Starter version — 15 September 2026. This policy uses the temporary name “the Malleversa project”. It must be updated when the official business structure and legally required identifying details are established. Final review by a Portuguese privacy/GDPR professional is recommended.
Who handles the data and how to contact us
For this starter version, references to “Malleversa”, “we” or “us” mean the Malleversa project operating the directory and related tools. Privacy questions and requests can be sent to hello@malleversa.com.
Personal data we may collect
Professional registration and profiles
- Name, trade or company name, email address, telephone and WhatsApp number.
- Service categories, locations, descriptions, prices, links and submitted portfolio images.
- Required declarations, acceptance timestamp and policy version.
- Membership and moderation status, administrative notes and limited business-existence check records.
AI Assistant
Messages you enter and the relevant recent conversation history needed to generate a response.
Complaints and support
Your contact details, complaint content, references to professionals, supporting images or PDFs, correspondence and handling notes.
Technical and security data
Limited request data such as IP address, timestamps and rate-limit/security counters may be processed to operate and protect the service. Server and hosting logs may also be created by infrastructure providers.
Analytics cookie and visitor statistics
To understand which Malleversa pages are useful and how often they are visited, the website uses a first-party cookie named mv_analytics_id. It contains a randomly generated anonymous identifier and does not contain your name, email address, telephone number or the contents of your activity.
The cookie and the related page-view record are used only for Malleversa’s own local traffic measurements, such as page views, approximate unique visitors, sessions, online visitors, referral domains, device and browser categories, campaign values, and separate likely-human or suspected-bot counts. Authorized Malleversa administrators may see a truncated anonymous visitor identifier together with aggregate visit times and technical categories in the private dashboard; raw IP addresses are not shown or stored. Where the local DB-IP Country Lite database is installed, an approximate country code is derived on our server during collection; the IP address is not sent to DB-IP or stored in the analytics database. The visitor identifier is not used for advertising, profiling or cross-site tracking.
Malleversa does not sell analytics data or provide it to advertising networks, data brokers or other third parties. The analytics records remain in the Malleversa hosting/database environment and are used only to operate, understand and improve the website. No cookie-consent pop-up is currently displayed for this site; this section describes the cookie used by the current implementation and should receive a final Portuguese privacy-law review before production reliance.
Why we use data
- To receive, review, publish and administer professional profiles.
- To provide directory search, contact preparation and AI orientation.
- To process complaints, support requests, safety issues and legal claims.
- To prevent abuse, secure the service and diagnose failures.
- To measure anonymous first-party website traffic and improve page usefulness.
- To meet legal obligations and protect legitimate interests.
Depending on the activity, processing may rely on steps requested before an agreement, performance of an agreement, consent where specifically requested, legal obligations, or legitimate interests in operating and protecting the directory. A final legal review should confirm the appropriate ground for each production process.
AI Assistant and Google AI
When you send an AI message, Malleversa sends that message and relevant conversation history through the Malleversa backend to Google’s AI service to generate a response. Do not include confidential, financial, medical, identity-document or other unnecessary sensitive information.
Chat history is stored only in your browser’s localStorage. It is not copied to a Malleversa cookie or sessionStorage. The bin button removes the stored conversation history from that browser. Messages still have to pass temporarily through the backend and Google AI to answer each request.
The assistant uses professional-supplied directory data, is not a quality ranking or guarantee, and does not provide professional advice.
Direct contact with professionals
Profile tools can prepare WhatsApp or email messages. When your browser opens WhatsApp or your email application, communication is directly between you and the professional. Malleversa does not receive or store a copy of that prepared message.
Service providers and recipients
- Google AI services for AI response generation.
- SMTP2GO for operational email and complaint delivery.
- Buy Me a Coffee for membership payment, renewal, cancellation and receipts; its underlying payment services may include Stripe.
- Hosting and security providers needed to operate the website.
- Google Maps / Google Business Profile only when you choose to follow external links.
These providers process data under their own terms and privacy arrangements where applicable. Data may be processed outside Portugal or the EEA; appropriate transfer safeguards must be confirmed for production use.
How long data is kept
Analytics page-view records are retained only in the Malleversa analytics database for internal measurement and are not sold or shared with third parties. The anonymous visitor cookie is configured to expire after approximately one year.
Registration and public profile data are normally retained while the membership and profile remain active. After ordinary membership cancellation, the profile and registration data may remain active until the end of the already paid period and can then be manually deleted.
An express privacy deletion request is handled separately. Where appropriate, the public profile may be hidden earlier. Only data genuinely necessary for a complaint, safety matter, legal obligation or legal claim may be retained, and only for the necessary period.
Complaint attachments should be held only as long as needed to assess and handle the matter. Temporary upload files are deleted after successful or unsuccessful email delivery attempts.
Your data protection rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing relies on consent. Send requests to hello@malleversa.com. We may need proportionate information to confirm the request and protect other people’s data.
You may also have the right to complain to Portugal’s data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).
Security, children and changes
We use proportionate technical and organisational safeguards, but no internet service can guarantee absolute security. Professional registration is limited to people aged 18 or over through a mandatory self-declaration; Malleversa does not request a birth date or identity document for that declaration.
We may update this starter policy as the service, providers or official business structure changes. The current version and date will be published here.