This Policy explains how Z·ilom processes the personal data of users of the web application zilom.pt (the "App" or "Service"), in accordance with Regulation (EU) 2016/679 ("GDPR") and Portuguese Law no. 58/2019.
1. Data controller
Link Store, Lda, a Portuguese company, tax number (NIPC) 506721523, with registered office at Av. D. Francisco de Almeida, 6, 2710-561 Sintra, Portugal, is the entity responsible for processing personal data, contactable for data protection matters at info@zilom.pt.
2. What data we collect
2.1. Data entered in the calculator
The assumptions you enter (areas, prices, costs, etc.) are processed locally on your device. They are not sent to our servers nor associated with you, unless you choose to save the calculation to your account, export it, or generate a report — in which case that data is processed by the technical providers listed in Section 5.
2.2. Contact and account data
If you join the waitlist, create an account, buy a one-off report, subscribe to a plan or contact support, we collect:
- Email (mandatory for authentication and communication).
- Professional profile (agent, agency, investor, etc.) — where applicable.
- Name, tax number, billing address — for invoicing, where applicable.
- Optional profile data — phone, AMI licence, photo, for agent users who choose to personalise reports.
- Organisation data — name, logo, tax number, contacts and AMI data, in agency accounts.
2.3. Payment data
Credit card or other payment-method data is collected and processed exclusively by Easypay — Instituição de Pagamento, Lda, which acts as an independent controller of that data. We do not see or store card numbers. We receive only opaque identifiers (customer token, subscription reference).
2.4. Usage and analytics data
We collect aggregated statistics about App usage (pages visited, visit duration, country, device type) and product events (calculations performed, detail expansion, report requests) through PostHog in privacy-first mode. Servers are in the European Union. We do not use tracking cookies, we do not do cross-site tracking, and we do not build personal profiles for anonymous users. Data is kept in memory during the session and discarded when you close the App; it is not passed to other sites or advertising networks.
2.5. Technical data
IP address, server logs (access logs), user-agent information, used exclusively for security, technical diagnostics, fraud prevention and compliance with legal obligations.
3. Purposes and legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Provision of the App service | Email, entered data when saved, account data | Performance of the contract (Art. 6(1)(b) GDPR) |
| Management of the pre-launch waitlist | Email, professional profile | Pre-contractual steps at the data subject's request (Art. 6(1)(b) GDPR) |
| Authentication via magic link and OTP code | Performance of the contract | |
| Payment of subscriptions and one-off purchases | Payment data, email, billing data | Performance of the contract |
| Issuance of legal invoices | Name, tax number, address, amount paid | Legal obligation (VAT Code) |
| Trainee discount | Email on the trainee file | Performance of the contract / legitimate interest |
| Sending essential product communications | Performance of the contract | |
| Sending optional marketing communications | Consent (revocable at any time) | |
| Aggregated analytics | Anonymous usage statistics | Legitimate interest (service improvement) |
| Security, abuse and fraud prevention | IP, logs, technical metadata | Legitimate interest |
4. Retention periods
- Unsaved calculator data: remains only on your device and is not retained by us.
- Calculations and reports saved to the account: until the account is deleted by the user or up to 3 years after the last access, whichever comes first.
- Dormant account created by a one-off purchase: up to 5 years after the last purchase, to allow re-access to the purchased report, unless deletion is requested.
- Waitlist emails: while the subscription is active or until revocation; automatic deletion 12 months after public launch if there has been no conversion into an account.
- Invoicing documents: 10 years, as legally required (VAT Code, Art. 52).
- Technical and security logs: up to 12 months.
- Support requests: up to 24 months after the last contact.
5. Recipients and processors
We use service providers acting as processors under Art. 28 GDPR, bound by a data processing agreement with guarantees equivalent to those required by the GDPR:
| Processor | Purpose | Data location |
|---|---|---|
| Supabase Inc. | Database, authentication, PDF storage | European Union (Frankfurt, DE) |
| Vercel Inc. | Web application hosting | EU / USA (standard contractual clauses) |
| Easypay — Instituição de Pagamento, Lda | Payment processing | Portugal (EU) |
| Resend, Inc. | Sending transactional emails | EU / USA (standard contractual clauses) |
| InvoiceXpress (Rauva) | Invoice issuance certified by the Portuguese Tax Authority | Portugal |
| OVHcloud (Zimbra Mail) | Support and contact email for the domain | France (EU) |
| PostHog Inc. | Product analytics (aggregated events, no personal profiles for anonymous users) | European Union (Frankfurt, DE) |
We do not sell, rent or share personal data with third parties for third-party marketing purposes. Data may be disclosed to competent authorities when required by law.
6. International transfers
Some processors may process data outside the European Economic Area, in particular the United States. When this happens, we ensure appropriate safeguards under Chapter V of the GDPR: standard contractual clauses approved by the European Commission, certification of the processor under the EU-U.S. Data Privacy Framework, or equivalent measures.
7. Data subject rights
Under the GDPR, the user may exercise the following rights:
- Access to their personal data;
- Rectification of incorrect or incomplete data;
- Erasure ("right to be forgotten"), within legal limits (e.g. invoicing must be kept for 10 years);
- Restriction of processing;
- Portability of data, in a structured, commonly used format (CSV, JSON);
- Objection to processing based on legitimate interest;
- Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
To exercise these rights, contact info@zilom.pt. We will respond within a maximum of 30 days (extendable by a further 60 days in complex cases, with notice of the reason).
You may also lodge a complaint with the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt.
8. Cookies and similar technologies
We use only strictly necessary cookies for the operation of the Service, in particular to keep the session active (HttpOnly, Secure, SameSite=Lax cookie) and user preferences (e.g. language). These cookies do not require consent under Art. 5(3) of the e-Privacy Directive.
We do not use tracking, advertising or personalised analytics cookies. For aggregated usage measurement we use PostHog in privacy-first mode (EU servers, no tracking cookies, no personal profiles for anonymous users — the app does not persist the identifier between sessions).
9. Security
We apply technical and organisational measures appropriate to the risk: encrypted HTTPS connections on all communications, encrypted storage at rest for sensitive data, passwordless authentication (magic link + OTP), a session policy limited to 30 days, role-based access control, audit logs, automatic backups, and periodic risk assessment.
10. Minors
The App is not intended for persons under 18. We do not knowingly collect data from minors. If we become aware that a minor has provided personal data, we will delete it immediately.
11. Automated decisions and profiling
We do not make decisions based solely on automated processing that produce legal or significant effects for the user. The calculations produced by the App are decision-support tools and the user always retains full control over the interpretation and use of the results.
12. Changes to this Policy
We may update this Policy to reflect legal, technical or functional changes. The version in force is the one published on this page, with the last-updated date shown at the top. Material changes will be communicated to users by email with reasonable notice.
13. Contact
For any question about the processing of your personal data: info@zilom.pt. For contractual, commercial or support matters not directly related to data protection, use info@zilom.pt.