Privacy policy

RMI is responsible for the data you leave on ricardomendoza.pt, in the app and in the assistant. We use it to reply to you, to manage bookings and, only with your yes, to send you news and measure our ads. We never sell data.

The Meta pixel and the record of where your visit came from only work if you click “Accept” in the cookie notice. The messages you write in the assistant are processed by an AI model on Amazon Web Services, in the United States: please do not write health information or other sensitive data there.

You can ask to access, correct or delete your data, or withdraw a consent, at any time, by writing to info@ricardomendoza.pt.

The data controller is Resultados Máximos Internacional, Unipessoal, Lda. (RMI), company and tax number 510 717 837, registered office at Avenida Menéres, 384, 2.º Esq. Trás, 4450-189 Matosinhos, Portugal. RMI is the company that runs Ricardo Mendoza's training, immersions, mentoring and talks.

For anything about your data, write to info@ricardomendoza.pt or to the address above. You can also call +351 917 054 002 (a Portuguese mobile number).

We process data under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Portuguese Law 58/2019 and Portuguese Law 41/2004, which covers electronic communications and cookies.

It covers the ricardomendoza.pt website, Ricardo Mendoza's app (app.ricardomendoza.pt) and the AI assistant in both.

The Saboteurs Test and joining the community happen on mentesgigantes.pt, another RMI website with its own notice. If you use the same email there, what you leave is added to your record in our CRM, and your test result shows in the app.

The community is a WhatsApp group. If you join it or write to us on WhatsApp, your number and messages go through WhatsApp (WhatsApp Ireland Limited) under its own rules. In the group, the admins and, depending on the group settings, other members can see your name and number. When you leave the website for another service (Instagram, Facebook, LinkedIn, YouTube or the press), that service's privacy policy applies.

Contact details: name, email and, when you give it, your mobile number.

Your request: what you write and choose in the form. Depending on the form: subject and message; the ticket or event you are interested in; company, job title, number of people, topic and preferred date (company and club requests); city, availability, the area where you want to help and your motivation (applications); and the door you got in “your next step”.

Consents: whether you accepted the privacy policy, whether you want to receive news, the policy version and the date and time you did so.

Your visit: the page with the form, the language and, if you accept measurement cookies, where the visit came from (for example, a campaign with utm parameters, a source code or the website you came from) and the Meta identifiers _fbp and _fbc.

Technical data: IP address, browser and device type, date and time of requests. We use them to run the website and to stop abuse.

The assistant: the messages you write, the replies, the page you were on and a random session number.

The app: your email, the access codes (stored only as a hash), the session, the language, the editions you are booked on and, if you took the Saboteurs Test, the result (an index from 0 to 100 and your two main saboteurs). The result describes thinking habits: it is not a diagnosis and not health data.

Paid bookings: invoice details (name, tax number and address, if you give them) and the payment confirmation. When you pay through a payment link, your card details stay with the payment provider and do not reach RMI.

Where it comes from: almost everything comes from you. The test result comes from mentesgigantes.pt, if you took it with the same email. Your stage (for example, “took the test” or “came to an event”) is worked out by the CRM from what you did.

Replying to your request (contact, booking, application, proposal request): steps taken at your request before a contract (GDPR, art. 6(1)(b)). Required fields are the ones we need to reply; without them we cannot handle the request.

Managing your booking and invoice, if you buy: performance of the contract (art. 6(1)(b)) and compliance with legal obligations, such as tax rules (art. 6(1)(c)).

Sending you news, dates and alerts by email: your consent (art. 6(1)(a)). You only get the newsletter and general news if you subscribed to it or ticked “I want to receive news and invitations by email”; a “Keep me posted” alert is only about the experience you chose; “your next step” sent by email brings the result and the next dates. You can leave from any email. List emails record whether they were opened and which links you clicked, so we know what interests people.

AI assistant: answering your questions and keeping the conversation, so the team can see what people ask and improve the answers: legitimate interest (art. 6(1)(f)). Keeping your contact details, if you leave them in the assistant for the team to reply: your consent (art. 6(1)(a)).

