Privacy policy

[ENTIDADE], tax number [NIF], registered office at [MORADA]. For anything about your data: [E-MAIL] or the contact page.

• Account: name, email, company, mobile, tax number (for the invoice) and the password, stored only in irreversible form.
• Brand (if you set it up): logo, trade name, colour, phone, email and website, shown on plans and share pages.
• Orders: property type, layout, floors and area, address or area and reference (optional), options, notes and messages with our team.
• Files: floor plans, sketches, land registry records and photos. Land registry records contain data on the property holders (such as name and tax number): we only use them to read the areas and description of the property.
• Payments: amount, status and Stripe references. Card details stay with Stripe; we never see them.
• Phone notifications (if you turn them on): the technical address your browser creates for notifications and the device type.
• Security: sessions (IP address, browser, dates) and failed sign-in attempts.
• Contact form: name, email, mobile, company and the message.

• Creating the account, producing, delivering and supporting orders and notifying you about them: performance of the contract (GDPR, article 6(1)(b)).
• Invoicing and tax and accounting obligations: legal obligation (article 6(1)(c)).
• Account and service security, abuse prevention and defence of legal claims: legitimate interest (article 6(1)(f)).
• Answering contact form messages: pre-contractual steps or legitimate interest in replying.
• Phone notifications and showing a job among the examples on our site: consent (article 6(1)(a)), which you can withdraw at any time.

We do not sell data, run advertising or build profiles.

• To read floor plans, land registry records and photos, we send those files, with the property type, layout, floors and area, to Anthropic's Claude API. We do not send your name or email.
• Anthropic processes this data on our behalf, does not use it to train its models and keeps it only for the short period set in its contract.
• AI makes a proposal; a person reviews every job before delivery. There are no automated decisions with legal effects on you.

• netcup GmbH (Germany): hosting of the site, database and files, on a server in the European Union.
• Anthropic (USA): AI reading of documents and photos.
• Stripe (Stripe Payments Europe, Ireland): payments. Stripe also processes data on its own account, to prevent fraud and meet its legal obligations.
• iziBizi: certified invoicing software, to issue invoices.

Emails are sent from our own mail server, with no external provider. Phone notifications pass, encrypted, through the push service of your browser's maker (Google, Apple, Mozilla or Microsoft).

Anthropic processes data in the USA and Stripe may do so. These transfers rely on GDPR safeguards: the EU-US Data Privacy Framework adequacy decision, for certified companies, or the European Commission's standard contractual clauses, included in the data processing agreements. You can ask us for a copy of these safeguards.

• Order files (floor plans, sketches, land registry records, photos): [X] months after delivery; then deleted.
• Delivered plans and tours: while the account exists and for the link period set in the Terms.
• Account: while it exists. If you ask us to delete it, we delete the data, except what the law requires us to keep.
• Invoicing data: 10 years, as required by law.
• Sessions: end after 30 days without use.
• Contact form messages: [PRAZO CONTACTOS] months.
• Backups: encrypted and in the European Union; deleted data leaves the backups as they rotate.

You can ask for access to your data, rectification, erasure, restriction or portability, object to processing based on legitimate interest and withdraw consent. Write to [E-MAIL] or use the contact page; we reply within one month. You can also complain to the Portuguese data protection authority (CNPD).

If you upload documents or photos with other people's data (for example, a land registry record naming the property holders), you confirm you may do so and that those people know their data reaches us for this purpose. Do not upload photos showing people or identity documents.

Encrypted connection (HTTPS), passwords stored in irreversible form, files accessible only to the client and the production team, and encrypted backups.

We use a single, essential cookie: t3d_sessao, which keeps you signed in for 30 days. There are no analytics, advertising or third-party cookies, and fonts are served from our own server; that is why we do not ask for cookie consent. The payment page belongs to Stripe, with Stripe's cookies and policy.

The current version is on this page, with its date. If the changes are significant, we will let you know by email.