Privacy Policy
Last updated: 2026-10-06
This policy explains what personal data Portucal ("the site") processes, why, and what your rights are. Carlos Alves is responsible for the data (the "controller"). Contact: info@portucal.com.
1. Data we process
- Account: email address, username, and a hashed password (never the password itself). Staff accounts also store the settings of their two-factor authentication.
- Profile (optional, entered by you): name, biography, location, date of birth, profile picture, preferred language and notification preference.
- Google sign-in (optional): if you sign in with Google we receive your Google account identifier, your verified email address and your name. We do not receive or store your Google password and we do not keep Google access tokens.
- Invitations: the email address an invitation was sent to, and when it was created and used.
- Server logs: like any web server, ours records technical data about each request (IP address, time, page requested, browser type) for security and troubleshooting.
Registration is by invitation only. Browsing the public pages of the site does not require an account.
2. Why we use it, and on what basis
- To create and run your account, log you in and send you the emails the service needs (invitation, email confirmation, password reset): performance of the service you asked for.
- To keep the site secure and prevent abuse (login rate limiting, logs, staff two-factor authentication): our legitimate interest.
We do not sell your data, we do not use it for advertising, and we do not send marketing email.
3. Cookies
The site uses only cookies that are strictly necessary, so no consent banner is shown. We use no analytics or advertising cookies.
| Cookie | Purpose | Duration |
|---|---|---|
sessionid | Keeps you logged in | Up to 14 days |
csrftoken | Protects forms against forgery | Up to 1 year |
django_language | Remembers your chosen language | Until you close the browser |
4. Who else handles data
- Hosting: DigitalOcean (server infrastructure).
- Email delivery: Brevo (sends the account emails; receives the recipient address and message).
- Google: sign-in, if you choose it, and Google Fonts (your browser requests the fonts from Google).
- Maps and scripts: map tiles are loaded from CARTO and OpenStreetMap-based services, and some scripts from the unpkg CDN. Your browser sends them your IP address when it loads these resources.
5. How long we keep it
Account and profile data are kept until you delete your account. Server logs are kept for a limited period for security purposes. Used and expired invitations are kept only as a record of how the account was created, and are detached from your account when it is deleted.
6. Your rights
You may access, correct, export and delete your data, restrict or object to its processing, and complain to the supervisory authority (in Portugal, the Comissão Nacional de Proteção de Dados, cnpd.pt). Logged in, you can do most of this yourself: edit your profile, download a copy of your data, or permanently delete your account from your profile page. For anything else write to info@portucal.com.
7. Security
The site is served over HTTPS, passwords are stored hashed, sign-up is by invitation, and staff accounts are protected with two-factor authentication.
8. Changes
We may update this policy; the date at the top shows the latest version.