Privacy policy

Last updated: 20 October 2026

This English version is provided for convenience. The binding version is the Portuguese one (Privacy policy); if the two differ, the Portuguese version prevails.

This policy explains what personal data MimoSpot collects, what it is used for, who it is shared with and what rights you have over it. It applies to the mimospot.com site and to all the platform’s services, for both customers and professionals.

1. Who is responsible for your data

José Alexandre Moreira da Silva, who operates the MimoSpot platform
Tax number (NIF) 212598341
Rua Jorge de Sena, 35, 4460-342 Senhora da Hora, Portugal
Email: clientes@mimospot.com

MimoSpot is a platform that connects customers with independent professionals. Each professional is responsible for the data they process on their own account outside the platform (for example, to issue their invoice).

2. What data we collect

If you are a customer

• Account data: name, email and mobile number (confirmed by SMS).
• Request data: the service address, postcode and approximate location, type of service, details you fill in, photos or videos you attach and the messages exchanged with the professional and with the team.
• Payments: payment (card, Apple Pay, Google Pay, MB WAY, Klarna, Amazon Pay or Satispay) is made through Stripe, a payment institution regulated in the EU. The payment details you enter (for example, your card number, expiry date and security code) go directly into Stripe’s secure form and never pass through MimoSpot’s servers. We do not store card details or any other payment method, and we do not ask you to save them for future purchases. If you pay with MB WAY, your mobile number is sent to Stripe so you can approve the payment in the MB WAY app; we do not keep that number for payments. If you choose Klarna, Amazon Pay or Satispay, you are taken to that service, which processes your data as an independent controller under its own privacy policy. On our side, we only keep a record of each payment (Stripe reference, amount, date and status), which we need to charge, refund and meet our legal obligations.
• Professionals’ payouts: at sign-up, the professional gives their date of birth and IBAN. When they activate payments, we send this data (with their name, contact details, tax address and tax number) to Stripe, which requires it by law to open the payments account and transfer the amounts. The IBAN is stored encrypted until then and is deleted from MimoSpot right after being sent; we only keep the last 4 digits for reference.
• Reviews: the review you leave for the professional and the private rating the professional gives of their experience with you (this is never public).

If you are a professional

• Account and profile data: name, email, mobile, photo, title, description, experience, photos of your work, services, prices (always final, including VAT where applicable), travel fee and the area where you work.
• Tax and location data: tax number (NIF), tax address and the approximate coordinates of that address, used to calculate your work area.
• Verification documents: identity document, proof of professional activity, proof of address and criminal record certificate.
• Acceptances: the version and date on which you accepted the Conditions for professionals and gave your consent to the verification of documents, including the declaration that you are aware of the obligation to have the insurance required for your activity, with the IP address from which you did so.
• Bank details: the IBAN and identity details needed to receive payments are collected directly by Stripe, in your payments account. We only keep the identifier of that account.
• Location while travelling: if you choose to share it when you indicate that you are on your way, your approximate position is shown on the map to the customer for that booking until you arrive. We only keep the last position, with no history of the route.
• Activity: requests received, services carried out, amounts, reviews received and your replies to reviews.

For any visitor

• Technical data: IP address, browser type and pages visited, which are kept in the server logs for security reasons.
• Device location: only if you allow it in your browser, to show professionals near you. You can refuse and type in your postcode.
• Help chat: what you write in the chat and, if you give them, your name and email.

3. What we use the data for and on what legal basis

Purpose	Legal basis (GDPR)
Creating and managing your account, receiving and forwarding requests, processing payments	Performance of a contract (Art. 6(1)(b))
Checking professionals’ identity, business activity and background before approving their profile	Legitimate interest in ensuring the safety of people who receive professionals in their home (Art. 6(1)(f)) and the professional’s explicit consent, given at sign-up (Art. 6(1)(a)). The criminal record certificate is processed for this purpose only, under Art. 10 GDPR, and the copy of the identity document is only kept with the holder’s consent (Law no. 7/2007); both are deleted 30 days after the decision.
Logging the team’s access and actions in the management area, protecting accounts and keeping backups	Legitimate interest in the security of the platform and the data (Art. 6(1)(f) and Art. 32 GDPR)
Keeping payment and invoicing records	Compliance with legal and tax obligations (Art. 6(1)(c))
Publishing reviews, moderating content and preventing fraud and abuse	Legitimate interest (Art. 6(1)(f))
Sending emails about your requests (confirmations, reminders, review requests)	Performance of a contract and legitimate interest
Ordering professionals in search results and awarding badges (Bronze, Silver, Gold and TOP)	Legitimate interest (Art. 6(1)(f)). The order and the badges are calculated automatically from distance, reviews, experience on the platform, cancellations and availability. They have no legal effects and do not decide whether accounts are approved, which is always done by a person on the team.
Sending reminders about a sign-up or a booking that was left unfinished	Legitimate interest (Art. 6(1)(f)). You can ask to stop receiving them.
Inviting you to review MimoSpot on Trustpilot after a service	Legitimate interest (you can refuse at any time)
Showing the customer, on a map, the position of the professional who is on their way	The professional’s consent (Art. 6(1)(a)), given for each trip and which can be withdrawn at any time
Using your device’s location	Consent (Art. 6(1)(a)), which you can withdraw in your browser settings
Showing the site and sending messages in your language, and translating messages between people who use different languages	Performance of a contract and legitimate interest (Art. 6(1)(b) and (f))

We do not use your data for advertising, we do not sell it and we do not make automated decisions with legal effects on you.

