Last updated: 29/07/2025
This Privacy Policy explains how Mutable Potential Lda (“we”, “us”, “our”) handles personal data when you visit cannabud.ai, use our mobile application, access our online backoffice, contact us, or use our services. It also clarifies when we act as controller and when we act as processor on behalf of customers.
Controller: Mutable Potential Lda (NIF 517017849)
Address: R. Bernardo Santareno, n.º 27, Portugal
Email: team@mutablep.com
We process personal data in line with the General Data Protection Regulation (GDPR) and applicable Portuguese law. When we process data on behalf of a customer under a data processing agreement, the customer is the controller and we are the processor. If your data was supplied to our platform by one of our customers, please address requests directly to that customer.
This notice covers:
Identification & contact details (e.g., name, email, company, phone)
— To respond to enquiries, provide requested services, manage accounts, and send opted-in updates.
Technical & device data (e.g., IP address, browser/OS, device type, error logs, device identifiers, app version)
— To deliver content, maintain security and stability, detect fraud/abuse, diagnose issues, and ensure app compatibility.
Usage data (e.g., pages/screens viewed, clicks/taps, session duration, referrers, feature usage patterns)
— To improve site/app performance, user experience and content relevance (consistent with your cookie/consent settings).
Location data (approximate location based on IP or, with permission, device location)
— To provide location-relevant features, comply with regional regulations, and prevent fraud.
Communications (emails, chat transcripts, support notes, in-app messages)
— To provide support, fulfil requests, and maintain appropriate records.
Customer content (data uploaded by customers into our services)
— Processed strictly to provide the contracted service, under the customer’s instructions (processor role).
Recruitment data (CVs, cover letters, interview logistics)
— To assess applications and manage the hiring process.
Legal bases
Depending on context: consent (e.g., non-essential cookies/marketing, camera access), contract or pre-contract steps, legal obligations, and legitimate interests (e.g., security, service improvement, fraud prevention).
Our mobile application requires certain permissions to function properly:
Camera Permission
— Used exclusively to scan QR codes for operational actions within the app. Camera access is requested only when you initiate a QR code scanning action. No images are stored unless explicitly required for the operational task, and camera access can be revoked at any time through your device settings.
File/Photo Library Access
— Used to allow you to select and scan QR codes from existing images in your device gallery. This permission is requested only when you choose to upload an image containing a QR code. We do not access, scan, or store any other images from your device.
App-Specific Data Collection:
All app data transmission is encrypted using industry-standard protocols. The app does not access contacts, microphone, or other sensitive permissions unless future features require them (in which case, we will update this policy and request explicit consent).
Our online backoffice platform provides secure access to manage your account and services:
Security Measures:
Data Usage:
We use cookies and similar technologies to run the site and, with your consent, for additional purposes (e.g., audience measurement). We operate a consent banner using Yescookie, which lets you grant, refuse, or withdraw consent at any time. Your choices are recorded to demonstrate compliance. You can also control cookies through your browser settings.
The mobile app may use similar tracking technologies (like mobile advertising IDs) subject to your device settings and consent preferences.
A detailed list of cookie categories and third-party cookies (if any) is provided in our Cookie Policy.
We use third-party providers to operate, secure, and support our website, app, and backoffice. They act as processors under contracts that require confidentiality, security, and GDPR-compliant safeguards:
Hostinger — hosting and infrastructure for cannabud.ai (storage, delivery of web content, basic server logging).
WordPress — our content management system and website framework (including core, themes, and plugins we select).
Tawk.to — live-chat and messaging on the website (handling chat messages, metadata necessary to deliver the chat, and, if you provide them, your contact details).
Mobile App Providers:
Notes:
International transfers: If a provider stores/handles data outside the EEA, we use appropriate safeguards (e.g., EU Standard Contractual Clauses) and limit transfers to what’s necessary for the service.
We do not sell personal data.
We may share personal data only in these circumstances:
We never share personal data for third-party marketing purposes.
We maintain appropriate technical and organisational measures:
We design for privacy by default and by design and review safeguards periodically.
We keep personal data only as long as needed for the purposes described or to meet legal/accounting requirements:
Where processing relies on consent, we delete data when consent is withdrawn unless another legal basis applies.
Under the GDPR, you have the right to:
To exercise your rights, contact team@mutablep.com. We will respond within 30 days.
Contact forms & email: If you contact us, we process the data you provide to handle your request and keep relevant records.
Live chat (Tawk.to): When you use chat, the content of your messages is processed to provide support. The chat widget may process technical metadata (e.g., timestamps, device/browser details) required to deliver the service. Please avoid sharing sensitive information via chat.
Accounts/login: We process login credentials and apply security measures (e.g., optional 2FA). Account data is deleted after closure, subject to legal retention. Users should export their data before requesting deletion.
Newsletters/marketing: We will send electronic communications only with your consent or as permitted by law. We log opt-ins to demonstrate compliance and maintain suppression lists to honour opt-outs.
QR Code Scanning: When you scan QR codes through the app, we process only the encoded data for the intended operational purpose. No additional image data is retained.
Our services are not directed to children under 16. If you believe a child provided us personal data, please contact us immediately and we will take appropriate action to delete such information.
While not legally required to appoint a DPO, we have designated a privacy contact who can be reached at team@mutablep.com for any data protection queries or concerns.
When we transfer personal data outside the EEA, we ensure appropriate safeguards:
We do not use automated decision-making or profiling that produces legal or similarly significant effects. Any analytics or personalization features are designed to improve user experience and can be opted out of.
We may update this notice from time to time. Material changes will be:
Continued use of our services after changes constitutes acceptance, except where re-consent is legally required.
Mutable Potential Lda
R. Bernardo Santareno, n.º 27, Portugal
Email: team@mutablep.com
NIF: 517017849
For urgent privacy matters, please include “URGENT: Privacy” in your email subject line.
This privacy policy is provided in English for convenience. In case of any discrepancy with Portuguese legal requirements, the Portuguese version prevails.
