Privacy Policy
Using Cifrova Personal? Its own policy is here.
This policy covers cifrova.com and Cifrova Business. It says what we hold, why, for how long, who else handles it, and how you get it back or deleted. The controller is Marquez Consulting Unipessoal Lda, NIF 516048538, Rua Ilha de Santiago, Lote A46C, 8200-317 Albufeira, Portugal. Write to info@cifrova.com for anything here.
1. Who this covers
People who visit cifrova.com, write to us through the contact form or book a meeting with us. Our clients' contacts, and the people who use Cifrova Business, including their accountants.
Inside Cifrova Business, the data in a client's books (bank lines, documents, the client's own customers and suppliers) belongs to the client. For that data the client is the controller and we act as its processor, under our Terms.
2. What we hold
| Data | Where it comes from | Why |
|---|---|---|
| Contact form: name, email, company website, phone or WhatsApp, notes, language, time, browser | You, through the form | To answer you and prepare a meeting |
| Meeting bookings: name, email, the time you pick, the answers you give | You, through Calendly | To hold the meeting |
| Emails we exchange | You | To answer you and keep a record of what we agreed |
| Users of Cifrova Business: name, email, role, sign-in times, actions in the app | You and your company | To run the account, control access and keep the audit log |
| Billing: company name, NIF, address, invoices, payments | You, our invoicing and payment providers | Invoicing and tax records |
| Server logs: IP address, time, page | Your browser | Security and keeping the service up |
| Visit statistics: pages visited, shortened IP address, browser | Google Analytics, only if you accept cookies | To see which pages help visitors |
We do not hold bank passwords or card numbers.
Active time in Cifrova Business: for the finance function's roles we measure active time per area of the app, and the tasks each person records, to show the company's owner the finance workload and to keep the financial assistant's task account. The legal basis is legitimate interest. The owner sees totals per area and month. Daily figures are kept for 13 months, then only as monthly totals. You can object in Settings > Security > Data protection.
3. Legal bases
- Consent (GDPR art. 6(1)(a)): the contact form and visit statistics. You can withdraw it at any time.
- Contract and the steps before one (art. 6(1)(b)): meetings, proposals and client accounts.
- Legal obligation (art. 6(1)(c)): invoices and tax records.
- Legitimate interest (art. 6(1)(f)): security logs, preventing abuse, and following up a conversation you started.
4. Accountants and other users
When a client invites an accountant or other users, they see the client's books according to their role. Each action they take is logged in their name. The client decides who has access and can remove it at any time.
5. Artificial intelligence
Cifrova Business uses Anthropic's Claude to read documents, propose matches and answer questions. It receives the relevant bank lines, documents and summaries. Anthropic acts as our processor and does not train its models on this data. A person reviews proposals before they change a client's books.
6. Who else handles the data
Only providers bound by contract, listed with their role and location on the service providers page. We do not sell data and we do not share it with advertisers.
Some providers (Anthropic, Calendly, Stripe, Sentry, Google) have entities in the United States. Those transfers rest on the EU Standard Contractual Clauses and, where it applies, the EU-US Data Privacy Framework.
7. How long
- Contact form and meeting details: up to 24 months after our last contact, unless you become a client. Ask us to delete them sooner at any time.
- Client data: while the agreement lasts. When it ends, we return it and delete it within 90 days, and from backups within a further 30 days.
- Invoices and payment records: 10 years, as Portuguese tax law requires.
- Server logs: 30 days. Visit statistics: 13 months.
8. Your rights
You can access, correct, export and erase your data, restrict or object to processing, and withdraw consent at any time. Write to info@cifrova.com; we answer within 30 days. If your data sits in a client's books, we pass your request to that client. You may also complain to the Portuguese authority, the CNPD (cnpd.pt), or to the authority of your own country.
9. Security
Everything travels over TLS. The platform is hosted in the EU, on European servers. Access follows each person's role and every action is logged. Integration credentials are stored sealed, and backups are encrypted. If a breach ever affects your data, we tell you and the CNPD within 72 hours, as the law requires. To report a security concern, write to security@cifrova.com.
11. Changes
We update this policy when the service or the law changes. The date at the top shows which version applies. Clients are told by email of any material change.