Privacy policy
This page explains what personal data this site collects, why, and what your rights are. I write in plain language on purpose.
Who is responsible
Luís Agostinho, Rua Pereira Henriques 5, 18B, Marvila, 1950-242 Lisboa. For anything about your data, write to info@agostinhosoftware.pt.
What I collect
I only collect data when you write to me through the contact form: your name, email, message and the language of the page you were on. I use it only to reply to you. The legal basis is your consent, which you give by sending the form.
To prevent abuse, the site keeps your IP address in server memory only, for at most one hour, to limit how often requests can be made. When you send a message through the contact form, I also store in the database, for at most one hour, an encoded fingerprint (a hash) of that address, never the address itself, to limit how many messages can be sent per hour. The legal basis is my legitimate interest in preventing abuse.
When someone gets a password wrong while signing in to the client area or the admin, I store in the database, for at most one hour, an encoded fingerprint (a hash) of the IP address and email used, never the values themselves, so that anyone trying to guess passwords is blocked for 15 minutes. The legal basis is my legitimate interest in protecting accounts.
If you ask to reset your password, I use the email you type to find your account and send you a single-use link that works for one hour. In the database I keep only an encoded fingerprint of that link and, for at most one hour, encoded fingerprints (hashes) of the email and IP address used in the request, never the values themselves, to limit abuse. The answer is the same whether or not an account exists with that email. The legal basis is providing access to your account and my legitimate interest in protecting it.
Customers with an account
If you are my customer and have a portal account, I store your name, email, the language you choose for the portal, the requests and answers you write and the screenshots and documents (PDF or Excel) you attach. I use them only to run your project. Only you and I can see them, the files are not public, and the account uses one strictly necessary session cookie. I keep the account while the project runs and for up to 12 months after it ends; then I delete it, unless you ask me to keep it, or sooner if you ask.
When you sign in to the portal or the admin, the session cookie is valid for 24 hours. If you tick “Keep me signed in for 30 days”, it is valid for 30 days in that browser (do not tick it on a computer that is not yours). You can also sign in with your Google account if it matches your email: Google confirms your email to me, and you are sent to Google only to identify yourself; no new account is created and I receive nothing else from your profile. For each session I also keep the date, the last activity, the expiry and a short description of the device (for example “Chrome · Windows”), never the IP address, so you can see and end your sessions; I delete these records shortly after the session ends. If you turn on the authenticator, I keep its key encrypted, the date, and recovery codes only as encoded fingerprints (never the codes themselves). I email you when someone signs in from a new device, when your password or authenticator changes, and when a recovery code is used; those emails contain no secrets.
Cookies and tracking
Visitors get no cookies. The site counts, anonymously, how many times each page and each step was used: per day, without identifying anyone, without storing the IP address, without cookies and without sharing anything with third parties. It also keeps, in aggregate, where each visit came from, only as a category (for example “Google”, “social network” or “direct”), never the address of the page it came from. Visitors whose browser sends “Do Not Track” or “Global Privacy Control” are not counted. There is no advertising, no external fonts and no third-party embeds. Your light or dark theme choice is not stored.
The admin demo keeps what you try in your browser's session storage (sessionStorage), in this tab only, so you do not lose it if you reload the page. It stays on your device, is never sent to the server, and disappears when you close the tab or press “Reset demo”. Only the administration area and the client portal use strictly necessary session cookies.
Who receives the data
Each message reaches me by email, through PTisp's mail server and my inbox, which is on Gmail (Google), and, if you sign in with Google, Google confirms your email to me. The site is hosted by PTisp. Encrypted backups are stored with PTisp, the same provider as the hosting. I do not sell your data or share it with anyone else.
How long I keep it
I keep each message for 12 months after I have dealt with it, and for 24 months at most if it is never dealt with. The clean-up is automatic and runs every day. I keep the log of who changed what in the administration for 12 months, and the anonymous usage counts for 60 months. You can ask for deletion at any time. I make encrypted backups of all the information above and delete them after 30 days; a deletion request reaches the backups when they expire.
Your rights
You can ask for access to your data, to correct or delete it, to restrict or object to its processing, and to receive a portable copy. You can also withdraw your consent at any time, without affecting what was already processed. If you think I handled your data badly, you have the right to complain to the supervisory authority, in Portugal the Comissão Nacional de Proteção de Dados (cnpd.pt).
Security
Administration passwords are stored encrypted, the administration area requires a signed-in session and access is limited. If a data breach affects you, I will tell you and the supervisory authority within the legal deadlines.