Privacy Policy

Last updated: 18 October 2026

Draft for legal review. This is a working draft prepared for internal review. It does not constitute legal advice. Before publishing, this document must be reviewed by a Portuguese-qualified lawyer or DPO for compliance with the GDPR (Regulation (EU) 2016/679), Law 58/2019 (Portuguese GDPR implementation), and Law 41/2004 (e-privacy).

This Privacy Policy explains how Architech, operated by [Legal Entity Name] ("Architech", "we", "us", "our"), processes personal data when you use the Architech web application, the Architech client web portal, or related services (together, the "Service").

1. Controller

The data controller is:

[Legal Entity Name] [Address] NIPC: [NIPC number] Email: [[email protected]] Data Protection Officer (DPO), if appointed: [[email protected]]

2. Scope

This Policy applies to data processed when you (a) create or use an Account, (b) access the Service via the web application or the client web portal, (c) communicate with us, or (d) interact with our marketing pages.

For data uploaded by a Company about its own employees, clients, or projects, the Company is the controller and Architech is the processor. The data subjects in those cases (for example, an employee added by their employer) should direct rights requests to the Company first; we will assist the Company in responding.

3. Data We Process

We process the following categories of personal data:

• Account and profile data — name, email address, phone number, address, NIF (tax identification number), position, hire date.
• Company data — company name, address, NIF, contact details. Where the User is the company representative, this overlaps with profile data.
• Employee records — added by an ADMIN: name, email, phone, address, hire date, location, position.
• Client records — added by an ADMIN: name, email, phone, fiscal number, address. Clients granted web portal access also have authentication credentials.
• Project content and files — drawings, BIM models, documents, plus metadata (name, version, review status).
• Billing data — Stripe customer and subscription identifiers, invoice metadata, the last four digits of the payment card. Full payment-card data is held by Stripe and is never stored by Architech.
• Communications — support tickets, ticket attachments, emails sent to and from us.
• Technical telemetry — IP address, browser, device characteristics, page interactions, errors. Collected through Grafana Faro on the web client and OpenTelemetry on the server.
• Audit logs — for Companies on the PROFESSIONAL plan: actor, action, entity type, entity identifier, metadata, timestamp.
• Authentication data — handled by Google Firebase Authentication (see Section 6).

4. Sources

We collect data directly from you when you register, use the Service, communicate with us, or upload Content. We also receive data from third parties when you interact with them through the Service (for example, Stripe when you make a payment).

5. Purposes and Legal Bases

6. Sub-Processors and Recipients

We rely on the following sub-processors to operate the Service:

A current list is available on request and will be updated when we change sub-processors.

We may also disclose data to professional advisers (lawyers, accountants), to authorities where legally required, and, in the event of a corporate transaction, to potential or actual successors subject to confidentiality obligations.

7. International Transfers

Some sub-processors are established outside the European Economic Area, in particular in the United States. Where we transfer personal data to such providers, we rely on Standard Contractual Clauses adopted by the European Commission, the EU-US Data Privacy Framework where the recipient is certified, and any supplementary technical and organisational measures that are appropriate.

8. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

• Account and profile data: while your Account is active, plus a limited deletion window after termination (typically 30 days, after which the data is removed from active systems).
• Employee records: subject to soft-delete on the Service; removed on Account termination per the schedule above.
• Client records and project content: while the Account is active and during the post-termination export window.
• Billing data: 10 years for invoices and accounting records, in accordance with Portuguese tax law.
• Communications and support tickets: typically 24 months unless a longer period is justified by an open matter.
• Technical telemetry: typically 30 days for raw data; aggregated metrics may be retained longer.
• Audit logs (PROFESSIONAL plan): per the audit-log retention schedule applicable to that plan.
• Backups: rotated according to our backup schedule; data continues to exist in backups for a limited period after deletion from active systems.

9. Your Rights

Under the GDPR you have the right to:

• Access your personal data (Art. 15).
• Request rectification of inaccurate data (Art. 16).
• Request erasure of your data, subject to legal exceptions (Art. 17).
• Restrict processing (Art. 18).
• Data portability for data processed by automated means based on consent or contract (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Not be subject to decisions based solely on automated processing that significantly affect you (Art. 22). We do not currently make such decisions.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint with your supervisory authority. In Portugal: the Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa — [email protected] — https://www.cnpd.pt.

To exercise these rights, contact us at the address in Section 1. We will respond within 30 days; this period may be extended by up to two further months for complex requests, in which case we will inform you.

For data the Company has uploaded about you (for example, employee records added by your employer), please direct your request to the Company first. We will assist them in responding.

10. Cookies and Tracking Technologies

The Service uses cookies and similar technologies as described in our Cookie Policy. Strictly necessary cookies are used without consent; non-essential cookies (including analytics) are used only with your consent through the in-product consent banner.

11. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS).
• Access control and role-based permissions.
• Tenant isolation, with all data scoped to a Company identifier.
• Audit logging on the PROFESSIONAL plan.
• Authentication via Firebase, with password requirements and email verification.

In the event of a personal-data breach that is likely to result in risk to data subjects, we will notify the CNPD within 72 hours where required, and affected data subjects without undue delay where required.

12. Children

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at the address in Section 1.

13. Changes to This Policy

We may update this Policy from time to time. The date at the top of the page reflects the most recent change. Material changes will be notified to ADMIN by email and through the Service. Continued use of the Service after an update constitutes acceptance of the updated Policy.

14. Contact

For privacy-related queries, including to exercise your rights:

[Legal Entity Name] [Address] Email: [[email protected]] DPO: [[email protected]]