Privacy policy — DRAFT for Diogo to review
Draft written from what the site actually does: a contact form, a client questionnaire reached through a personal link, and essential cookies. It is not legal advice. Fill in the fields in [ ] and confirm the providers before publishing.
Last updated: [publication date]
Who processes your data
Diogo Oliveira Martins, tax ID (NIF) 211683400, reachable at ola@diogoom.pt. This is the controller of the data collected on this site.
What data we collect and why
| Where | What data | What for | Legal basis |
|---|---|---|---|
| Contact form | Name, email, space of interest, message | To reply to your request | Your consent and pre-contractual steps |
| Client questionnaire (personal link) | The answers you give about your business and your project | To prepare and carry out the agreed work | Performance of a contract or pre-contractual steps |
| Reception (attendance assistant) | Name, email, the conversation and, technically, your IP address (stored only as an irreversible code) | To verify your email, reply to your request and protect the service from abuse | Your consent and pre-contractual steps |
We do not ask for or store health data, or any special categories of data, on this site.
How long we keep it
- Contact requests that do not lead to work: deleted after [12] months.
- Reception conversations that do not lead to work: deleted after 12 months. Verification codes stop working after 10 minutes and are deleted within two hours at most.
- Questionnaires and client data: for as long as the working relationship lasts and, after that, for as long as the law requires.
Who we share it with
We do not sell or hand over data to anyone. We use these service providers, who process data on our behalf:
- Vercel: website hosting
- Supabase: database where requests and questionnaires are stored (EU region, Ireland)
- Brevo: sending the email that alerts us to each request, and the Reception codes and messages (EU)
- Cloudflare (Turnstile): anti-bot check in Reception, to make sure whoever asks for a code is a person
Some of these providers may process data outside the EU with the safeguards set out in the GDPR, such as standard contractual clauses. [Confirm for each one.]
Artificial intelligence
We work with artificial intelligence agents. Messages and questionnaires may be read with the help of these tools in order to prepare the work, always under human guidance and never to make automated decisions about you. [Confirm the provider and its data-use terms before publishing.]
AI-led interviews
If we send you a personal link to a conversation about your project, the questions are asked by an artificial intelligence agent (Claude, from Anthropic) and the answers are read by us. Your answers are stored in Supabase and sent to Anthropic to generate the next question and a report for us, never to make automated decisions about you.
You can type or, if your browser allows it, speak. In that case, speech recognition is done by the browser itself, under the terms of whoever provides it (for example Google in Chrome or Apple in Safari). We do not receive or store the audio, only the text you confirm before moving on.
Answers are kept for [retention period]. The link stops working when the conversation ends or after 30 days. [Confirm Anthropic’s data-use terms and the region where the data is processed.]
Reception (attendance assistant)
In Reception we ask for your name and email, send you a 6-digit code to confirm the email, and talk to you through an artificial intelligence assistant (Claude, from Anthropic). Your messages are stored in Supabase, sent to Anthropic to generate the replies and a summary, and read by us. They are never used to make automated decisions about you.
When the conversation ends, we send you a thank-you email and send ourselves a summary and the full conversation, so we can reply to you. The code is stored only in encrypted form and is valid for 10 minutes; your IP address is stored only as an irreversible code, to limit abuse. The anti-bot service (Cloudflare Turnstile) is only loaded when you open Reception.
You can type or, if your browser allows it, speak. In that case, speech recognition is done by the browser itself, under the terms of whoever provides it. We do not receive or store the audio, only the text you send. Please do not include health data or data about other people in your messages.
Conversations that do not lead to work are deleted after 12 months. [Confirm Anthropic’s data-use terms and the region where the data is processed.]
Cookies
This site only uses essential cookies and local storage: your language choice, a record that the intro has already been seen, and your answer to the cookie notice. We do not use advertising or tracking cookies. [If visitor analytics are added, update this section.]
Your rights
You can ask for access, rectification, erasure, restriction or portability of your data, or object to its processing, by writing to ola@diogoom.pt. You can also withdraw your consent at any time. If you believe your data has not been handled properly, you can lodge a complaint with the CNPD (www.cnpd.pt).