Last updated: 23 October 2026.
1. Controller
The controller of the personal data is Filipe Clemente, a sole trader (brand estou.ai), who can be contacted at hello@tibly.eu.
tibly is a B2B digital menu and QR menu platform for restaurants in Portugal.
2. Data we process
We process the data a restaurant gives us when it creates an account, manages the menu, or asks for a demo:
- Account: name, email and sign-in details.
- Restaurant and menu: name, contact details, the venue address, opening hours, categories, dishes, prices, photos, allergens and other information the restaurant publishes.
- Demo request: name, email, restaurant name, phone, city, message and how they heard about us.
- Technical data: IP address, date and time of the request, and session identifiers the site needs in order to work.
This application does not ask for card details. Billing is handled by invoice and, when relevant, by proof of payment sent by the restaurant.
3. Purposes and legal bases
- To create and manage the account and to provide the digital menu service. Basis: performance of a contract, GDPR Article 6(1)(b).
- To answer demo and contact requests. Basis: pre-contractual steps taken at the restaurant's request.
- Security, abuse prevention and legal duties. Basis: legal obligation and legitimate interest.
- Aggregated menu visit metrics (view counts, time, channel and device), without identifying the restaurant's guests. Basis: legitimate interest.
Processing follows Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019 of 8 August.
4. Retention
We keep account and menu data while the account is active. After it closes, we keep it for as long as legal duties, invoicing and the defence of claims require. Demo requests are kept while they are useful for the conversation and for no more than 24 months after the last contact, unless a different legal duty applies.
5. Sharing and processors
We do not sell personal data. When they are configured in the installation, we may use these processors, which handle data on our behalf:
- Mailgun, for transactional email (account confirmation, password reset and notices).
- Amazon S3, or a compatible storage service, for images uploaded by the restaurant.
- Google Places, to suggest addresses in the restaurant form.
- Meilisearch, for internal search.
- The hosting service where the application runs.
Visit metrics are processed in the application itself. We do not use advertising networks.
6. Rights
The data subject may ask for access, rectification, erasure, restriction, objection and, where it applies, portability. They may also withdraw consent where processing is based on it. That does not affect processing already carried out. Requests go to hello@tibly.eu.
7. Complaints
A complaint can be lodged with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), at https://www.cnpd.pt.
8. Updates
When this policy changes, we update the date at the top of the page.