This is a translation of the original Portuguese text. In case of any discrepancy, the Portuguese version prevails.
This policy explains what personal data we collect, how we use it and what rights you have over it. Nuntiatum is the data controller.
1. Data we collect
- Account: email address; name and company, if you provide them; your chosen language. If you sign in with your Google account, the name, email address and profile picture that Google shares with us. Your password, if you use one, is stored by the authentication provider in encrypted form (hashed) — we never see it.
- Team: the email addresses of the people you invite to seats on your account.
- Payment: processed by Stripe. We do not store card numbers; we store your plan, your subscription status and your customer identifier at Stripe.
- Use of the Service: the alerts you set up, the email subscriptions you turn on (daily email, weekly bulletin), your API keys and the number of requests made with each one per day, and a log of the emails we send you (recipient, subject, date and delivery status).
- Country of access: when you land on the home page, your IP address is looked up in a local database so we can take you to your country’s site. The lookup runs on our server, the address is neither stored nor sent to third parties, and the choice you make by hand prevails.
- Technical data: IP address, browser and requested page, in the server access logs, for security and troubleshooting. We do not use any analytics tools.
2. What we use the data for
- Providing the Service and personalising your experience.
- Billing subscriptions and meeting our tax obligations.
- Sending operational messages (alerts) and the emails you have subscribed to.
- Protecting the Service: security, abuse prevention and API usage limits.
3. Legal basis
We process data on the basis of performance of a contract (providing the Service), legal obligation (billing), legitimate interest (security) and consent (optional emails, such as the daily email, which you turn on and off in your account).
4. Who we share it with
- Stripe — payment processing.
- Supabase — authentication: email address and login session (EU).
- Resend — email delivery.
- Hetzner — hosting of the server and the database (Germany, EU).
- Cloudflare — encrypted backups (R2, EU region) and delivery of the map icons (cdnjs).
- CARTO — the map background images. When you open a page with a map, your browser requests them directly from CARTO, which receives your IP address.
- Google — only if you choose to sign in with your Google account.
Some of these providers may process data outside the EU; in those cases the transfer relies on the mechanisms provided for in the GDPR (an adequacy decision or standard contractual clauses). We never sell personal data to third parties.
5. Retention
We keep account data for as long as the account exists; you can delete it at any time on the account page. Billing records are kept for 7 years for tax purposes. Server access logs are rotated and deleted automatically.
6. Your rights (GDPR)
- Access — request a copy of your data.
- Rectification — correct inaccurate data.
- Erasure — request deletion (the “right to be forgotten”), or delete your account on the account page.
- Portability — export your data in a structured format.
- Objection — object to processing based on legitimate interest.
- Withdrawal of consent — at any time.
To exercise any of these rights: privacidade@nuntiatum.com. You may also lodge a complaint with the CNPD, the Portuguese data protection authority (cnpd.pt), or with the data protection authority of the country where you live.
7. Security
Encrypted connections (HTTPS), passwords stored as hashes by the authentication provider, and encrypted, rotated backups. We recommend enabling 2FA as soon as it is available.
8. Changes
We will give at least 30 days' notice of any material changes to this policy.
Other languages: Português · Español · Français · Italiano · Deutsch