Privacy Policy

This website is the personal professional portfolio of [Legal name / business name] ([Street address, postal code, city, Portugal], tax / VAT details: [Tax / VAT number, if applicable]). It is an informational site. It has no user accounts, no login, and no sign-up.

Separately, the site owner operates private automations for their own use. These are not public products or services, are not offered to visitors, and cannot be signed up for from this website. Where those automations use Google APIs, the disclosure in section 6 applies.

• Contact data you choose to send. If you email the address published on this site, the message and any details it contains are processed in order to reply.
• Technical data from hosting. Serving a web page necessarily involves your IP address and browser request information being processed by the hosting provider, and may be retained in server logs for security and reliability purposes.
• No form submissions. The contact form on this site is a user-interface placeholder only. It does not transmit, store, or email anything.
• No analytics or tracking. This site uses no analytics, advertising, tracking pixels, or profiling technologies.

• Responding to professional enquiries — legitimate interests, or steps taken at your request prior to entering a contract.
• Operating and securing the website — legitimate interests in providing a functioning, secure site.
• Complying with legal obligations, where applicable — legal obligation.
• Any optional processing that requires it — consent, which may be withdrawn at any time.

Data is held using access-controlled accounts and services with credentials kept out of source code and access limited to what is necessary. No security measure is absolute, and no guarantee of absolute security is made.

Enquiry correspondence is retained only as long as needed for the professional relationship or as required by applicable law [insert retention period, e.g. 24 months]. Server logs are retained according to the hosting provider's standard periods.

• Website hosting and content delivery provider
• Email provider used for correspondence
• Google Cloud and Google APIs, for the private automations described in section 6
• Anthropic (Claude API), where AI processing is used in those automations
• Slack, where the owner-requested digest is delivered to a private channel

[Insert the specific named providers and their roles before publication.]

This application may use Google APIs, including Gmail API, only after a user explicitly authorizes access through Google OAuth. Where Gmail access is used, the application requests the minimum necessary scope, such as gmail.readonly, to read email messages for the limited purpose described to the user, such as creating a personal work or project digest.

Google user data is not sold. It is not used for advertising, creditworthiness, or unrelated profiling. It is not shared with third parties except where necessary to provide the requested service, such as sending a user-authorized summary to the user's selected private communication channel or using a configured AI processing provider solely to generate the requested summary.

The application does not modify, delete, archive, or send Gmail messages unless the user separately authorizes an explicit feature requiring that permission. Users can revoke access at any time through their Google Account security and third-party access settings.

In practice, this authorization is given by the site owner for their own Google account. The automation is private and owner-operated: it is not a public product and no visitor to this website is asked to connect a Google account. Selected Gmail message content may be processed by Google Cloud, the Anthropic Claude API, and Slack solely to generate and deliver an owner-requested daily project digest, and for no other purpose.

Fuller detail is provided on the Google API Services Disclosure page, and revocation and deletion steps are on the Data Deletion and Google Account Access page.

Some providers listed above may process data outside the European Economic Area. Where that happens, transfers are intended to rely on an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. [Insert the specific transfer mechanism relied upon for each provider.]

Subject to applicable data protection law, including the EU General Data Protection Regulation where it applies, you may have the right to:

• Request access to the personal data held about you
• Request rectification of inaccurate data
• Request erasure of your data
• Request restriction of, or object to, processing
• Request data portability
• Withdraw consent at any time, without affecting prior lawful processing

To exercise any of these, contact hello@example.com. You may also lodge a complaint with your local supervisory authority — in Portugal, [Comissão Nacional de Proteção de Dados (CNPD), Portugal].

[Placeholder: if personal data is processed on behalf of a client as a processor, insert or link the applicable Data Processing Agreement and describe sub-processors, security measures, audit rights, and breach notification terms here.]

This policy may be updated as the website or the owner's automations change. The last updated date is shown at the top of this page.