Meet The Locals
Privacy Policy — Meet The Locals
Last updated: 10/11/2026
Meet The Locals ("MTL", "we") is a platform that strengthens local businesses in Lisbon by connecting members (customers) with partner places recommended by the people who live in the neighbourhood. This policy explains which personal data we process, why, for how long and what rights you have. It is based on the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portuguese Law 58/2019. For data subjects in Brazil, see also section 11 (LGPD).
1. Controller
- Controller: Gustavo Corsi Naitzke, a natural person, self-employed in Portugal.
- Privacy and general contact email: gustavo.mtlocals@gmail.com.
- Data Protection Officer (DPO): no data (assess whether one is required).
2. Data we process
- Waitlist and contacts: name, email, profile (e.g. visitor, resident), preferred language, consent.
- Member (customer) account: name, email, phone (optional), plan (Free, Local, Duo), join and cancellation dates, origin (e.g. a host's code).
- Visits: place visited, date and time, QR validation, benefit applied.
- Payments: handled by Stripe. MTL only receives reference data (payment status, last card digits, invoices); we do not store full card numbers.
- Partners (businesses, hosts): business name, contact person, address, tax number for invoicing, card payment details (handled by Stripe), benefit conditions.
- Ambassadors and hosts receiving commissions: identification and payout data for bank transfer, referrals made and commissions.
- Automated support: messages exchanged with our AI assistant (by email).
- Technical data: IP address, device and browser, cookies (see the Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Telling you about the launch and waitlist news | Consent (a) |
| Creating and managing your account, plans and benefits | Contract (b) |
| Validating visits, invoicing partners and paying commissions | Contract (b) |
| Meeting tax and accounting obligations | Legal obligation (c) |
| Preventing fraud (e.g. reused QR codes) and protecting the platform | Legitimate interest (f) |
| Answering requests through the AI assistant | Contract or pre-contractual steps (b) |
4. AI support and automated decisions
MTL support is by email (gustavo.mtlocals@gmail.com). An AI assistant triages and replies from the first message to onboarding: questions, forms and reminders. A person (the controller) talks directly to anyone who needs to confirm that MTL is real and trustworthy, and reviews exceptional cases (complaints, payments, suspected fraud, personal data requests). We do not take solely automated decisions with legal or similarly significant effects (GDPR art. 22). You can always ask for human review by writing "talk to a person". Transparency (art. 50 of Regulation (EU) 2024/1689, the AI Act): emails sent to gustavo.mtlocals@gmail.com are read and processed by an AI assistant used for email triage, which drafts and sends automated replies; those replies identify themselves as AI-generated. When a conversation is passed to the controller, you get a personal reply within 1 business day.
5. Who we share data with
- Stripe (card payments and invoicing).
- Email and form providers: Google email (Gmail) and Tally (processor; forms, EU).
- AI assistant: an AI assistant used for email triage, which operates the gustavo.mtlocals@gmail.com inbox (reads, sorts and answers emails). Provider's data processing terms and processing location: no data (to be confirmed).
- Website and platform hosting: Lovable (website hosting), on Cloudflare infrastructure.
- Partner places: only what is needed to validate a visit (e.g. name and QR confirmation).
- Hosts and ambassadors: aggregated figures only (number of sign-ups and visits), never your identity.
All act as processors under a GDPR art. 28 agreement or as independent controllers (as Stripe does for some processing). We do not sell personal data.
6. Transfers outside the EEA
Some providers (e.g. Stripe, Google and Cloudflare, in the USA) may process data outside the European Economic Area. In those cases we rely on GDPR safeguards such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, where applicable. Detailed list: no data (to be confirmed per provider).
7. How long we keep data
- Waitlist: until you withdraw consent or up to 12 months after launch.
- Member and partner accounts: while active and up to 24 months after closure.
- Invoices and accounting records: for the Portuguese legal period (10 years).
- AI assistant conversations: 12 months.
- Visit logs for fraud prevention: 24 months.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time without affecting prior processing. To exercise them, write to gustavo.mtlocals@gmail.com. We reply within one month. You can complain to the Portuguese supervisory authority, CNPD (www.cnpd.pt).
9. Security
We use providers with recognised security measures, restricted access, single-use QR codes valid for 3 minutes and encrypted connections. If a data breach puts you at risk, we will inform you and the CNPD within the legal deadlines.
10. Age
MTL is for people aged 18 or over. We do not knowingly collect data from minors.
11. Data subjects in Brazil (LGPD)
If you are in Brazil, Brazil's General Data Protection Law (Law 13,709/2018) also applies. The equivalent legal bases are consent, performance of a contract, compliance with a legal obligation and legitimate interest (art. 7). You have the rights in art. 18: confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, deletion of data processed with consent, information about sharing and withdrawal of consent. Data officer (art. 41): no data. You may also complain to Brazil's National Data Protection Authority (ANPD, www.gov.br/anpd).
12. Changes
We may update this policy and will notify you by email or on the platform when changes are relevant.