Privacy policy

1. Who we are (data controller)

Dashboard Lda., registered in Portugal, is the data controller for the personal data we collect through the service. You can reach us at privacy@dashboard.sergiofpedro.com or via the /contact page.

2. What data we collect

Account data: your name, email, password hash, organisation, and the role you hold inside the workspace. We use this to operate the service and communicate with you.

Usage data: which features you use, when, and for how long, in aggregated form. We use this to improve the product and detect abuse.

Technical logs: IP address, browser type, timestamps of requests, and error traces. We retain these for up to 90 days for security and debugging.

Content you create: the company profile, the funding calls you save, the notes you write, the questions you ask the assistant. This lives in your workspace and is deleted with your account.

3. How we use data

To deliver the service, including processing the questions you ask the assistant, persisting the items you save, and producing digests.

To keep the service secure: rate limiting, abuse detection, audit logs of sensitive actions.

To communicate with you about service changes and security incidents. We do not send marketing email without your consent, and you can opt out of non-essential email from the workspace settings.

We do not sell your data. We do not share it with advertisers. We do not use it to train third-party models.

4. Legal basis (GDPR Art. 6)

Contract (Art. 6(1)(b)) — the data we need to run the service you signed up for: account data, content you create, billing information.

Legitimate interest (Art. 6(1)(f)) — security logs, abuse detection, and product analytics that help us run a stable service. You can object to this processing; we will either stop it or show that our interest outweighs yours.

Consent (Art. 6(1)(a)) — optional communications, non-essential cookies. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data sharing (sub-processors)

We share data with the following sub-processors, under written agreements that match the requirements of GDPR Art. 28. The list is reviewed quarterly.

6. International transfers

Most of our processing happens in the European Union. Where a sub-processor is outside the EU (Stripe Ireland is fine; Resend and OpenRouter are in the US), we rely on the European Commission Standard Contractual Clauses (SCCs) for the transfer, supplemented by additional technical measures (encryption in transit and at rest, access logging, data minimisation).

7. Your rights

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to our processing, to receive a portable copy of your data, and to lodge a complaint with your national data protection authority.

Most of these you can exercise directly from workspace settings (export, delete). For anything else, write to privacy@dashboard.sergiofpedro.com or use the /contact page; we answer within 30 days, as required by Art. 12 GDPR.

8. Retention, security and DPO contact

Account data: deleted within 30 days of account closure, except billing records (retained 7 years per Portuguese tax law).

Backups: encrypted, retained up to 30 days, then destroyed. Backups are restored only for disaster recovery, not for routine retrieval.

Security measures: encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access, audited quarterly, incident response plan tested twice a year. We notify the supervisory authority and affected users of a personal data breach within 72 hours of becoming aware of it, as required by Art. 33 GDPR.

Data Protection Officer: privacy@dashboard.sergiofpedro.com. Supervisory authority: Portuguese Data Protection Commission (CNPD), Av. D. Carlos I, 134, 1200-651 Lisbon, Portugal.