Measuring our ads and showing them to people who have visited us (Meta pixel and Conversions API, where the visit came from): your consent (art. 6(1)(a) GDPR and art. 5 of Law 41/2004). Without “Accept”, none of this runs.

Organising contacts in the CRM (seeing where each request stands, not contacting you twice about the same thing, knowing which experiences interest you): legitimate interest (art. 6(1)(f)).

The app (signing in with a code, showing your profile, the calendar, your bookings and your index): performance of the app's terms of use (art. 6(1)(b)). If you sign in to the app without being in the CRM, we create your record with your email.

Security (stopping automated submissions and abuse, counting requests per IP address, keeping technical logs): legitimate interest (art. 6(1)(f)).

Complying with the law and defending our rights (invoices, complaints, requests from authorities, disputes): legal obligation (art. 6(1)(c)) and legitimate interest (art. 6(1)(f)).

When the basis is legitimate interest, we only process what that purpose needs, and you can object at any time (GDPR, art. 21).

The assistant is an artificial intelligence system: it is not Ricardo and not a member of the team. It tells you so on its first screen, as required by article 50 of Regulation (EU) 2024/1689 (the AI Act).

The buttons reply with fixed texts. When you type a question, the reply is written by the Claude model, made by Anthropic, running on the Bedrock service of Amazon Web Services (AWS) in the United States. For each reply we send your message, the latest messages of the conversation (up to 8) and the page you are on. Prices, dates and venues come from fixed texts on the website, not from the model. According to AWS, Bedrock does not store the messages, does not use them to train models and does not share them with Anthropic. We do not use conversations to train AI models either.

Each turn of the conversation is saved in our CRM, with a random session number, for 12 months. If you leave your details in the assistant, or later send a form in the same browser, the conversation is linked to your contact, so the team knows what you already asked.

Do not write in the assistant health information, card or bank details, passwords, ID numbers or other people's data. The assistant does not give medical, psychological, legal or financial advice and makes no decisions about you.

If a message mentions a crisis or danger, the assistant immediately replies with 112 and support lines, and that conversation is flagged in the CRM for the team to see.

The Meta pixel is code from Meta Platforms Ireland Limited. It only loads in your browser after you click “Accept” in the cookie notice. It records the pages you view and actions such as sending a form or opening WhatsApp, together with your IP address, browser type and the _fbp and _fbc cookies.

If you accepted, when you send a form (including details left in the assistant), our server also sends Meta a record of that request through the Conversions API. The record includes the type of request, the page, the date and time, your IP address, browser type, the _fbp and _fbc cookies and your email, mobile number, name and session number converted by a hash function (SHA-256). Meta compares these codes with those of the accounts it knows, so they are still personal data.

This tells us which ads bring real requests, helps Meta show the ads to the people most likely to be interested and lets us show ads to people who have visited the website.

For collecting and sending this data, RMI and Meta Platforms Ireland Limited are joint controllers (GDPR, art. 26). We are responsible for asking for your consent and informing you; what Meta does with the data afterwards is Meta's responsibility and is described in Meta's privacy policy. You can exercise your rights with us or with Meta.

If you refuse, we send nothing to Meta, neither from your browser nor from our server. You can change your mind at any time with the “Manage cookies” button at the bottom of every page. If you withdraw consent, we delete this website's measurement cookies and stop sending data to Meta; what was already sent is subject to Meta's rules.

We never sell data. We only share it with providers who help us run the service, process it on our behalf and under our instructions, and are bound by contract to protect it (GDPR, art. 28):

Cloudflare (hosting of the website and of the functions that receive forms and run the assistant; anti-abuse counters in a database in Western Europe): global network, EU and US.

Kit, formerly ConvertKit (our contact list: it keeps the name, email, mobile number, language, visit source and a request tag of everyone who sends a form, and sends the list emails): US.

Resend (confirmation emails, team alerts and app access codes): US.

