What data I collect, what it is used for and for how long

Data controller

• Fernando Rosa de Carvalho, sole trader, registered and operating in Portugal.
• For data questions, use the form on the Contact page.
• No Data Protection Officer (DPO) has been appointed, under art. 37 GDPR — requests are handled directly by the controller.

Data collected, purposes and legal bases

The processing of your personal data complies with the General Data Protection Regulation (GDPR — Regulation EU 2016/679) and applicable Portuguese law.

• Contact and diagnosis form. Name, company, email, phone and a description of processes and tasks. Basis: pre-contractual steps and legitimate interest in answering your enquiry.
• Delivery of projects. The data and system access strictly necessary for the contracted work. Basis: performance of a contract.
• Newsletter subscription. Email address, verified by double opt-in. Basis: consent of the data subject.
• Invoicing data. Name, tax number (NIF) and billing address. Basis: compliance with a legal obligation.

Cookies and local storage

• Essential. Storage of your theme, language and consent record in your browser. Exempt from prior consent under art. 5(3) of Portuguese Law 41/2004.
• Claude Cowork instructions generator. That page keeps a draft of what you type into the form (key sintetico.cowork.brief.v1) in your own browser, so you do not lose work halfway through. It is never sent anywhere and it disappears when you press "Clear". This is functionality you asked for, exempt on the same grounds.
• External services (Cal.com). The booking calendar is provided by Cal.com (Cal.com, Inc.) and is only loaded after you click "See available times". From that moment on, your browsing connects to app.cal.com, subject to the provider's own policy. You can block this loading through the COOKIES link in the footer.
• Audience measurement (Google Analytics). Google Analytics 4, provided by Google Ireland Limited, is used to count visits and understand which pages get read. It is active from the start and you can switch it off at any time through the COOKIES link in the footer, which is on every page. The cookies _ga and _ga_<identifier> are set, lasting up to 2 years, and your IP address is processed by Google. It is not used for advertising or to identify you. When you switch it off, those cookies are deleted and no further request is made to Google.
• Fonts and resources. Google Fonts and jsDelivr receive your IP address at the moment the page makes its technical request.
• Your preference choice is kept for 180 days and can be changed at any time from the footer.

Virtual assistant (AI)

• Messages you send are processed via Cloudflare Workers (EU) and forwarded to Anthropic's business API.
• A business account is used, with the option to train models on the data expressly disabled.
• Questions are retained anonymously for up to 180 days to improve the service. To prevent abuse and spam, your IP address may be recorded and blocked for 30 days.
• You are advised not to enter sensitive or confidential personal data, or credentials, into the assistant.

Retention periods

• Contacts that do not become projects: 12 months after the last contact.
• Project documentation: 5 years after the work is completed, for support and contractual liability.
• Invoicing and accounting: 10 years, under art. 123 of the Portuguese Corporate Income Tax Code (CIRC).
• Email subscriptions: until cancellation, with definitive removal within 30 days.
• Anonymous questions to the assistant: 180 days.

Processors and international transfers

• Third-party tools are used (hosting, email, scheduling, audience measurement and AI models) under data processing agreements.
• Whenever data is transferred outside the European Economic Area (EEA), appropriate safeguards are ensured, namely through the European Commission's Standard Contractual Clauses or under the EU-U.S. Data Privacy Framework.

Your rights

• You have the right to request access to, rectification, erasure, restriction, objection to and portability of your data, as well as to withdraw consent at any time.
• To exercise these rights, send a message through the Contact page. The response time is 30 days at most.
• You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).