This policy explains how personal data is processed on PresupuestoYa (presupuestoyavd.com), in accordance with Regulation (EU) 2016/679 (GDPR) and Law No. 58/2019 (which implements the GDPR in Portugal).
1. Data controller
- Owner: Diogo Mateus Gonçalves Méndez (natural person, self-employed)
- Tax ID (NIF/CIF): 336359101
- Address: Além do Rio 589, 4585-582 Recarei, Paredes, Portugal
- Contact email: presupuestoya.app@gmail.com
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email and password (or Google account) when creating an account | To create and manage your account and provide the service | Performance of the contract (Art. 6.1.b GDPR) |
| Details of your business and your quotes (name, tax ID, phone, address, logo, quote lines, amounts) | To prepare, save and send your quotes | Performance of the contract |
| Your client records (name, company, phone, email, address, notes) | To manage your client list and link it to your quotes | Performance of the contract (see section 5) |
| Payment data for the Pro subscription | To charge the subscription. We do not store your card: Stripe processes it | Performance of the contract |
| Name, trade, text and rating of the review | To publish your review on the website | Consent (Art. 6.1.a), when you submit it |
| Email address in the blog form | To send you blog updates | Consent (box ticked by you) |
| Log of actions in the application (for example, “quote created”), linked to your user ID | Security, abuse detection and service improvement. It is not used for advertising | Legitimate interest (Art. 6.1.f) |
| IP address and technical connection data | Security and operation of the service; processed by our hosting provider | Legitimate interest |
We do not make automated decisions with legal effects on you, nor do we build commercial profiles.
3. Recipients and processors
To provide the service we use providers that process data on our behalf, with whom the corresponding data processing agreement is in place:
- Google (Firebase): authentication, database, file storage and execution of functions.
- Stripe Payments Europe, Ltd.: payment processing and billing of the subscription. Stripe also acts as an independent controller for its legal obligations (Stripe's policy).
- Netlify, Inc.: hosting and delivery of the web pages.
We do not sell your data. We only share it with third parties when the law requires it or when you decide to (for example, when sending a quote via WhatsApp, which opens on your device with your own messaging service).
4. International transfers
Some of these providers may process data outside the European Economic Area, in particular in the United States. In those cases, the transfer is covered by the safeguards provided for in the GDPR, such as the European Commission's standard contractual clauses or the provider's certification under the EU–US Data Privacy Framework.
5. Your clients' data: you are the controller
You enter the data of your own clients (the data you keep in client records and in quotes) for your professional activity. You are the controller of that processing and PresupuestoYa acts as processor: it processes the data only to provide you with the service and following your instructions, applies appropriate security measures, does not use it for its own purposes, helps you respond to your clients' rights and, when you close your account, deletes it or returns it to you, unless there is a legal obligation to keep it. You must inform your clients about that processing and have a legal basis for it. The sub-processors are the providers in section 3.
6. How long we keep the data
- Account, quote and client data: as long as you keep the account. If you close it (yourself from the application, in the user menu → “Delete my account”), we delete it immediately, except for data we must keep blocked for the legal periods (for example, billing and accounting data, up to 10 years for tax and accounting purposes).
- Reviews: until you request their removal.
- Blog subscription: until you unsubscribe.
- Log of actions in the application: as long as you keep the account; when it is closed it is deleted or unlinked from your identity.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time, by writing to presupuestoya.app@gmail.com and stating the right you wish to exercise. For the right to erasure you also have the “Delete my account” option in the application's user menu: it instantly deletes your account, quotes, clients, logo, review, usage log and blog subscription, and cancels the Pro subscription. To verify your identity we may ask you to do so from your account's email address. We will reply within a maximum of one month.
If you believe your data is not being processed correctly, you can lodge a complaint with the Comissão Nacional de Proteção de Dados (www.cnpd.pt) or the data protection authority of your country of residence.
8. Security
We apply reasonable technical and organisational measures: encrypted connection (HTTPS), access rules so that each user only sees their own data, passwords handled by Google's authentication system (we never see them) and keys for external services kept out of the public code.
9. Minors
The service is aimed at professionals of legal age. We do not knowingly process data of children under 14.
10. Changes to this policy
We may update this policy to reflect legal or service changes. The date of the last revision appears at the top of the page.