Privacy Policy

This policy explains what personal data 2 Manos collects, why, who we share it with, and what rights you have. It is written to be read: if anything here is unclear, write to us and we will explain.

Who processes your data

The controller is DOTVILAS, LDA., Rua Nova da Alfândega 74, 4050-385 Porto, tax number 506837114, trading as 2 Manos.

For any privacy question, including exercising your rights: info@2manossmash.com.

What we collect

Account. Email address (required — it is how you sign in), name, and, if you provide them, a display name, username, phone number, profile picture, a short bio and your preferred language. Only the email is needed to have an account.

Orders. The items ordered, the pickup time, the amounts, the order status and any notes you leave us.

Payments. Payments are processed by Stripe. We never receive or store your card number. We keep only the transaction reference, the amount and the outcome, which we need to confirm the order, issue an invoice and handle refunds.

Community. When the community area opens: the posts, photos and comments you choose to publish, and the record that you accepted its rules.

Communications. Your contact preferences and, if you subscribe, your consent to receive news — with the date you gave it.

Site usage. Technical logs generated by our hosting providers (IP address, date and time, pages requested), used for security and diagnostics.

What we do not do: no advertising cookies, no analytics tools, no social media pixels, and we do not sell data to anyone. When we count how many people clicked through to a delivery marketplace, the record holds only which marketplace and when — with no link to you.

Legal basis

• Creating and maintaining your account; processing orders — performance of a contract.
• Issuing and keeping invoices — legal obligation.
• Security, abuse prevention and diagnostics — legitimate interest.
• Community posts — performance of a contract and your consent.
• News and offers by email — consent, which you may withdraw at any time.

Who we share it with

Only those needed for the service to work, and always as processors bound to handle the data on our behalf:

• Supabase — database, authentication and file storage
• Vercel — site hosting
• Stripe — payment processing
• Hostinger — email service

The map on the Visit section is served by OpenStreetMap. When that page loads, your browser connects to OpenStreetMap's servers, which therefore receive your IP address. OpenStreetMap sets no advertising cookies.

The delivery buttons take you to Uber Eats or Glovo. Once you leave our site, their policies apply, not this one.

We do not transfer data outside the European Economic Area on our own initiative. Some of the providers above are companies based outside the EU and may process data on servers outside the EEA under the safeguards provided for in the GDPR.

How long we keep it

• Account and profile — for as long as the account exists.
• Orders, invoices and accounting records — 10 years, as Portuguese tax law requires. This period cannot be shortened on request.
• Community posts — until you delete them or delete your account.
• Technical logs — our hosting providers' retention period, typically a few weeks.

Deleting your account

You can delete your account from the customer area. When you do, immediately:

• your email is replaced with an anonymous value, and your name, phone, picture and bio are erased;
• your favourites and notifications are deleted;
• any unused benefits are revoked;
• the account is marked deleted and can no longer be used.

Your order history is not deleted, because the law requires us to keep billing records. It does, however, stop being attached to an identifiable profile.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise them, write to info@2manossmash.com. We reply within one month.

If you believe we have not handled the matter properly, you may complain to the Portuguese data protection authority, Comissão Nacional de Protecção de Dados (CNPD), Av. D. Carlos I 134, 1200-651 Lisbon — www.cnpd.pt.

Children

The service is not directed at children under 16 and we do not knowingly collect data from anyone below that age. If you learn that a child has given us data, write to us and we will delete it.

Security

Data travels over an encrypted connection, and database access is restricted at the row level: each person reaches only their own records, and staff only what their role requires.

Changes

If we change this policy we publish the new version here, dated. Material changes are notified by email to account holders.

Last updated: 2026-08-25.