Privacy policy
Metproof is provided by José Mendonça. This policy explains how we handle the personal data of people who have an account on the service and of visitors to the site. The ticket data our customers upload is handled as a processor, under the data processing agreement.
1. Who is the controller
José Mendonça (sole trader), trading as Metproof, a StackCare product, tax number (NIF) PT207822166, Rua do Heroísmo, 84, 4300-254 Porto, Portugal. Privacy contact: privacy@metproof.com.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (stored hashed), two-factor and passkey data | Create and protect the account and provide the service | Performance of the contract |
| Company name, tax or VAT number, billing address, subscription and payment history (we do not store card numbers) | Billing, invoicing and tax obligations | Performance of the contract and legal obligation |
| IP address, browser type and technical server logs | Security, abuse detection and troubleshooting | Legitimate interest |
| Emails we send you (account verification, alerts, reports you schedule) | Provide the service | Performance of the contract |
We do not use data for advertising or automated decisions, and we do not sell it.
3. Who we share it with
- The subprocessors on the subprocessor list, which process data only on our behalf.
- Stripe Payments Europe, Ltd. (Ireland (EU)), which processes payments. It may process data outside the European Economic Area under the safeguards described in its own privacy policy.
- Our accountant and invoicing software, for tax obligations.
- Authorities, where the law requires it.
4. Where the data is
The application server and the backups are in Germany, inside the European Economic Area. We do not transfer ticket data outside the European Economic Area.
5. How long we keep it
- Account data: while the account exists, and deleted within 30 days after it is closed. Backups expire within the period stated in the data processing agreement.
- Invoicing documents: for the period tax law requires.
- Technical server logs: at most 90 days.
6. Your rights
You can ask for access, rectification, erasure, restriction, portability, and object to processing, by writing to privacy@metproof.com. We reply within one month. You can also complain to the Portuguese data protection authority, the CNPD (cnpd.pt).
If your data is in tickets uploaded by a customer of ours (for example your name in a title), that customer is the controller and you should contact them.
7. Cookies
We use only strictly necessary cookies, to keep you signed in and to protect forms. We use no analytics or advertising cookies, so no consent is requested.
8. Security
We apply technical and organisational measures appropriate to the risk, described in Appendix B of the data processing agreement. If a personal data breach affects you, we will notify you and the supervisory authority as the law requires.
9. Changes
When we change this policy in a material way, we notify account holders by email. The version in force is the one shown at the bottom of this page.