Privacy policy

Controller: [TO COMPLETE: legal name of the individual or organisation, tax identification and address]. Privacy contact awaiting validation: [TO COMPLETE: a working privacy email address]. The website contact form is not a confirmed channel for exercising data rights.

Depending on the interaction, data includes professional contacts, company information, notes, sources, drafts and contact history, proposals, team accounts, permissions and sessions. Technical connections and security controls may process IP addresses and logs.

The contact form is prepared to receive a name, email, company, service and message; email delivery is not active in production. CRM information can come from the team, public IMPIC records, company websites and web searches. Public availability alone does not authorise reuse or marketing.

Data supports enquiries, proposals, commercial research and follow-up, access management and security. Claude, through the Anthropic API, supports web research, analysis and drafts using company data and source excerpts that may contain personal information.

AI output requires human review and can contain errors. The CRM does not send commercial emails. Human approval or manual sending does not exempt a message from marketing rules.

The basis must be established for each purpose: requested pre-contractual steps where applicable; documented legitimate interests only if necessity and balancing permit; and consent where required. Reading this policy is not consent to marketing.

Natural-person email marketing generally requires prior express consent, subject to the existing-customer exception. Corporate recipients have a distinct opposition regime, including the DGC list. A work email alone does not establish eligibility. The notice procedure for indirectly obtained data still needs to be completed.

Cloudflare provides hosting; Supabase provides database, authentication and application processing; Anthropic provides AI with global processing. Processing exclusively within the EU is not established. [TO COMPLETE: contracted entities, recipients, locations, retention, agreements and applicable transfer safeguards].

Resend is prepared for contact-form email delivery but remains inactive until configured. Spline loads an external visual resource; a network request does not, by itself, establish cookies or tracking. Provider roles and actual data flows require review.

[TO COMPLETE: retention periods or criteria and deletion procedures for enquiries, CRM and sources, AI analyses, messages, proposals, accounts, logs, objections and backups]. These decisions and procedures remain incomplete; no fixed period or automatic complete erasure is established here.

Where applicable, you have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent. An objection to direct marketing also covers related profiling. The operational contact remains unconfirmed: [TO COMPLETE: a working privacy email address].

You may complain to the competent authority, including Portugal’s Comissão Nacional de Proteção de Dados (CNPD). This provisional text does not suspend your legal rights.

The website and private areas use language, authentication, proposal-session and preference mechanisms, including cookies or local storage where applicable. Their use varies by page and interaction.

Optional analytics is disabled and no provider has been selected. Before activation, the provider, purposes, storage, duration and consent controls must be specified and validated. Technical hosting and external-resource requests are distinct from optional analytics.

This provisional version will be replaced after the missing information and procedures have been completed and checked. Material changes may require updated information and a new consent choice.