Supabase (the CRM and app database: requests, assistant conversations, bookings and app sessions): EU/US.

Amazon Web Services (the assistant's AI model, on the Bedrock service): US (us-east-1 region and, through automatic AWS routing, other US regions).

aidone.pt (D'One), in Portugal: builds and maintains the website, the CRM and the app on RMI's behalf. Some of the services above are contracted through it.

The team's email provider, which receives the alert for each request, and the payment provider of the link we send you, if you pay that way.

Other recipients: Meta, as joint controller, if you accept measurement cookies (see above); our certified accountant, for invoicing; and public authorities, when the law requires it.

Within RMI, your data is only seen by those who need it to reply to you or to organise the experiences.

Kit, Resend and AWS process data in the United States, and Cloudflare, Supabase and Meta may also do so. We only allow this with one of the GDPR safeguards (arts. 45 and 46): the EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795), when the recipient is certified, or the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914). We check each provider's safeguard case by case, and you can ask us which one applies to each.

Requests without a purchase (contact, booking, application, proposal, date alerts): up to 3 years after our last contact with you. Then we delete or anonymise them.

Email list: until you leave or withdraw consent. Anyone who goes 3 years without opening or clicking one of our emails is removed from the list.

Paid bookings: while our relationship lasts and up to 3 years after the last edition you attended. Invoices and accounting records: 10 years, as required by article 123 of the Portuguese Corporate Income Tax Code.

Assistant conversations: 12 months in the CRM. In your browser they stay until you clear the website's data; in the app, until you tap “New conversation” or “Sign out”.

App: the session lasts 90 days or until you tap “Sign out”. Access codes are valid for 10 minutes.

Proof of consent: for as long as the data it relates to. Technical and security logs with the IP address: up to 30 days.

If there is a complaint or a dispute, we keep what is needed until it is resolved.

You have the right to: know what data we hold about you and get a copy; correct it; delete it; restrict its processing; receive it in a commonly used format to take it to another service (portability); object to processing based on legitimate interest; and withdraw a consent at any time, without affecting what was done before.

You can always object, without giving reasons, to receiving marketing and to your data being organised for that purpose. You also have the right not to be subject to decisions made solely by automated means with legal effects on you; we make no such decisions.

To exercise a right, write to info@ricardomendoza.pt. It is free. We reply within one month; in complex cases this can extend to three months, and we tell you why. If we are unsure who is making the request, we may ask you to confirm it, for example by replying from the email you gave us.

To stop receiving emails, use the unsubscribe link at the bottom of any email. To change your cookie choice, use the “Manage cookies” button.

If you believe your rights have not been respected, you can complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, phone +351 213 928 400, cnpd.pt, or to the data protection authority of the country where you live or work.

The website, forms, assistant and app are not intended for people under 16. If you are under 16, ask a parent or legal guardian to contact us. Paid bookings for people under 18 are made by a parent or legal guardian. If we learn that we have received data from someone under 16 without that permission, we delete it.

We do not ask for health data or other special categories of data (GDPR, art. 9), such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation. Please do not write them in the forms, the assistant or the app.

If you write them anyway, we use them for nothing other than replying to you and we do not send them to Meta. The team deletes any health data it finds in conversations and requests, and you can ask us to delete everything at any time.

We make no decisions based solely on automated processing that have legal effects on you or affect you in a similarly significant way (GDPR, art. 22). The assistant replies automatically but decides nothing. The CRM sorts contacts by stage automatically, so the team knows what to offer you; decisions, such as accepting an application, are always made by a person.

All connections to the website and the app are encrypted (HTTPS). The CRM only opens with each team member's personal account. App access codes and sessions are stored only as hashes. Forms and the assistant are protected against automated submissions.

If there is a data breach that puts you at risk, we notify the CNPD and, when the law requires it, you too (GDPR, arts. 33 and 34).

This is the version of 3 November 2026. If we change it, we publish the new version here with its date. If the change is significant and we have your email, we let you know.