Privacy policy

Who we are

Visa Portuguese (visaportuguese.com) is operated by Kevin Carmo, who is the data controller for personal data processed through this site. Contact: our contact page.

What we collect and why

• Account data (email, login method, sign-in records): to create and secure your account. Legal basis: contract performance.
• Saved work (move profile, plans, scenarios, document folder, dates and notes): to provide the tools you use. Legal basis: contract performance.
• Purchase records (product, order status, payment reference IDs): to deliver the paid report. Legal basis: contract and legal obligations.
• Newsletter (email): to send updates you asked for. Legal basis: consent, withdrawable any time.
• Assistant questions and a hashed IP address: to answer and to enforce daily limits and prevent abuse. Legal basis: legitimate interests.
• Usage and analytics (pages viewed, clicks, device and browser data, pseudonymous session ID): to improve the site. Legal basis: consent (via the cookie banner).
• Support messages: to answer you. Legal basis: legitimate interests.

Who we share data with

• Service providers for hosting, database, authentication, AI processing and analytics (including Google Analytics), bound to process data only on our instructions.
• Stripe (and Link, where it acts as Merchant of Record), for payments, subscription management, tax compliance, fraud prevention and invoicing. Stripe collects card data directly under its own privacy notice; we never see your full card number.
• Professional advisers (legal, accounting) where needed.
• Authorities where required by law.

We do not sell personal data.

International transfers

Some providers may process data outside the EEA. Where they do, we rely on adequacy decisions or Standard Contractual Clauses.

Retention

Account data and saved work are kept while your account is active and deleted within 30 days of account deletion. Purchase records are kept as long as tax law requires. Analytics events are kept up to 26 months. Data no longer needed is deleted or anonymised.

Security

We use appropriate technical and organisational measures, including encryption in transit, access controls and row-level database security so users can only read their own data.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, object to processing, and withdraw consent at any time. We respond within one month. You can also complain to the Portuguese supervisory authority, CNPD (cnpd.pt).

Cookies

We use essential cookies and, only with consent, analytics cookies. See the cookie policy or use "Cookie settings" in the footer.