Privacy Policy

1. Data Controller

Mampassar Company, trading name of a sole trader, NIF 333839714, with its address at Praceta Augusto Gil, n.º 2, Miratejo, Portugal, is the controller of the personal data collected through Buildflow, under the GDPR (EU Regulation 2016/679).

2. Data Collected

Account data: nome, email, palavra-passe cifrada, empresa, NIF. Operational data: obras, trabalhadores, orçamentos e finanças. Usage data: registos de acesso, endereço IP. Pagamentos: processados pela Stripe, não armazenamos dados de cartões.

3. Purpose and Legal Basis

Provision of the service (performance of the contract); service communications (legitimate interest); legal and tax obligations (legal obligation); improvement using anonymised data (legitimate interest).

4. Data Sharing

Data is never sold. We share it only with essential processors: Supabase (database), Stripe (payments), Resend (email), Anthropic (AI assistant and analysis). All with GDPR compliance guarantees.

5. International Transfers

Some processors operate in the USA, with appropriate safeguards under article 46 of the GDPR (European Commission Standard Contractual Clauses).

6. Retention

Data is kept for the duration of the contract and a further 5 years for tax obligations. Operational data is deleted 30 days after termination.

7. Your Rights (GDPR)

You have the right of access, rectification, erasure, portability, objection and restriction of the processing of your data. To exercise these rights: suportebuildflow@gmail.com

8. Security

Encryption in transit (TLS 1.3) and at rest; authentication with JWT tokens; role-based access control (RLS); audit logs; encrypted automatic backups.

9. Cookies

We use only cookies strictly necessary for the session. We do not use tracking, advertising or third-party analytics cookies.

10. Complaints

You may complain to the CNPD (Comissão Nacional de Protecção de Dados, Portugal, www.cnpd.pt). Contact us first: we try to resolve matters directly.

11. Controller and Processor

Quanto aos dados de conta do próprio Cliente, a Buildflow actua como responsável pelo tratamento. Quanto aos dados pessoais de trabalhadores, candidatos e terceiros que o Cliente introduz na plataforma, o the customer is the data controller e a Buildflow actua como subcontratante (art. 28.º do RGPD), tratando-os apenas segundo as instruções do Cliente e para prestar o serviço. Cabe ao Cliente assegurar a base legal e informar esses titulares.

12. Special Categories and Minors

The service is not intended for minors nor for the collection of special categories of data (article 9 of the GDPR). The Customer undertakes not to enter such data without a valid legal basis, and takes responsibility if it does.