4. Who we share the data with

• Between customer and professional: the professional receives the data needed to assess your request. The full address is only shared after they accept the request. The customer sees the professional’s public profile (name, photo, description, services, prices and reviews).
• Stripe Technology Europe, Limited (Ireland): payment processing. It is an electronic money institution authorised and supervised by the Central Bank of Ireland, permitted to provide payment services in Portugal under European Union rules (it is not a bank authorised by the Banco de Portugal).
• Hostinger (European Union): hosting of the site, database and email.
• BulkGate (Czech Republic): sending SMS with confirmation codes (only the mobile number and the code).
• Google (Google Drive): stores the site backups. Google, Apple and Mozilla also deliver notifications to your phone or browser, if you turn them on (they only receive a device identifier, without the content of the notification).
• Anthropic (USA): the artificial intelligence assistant Claude is used by the team as a technical maintenance tool for the site and may occasionally access data stored on the platform during those tasks, only to the extent necessary.
• Microsoft Ireland Operations (Ireland), Microsoft Translator service: when customer and professional use different languages, the text of chat messages, request descriptions and guarantee requests is sent for machine translation, processed in the European Union. Microsoft does not store the text sent. Phone numbers and emails written in the chat are hidden before sending.
• Trustpilot A/S (Denmark): name, email and booking number, to send the MimoSpot review invitation.
• OpenStreetMap (Nominatim) and GeoAPI.pt: receive postcodes, towns or addresses, without your name, to convert them into coordinates.
• OpenStreetMap (maps): the site’s maps (for example, to follow the professional on their way) are loaded from OpenStreetMap’s servers, which receive your IP address.
• Content services (Google Fonts, Unsplash, jsDelivr and cdnjs): your browser connects to these services to load fonts, images and libraries, and they receive your IP address.
• Authorities, when required by law.

These providers only process the data to provide their service to us, under contracts that comply with the GDPR.

5. Transfers outside the European Union

Some providers (such as Stripe, Google, Apple and Anthropic) may process data in the United States. In those cases, the transfer is protected by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission.

6. How long we keep the data

• Account and profile: while the account is active.
• When you delete your account: we immediately delete the profile, photos, verification documents and contact details, and ask Stripe to close the professional’s payments account.
• Records of paid services and invoicing: 10 years, as required by tax law, with no public access.
• Published reviews: while the professional’s profile exists. If you ask for your customer account to be deleted, we remove your name from the reviews you left.
• Help chat messages: up to 24 months after the last contact.
• Identity document and criminal record certificate: automatically deleted 30 days after the profile is approved. If the application is declined, all documents sent are deleted 30 days after the decision. Only the record that they were checked, when and by whom is kept.
• The professional’s other documents (activity and address): while the account is active.
• Log of the team’s access and actions: 1 year.
• Notification subscriptions: until you turn them off or they stop being valid.
• Location of the professional on their way: only the last position, deleted when the professional arrives, stops sharing or the booking changes status (3 hours at most).
• Backups: the database is copied every day and each copy is kept for 14 days; files are copied every week and kept for 4 weeks. Deleted data disappears from the backups within 5 weeks at most.

7. How we protect the data

• Encrypted connection: the whole site uses HTTPS.
• Encrypted documents: professionals’ verification documents are stored encrypted (AES-256) in a private area of the server, with no public access, and can only be seen by the professional and the verification team. Request attachments are also kept in a private area, visible only to the parties to the request and to the team.
• We do not keep photo metadata: when you upload a photo (profile, work, request attachments or photos of documents), we automatically remove the information hidden in the file, such as GPS location, date and time or phone model. In videos, we delete the location. PDF files are not changed, but their metadata is not read or used.
• Team access: the management area requires two-step authentication (2FA), each team member only sees what they need for their role and all access and actions are logged.
• Protection against attacks: blocking of repeated sign-in attempts and automatic backups stored off the server.
• Data breaches: if a personal data breach occurs that poses a risk, we notify the CNPD within 72 hours and, if the risk is high, we inform you without delay.

8. Your rights

At any time, you can:

• access the data we hold about you and receive a copy;
• correct inaccurate or out-of-date data;
• delete your account and your data (professionals can do this in the professional area; customers can ask by email);
• ask for portability of your data in a commonly used format;
• object to processing based on legitimate interest, such as the Trustpilot invitation;
• restrict the processing of your data in certain situations (for example, while we check a correction request);
• withdraw any consent you have given, without affecting what was done before.

To exercise these rights, write to clientes@mimospot.com. We reply within one month at most, which may be extended by two further months for complex requests (in that case, we will let you know). If you think your data has not been handled correctly, you can lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

9. Cookies and browser storage

The details are in the Cookie policy.

We use what is needed for the site to work and, only if you accept, some optional preferences. We do not use advertising or analytics cookies. You can change your choice in Cookie settings.

What	What for	Duration
WordPress session cookies (wordpress_logged_in_*, wordpress_sec_*)	Keeping you signed in	Until you sign out (max. 14 days)
Professional sign-up cookies (tt_etapa*_token)	Saving your sign-up progress	Until you complete the step
Stripe cookies (__stripe_mid, __stripe_sid)	Payment fraud prevention	Up to 1 year
Language cookie (tt_lang)	Remembering the language you chose for the site	1 year
Team access cookie (tt_acesso)	Allowing the team to view the site during maintenance periods	90 days
Browser local storage	Remembering the help chat conversation and some preferences (for example, your last search)	Until you clear your browser data
Browser session storage	So you don’t lose what you typed in a form if the page reloads	Until you close the tab

10. Minors

MimoSpot is intended for people aged 18 and over. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this policy when the service changes. The date at the top shows the latest version. If the change is important, we will let you know by email or on the site.

12. Contact

For any question about privacy: clientes@mimospot.com.