Privacy Policy

The controller of your personal data is Murilo Lima, who provides private chef and catering services under the Thyme brand in Porto, Portugal. For any privacy question, email us at hello@thyme.pt.

• Menu requests: when you fill in the form, we collect your name, email, event date, number of guests, location, type of experience, dietary restrictions and your message. The form prepares a WhatsApp message: the data only reaches us if you send it.
• Direct contact: the data you send us by WhatsApp or email (for example, your name, phone number and event details).
• Browsing data: technical information about your visit, such as pages viewed, device, browser and where the visit came from (for example, an ad).

Any dietary restrictions or allergies you share may reveal health information. We use them only to prepare your menu safely.

• To answer your request, prepare a proposal and organise the event: pre-contractual steps and performance of a contract.
• To handle dietary restrictions and allergies: your explicit consent, given when you share them.
• To meet legal obligations, such as invoicing: legal obligation.
• To count site visits without cookies, so we know how the site is used: legitimate interest.
• To measure the results of our Google and Meta (Facebook and Instagram) ads and show relevant ads: your consent, given in the cookie panel.

We do not sell your data. We use these providers, which process data on our behalf or under their own policies:

• WhatsApp and Meta Platforms Ireland: messaging and, with your consent, ad measurement (Meta Pixel).
• Google Ireland: Google Ads and Tag Manager, with your consent.
• Lovable: website hosting and cookie-free visit counting.
• Our email provider and our accountant, when needed.

Some of these providers may transfer data outside the European Economic Area, including to the United States. In those cases, transfers are covered by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission.

We use cookies and similar technologies for:

• Necessary: storing your cookie choices. Always on.
• Analytics: understanding how the site is used. Only with your consent.
• Advertising: measuring Google and Meta ad results and showing relevant ads. Only with your consent.

On your first visit you can accept, decline or choose by category. You can change your choice at any time in Cookie preferences, in the site footer. Even without consent, Google may receive cookieless signals without identifiers, under Google's consent mode.

Lovable's visitor analytics uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. It records pages visited, where visitors came from, country, browser, operating system and device type, time on page, page loading speed and errors. It also records clicks, identified by their position on the page rather than their text.

Analytics starts denied worldwide. Clicks are recorded after you accept analytics, including a valid saved acceptance, and never if your browser sends the Global Privacy Control signal. There is one exception: if the stored analytics choice is cleared in another tab while this page is open, the site may enable analytics without a new acceptance when it identifies your country as outside its consent-required regions (the EU/EEA, the UK, Switzerland, the listed French overseas territories and Canada). Page visits, time on page, page speed and errors are counted for every visitor, without cookies and without identifying anyone.

Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

Your browser stores your language choice and your separate analytics and advertising choices, including when you made them, plus an advertising compatibility record. Google Tag Manager receives the consent settings and site events such as page navigation, menu requests and contact clicks. Google and Meta may store advertising identifiers when you consent; WhatsApp receives the message and contact details you choose to send. Your email provider receives emails you send.

• Requests that don't lead to a booking: up to 12 months after the last contact.
• Client and invoicing data: for the period required by Portuguese tax law (currently 10 years).
• Cookie choices: up to 12 months. After that, we ask again.
• Ad data: according to the periods set by Google and Meta.

Lovable keeps detailed visitor-analytics data for 90 days and daily summaries for one year.

Cookie choices are stored in your browser for up to 12 months; a refusal may be requested again after approximately six months, without enabling tracking automatically.

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. You can also withdraw consent at any time, without affecting processing already carried out. To exercise these rights, email hello@thyme.pt. We reply within one month.

If you believe your data is not being handled properly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

We use platforms with encrypted connections and limit access to your data to what is needed to provide the service.

We may update this policy. The date of the last update is shown at the top of this page.