see our Cookie Policy.

If you believe your data protection rights have been infringed, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD):

We may update this Privacy Policy from time to time to reflect changes in the law, our services or our processors. Whenever we make material changes, we will notify you in advance — through the app or by email — before the new version takes effect, so that you can review it and, where applicable, renew your consent.