Privacy policy

The data controller is LUMINOUS GIANT — UNIPESSOAL LDA, trading as Porto For You. NIPC/NIF: 519357124. Commercial registration (CRC): 519357124.

Registered address: Rua Companhia dos Caolinos, 102, R/C Esq Tras, 4460-205 Senhora da Hora, Matosinhos, Portugal. Privacy contact: privacy@portoforyou.com.

Porto For You is operated by its founders, who receive and respond to enquiries.

Through the contact and supplier forms we collect:

• Name, email address, subject, and message
• Any selected experience, preferred dates, and group size when provided
• For supplier enquiries: company name and experience type
• GDPR consent timestamp, form language, and source page
• Limited technical information needed for security (for example Turnstile verification results and rate-limiting signals)

For bookings and payments we process proposal and booking references, agreed amounts in EUR, payment status metadata, and identifiers needed to authenticate a payment link.

We do not ask for payment card numbers, CVC codes, or full card details on this site; Stripe collects payment details on checkout.stripe.com when you pay.

We use form data to:

• Review, manage, and reply to your enquiry or supplier request
• Prepare proposals for stays or experiences
• Create and fulfil bookings
• Take payment for agreed proposal amounts
• Coordinate with the suppliers involved when agreed fulfilment requires it
• Protect our forms and payment endpoints against spam, bots, and abuse

We use aggregate analytics (Cloudflare Web Analytics, Ahrefs Web Analytics, and, with your consent, Google Analytics) to understand how the site is used so we can improve it.

We process form submissions on the basis of your consent (the GDPR checkbox) and, where your request concerns a possible stay, experience or supplier relationship, to take steps at your request before entering into a contract (GDPR Art. 6(1)(a) and 6(1)(b)).

Booking and payment processing for an accepted proposal is based on performance of a contract (Art. 6(1)(b)) and, where required, our legal obligations. Security and anti-abuse measures are based on our legitimate interests in keeping the website safe (Art. 6(1)(f)).

You may withdraw consent at any time without affecting earlier lawful processing.

This website is hosted on Cloudflare. Contact and supplier submissions are stored in a Cloudflare D1 database and emailed to the Porto For You founders so they can reply. Cloudflare Turnstile verifies that form submissions are human.

Cloudflare acts as our processor for hosting, D1 storage, Turnstile, and email delivery infrastructure. Stripe processes online payments as our payment service provider when you use hosted Checkout.

When an enquiry or booking requires a supplier to deliver part of a stay or experience, we may share the relevant fulfilment details with that supplier. We do not sell your personal data.

When you open a payment link and continue to Stripe Checkout, payment-card and related payment data are processed by Stripe on Stripe’s domains.

We store booking and payment status metadata needed to confirm your booking after Stripe notifies us by webhook. We do not embed Stripe.js on this site for hosted Checkout redirects.

We use Cloudflare Web Analytics and Ahrefs Web Analytics. Both are cookieless: they do not set client-side cookies for analytics.

Separately, we use Google Analytics (gtag.js) to understand aggregate traffic and improve the site. Google Analytics uses cookies and similar storage only after you accept analytics cookies in our consent banner. Until then, Google Consent Mode keeps analytics storage denied.

You can change or withdraw analytics consent at any time via Cookie preferences in the site footer.

Strictly necessary first-party cookies include “lang” and “currency” (language and currency preferences), our consent preference cookie, “pfy_pay_token” (secures booking payment return pages after you open a payment link), and technologies Cloudflare Turnstile may use for security and bot protection on forms. These are required for the site, forms, and payment-link flow to work and are not used for advertising.

Optional analytics cookies from Google Analytics (_ga, _ga_*, _gid) are set only if you accept analytics in the cookie banner.

When you pay via Stripe hosted Checkout, Stripe may set essential cookies on its own domains for payment security and fraud prevention; those cookies are not set by this website and are not an optional marketing category on our banner. Manage your choice anytime via Cookie preferences in the footer, or see this policy for more detail.

Contact and supplier submissions are scheduled for deletion 12 months after receipt, unless we need to retain a record longer to establish or manage a contractual relationship, meet a legal obligation, or handle a dispute.

Booking, payment, and related audit records are retained as needed for contract performance, accounting, and legal holds. Security and rate-limit logs are kept only as long as needed for those purposes.

Under the GDPR and Portuguese law, you may ask to:

• Access your personal data
• Rectify inaccurate data
• Erase your data
• Restrict processing
• Receive a copy of your data (data portability)
• Object to processing based on legitimate interests
• Withdraw consent where processing is consent-based

To exercise these rights, contact us using the details below.

For privacy requests, email privacy@portoforyou.com or write to LUMINOUS GIANT — UNIPESSOAL LDA (Porto For You), Rua Companhia dos Caolinos, 102, R/C Esq Tras, 4460-205 Senhora da Hora, Matosinhos, Portugal.

You may lodge a complaint with Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) at https://www.cnpd.pt/, if you believe your data-protection rights have not been respected.

We would appreciate the chance to resolve concerns with you first.

Experience pages include an embedded map from OpenStreetMap (openstreetmap.org) to show the meeting point. When your browser loads this embed, it connects directly to OpenStreetMap servers, which may receive your IP address and basic browser information.

This data is processed by OpenStreetMap under its own privacy policy (https://wiki.osmfoundation.org/wiki/Privacy_Policy). We do not control this processing and recommend reviewing OpenStreetMap's policy if you have concerns.

The embed is loaded lazily and only connects when the map section enters the viewport.