Privacy policy

Who is responsible

Daniel Filipe da Conceição Saraiva leads ITMA and is the controller of the project's personal data. Contact: info@itma.pt. ITMA is currently a personal project and has not been formally established as an association or institute. Formal establishment depends on enough people joining and donations covering the necessary costs.

At this stage, “members” means participants in the project community. Registration does not in itself confer membership of a future legal entity. Updated information will be provided before a change of controller or purpose.

Data and purposes

To process a request to join the community, we use your chosen name, verified email, account identifier, linked sign-in methods, application status and registration and approval dates. The legal basis is providing the requested participation service and taking the steps necessary for your request under GDPR Article 6(1)(b). The restricted area cannot be managed without the identification data it requires.

Votes include the proposal, choice, optional explanation, name and dates. The participation counter reflects the polls you joined and those for which you were eligible. Voting is voluntary and is not required to keep your account. For new submissions, we ask for explicit consent to process your position and show it to approved participants, including where it reveals political opinions: GDPR Articles 6(1)(a) and 9(2)(a).

Messages sent to info@itma.pt are used to respond to the matter raised. Keeping the site secure and preventing unauthorised access may involve technical connection data and error logs. The basis is the legitimate interest in answering enquiries and protecting the service and participants, Article 6(1)(f). Where a specific legal obligation applies, the necessary processing relies on Article 6(1)(c).

Who can see votes

Approved participants can see names, choices, explanations and poll results. This information is not displayed on the public homepage. Emails and application management are restricted to administration. Participants must respect this restriction and must not disclose other participants' data outside the restricted area.

Do not include other people's personal data or unnecessary sensitive information in explanations. You can withdraw your own vote using “Retirar voto” in the poll, including after it closes. This deletes the identified vote and updates the results and counter. If you cannot sign in, contact info@itma.pt. Withdrawing consent does not affect the lawfulness of earlier processing.

Sign-in and service providers

The site uses Sites/OpenAI and Cloudflare infrastructure for hosting and storage; Supabase for authentication; and the Domínios.pt email service for info@itma.pt and the configured delivery of sign-in links. These services may process data needed for their respective functions and technical data for security and maintenance.

When you choose an external sign-in method, that provider handles authentication under its own terms. ITMA receives the identification and email needed for access, not your account password. Google and Apple can only be used when displayed as active options. Signing in with ChatGPT does not give ITMA access to your conversations.

Some providers and subprocessors operate outside the European Economic Area. Their information describes the locations and mechanisms applicable to international transfers. You can request clarification or information about safeguards at info@itma.pt. See OpenAI, Cloudflare and Supabase.

Retention

Account data is kept while needed for participation and application management. Identified votes are kept while needed to follow up the poll and can be withdrawn by the participant. The need to retain data must be reviewed when its purpose ends or the project is formally established.

Messages are kept while needed to resolve the matter. On a closure or erasure request, data that is no longer needed is deleted or anonymised. Further retention to meet a legal obligation or defend a right must be limited to what is necessary and explained to the individual. Backup and log retention also depends on the services involved; instant deletion from every copy is not promised.

Your rights

You may request access, rectification, erasure, restriction and, where applicable, portability or object to processing. Write to info@itma.pt, preferably from your account email. Only proportionate identification will be requested. A reply is normally provided within one month; any legally permitted extension will be explained and communicated.

You may withdraw consent for a vote without losing community access. Requests about other data are assessed under applicable legal requirements. You may also complain to Portugal's Comissão Nacional de Proteção de Dados. The site does not make solely automated decisions with legal effects on your membership request; approval is handled by administration.

Statistics and donations

The public homepage uses Cloudflare Web Analytics for usage statistics. Its script is not included in restricted member pages. See the cookies and storage information.

The support button opens an external GoFundMe campaign. The payment form is not hosted by ITMA. GoFundMe handles donation data under its policy and may provide donation information to the organiser according to its rules and your choices. Do not post payment details in proposals or explanations.

Updates

This policy describes the project's current stage and must reflect changes to services, purposes or the controller. Significant changes will be communicated before new processing begins. Reference: European Data Protection Board guidance.

Human support and the future assistant

Support is provided by Daniel Saraiva, not by artificial intelligence. We store the subject, messages, dates, status and outcome to follow up each request. Conversations are private between the participant and Daniel, are not shown to the community, and can be deleted by their author within the conversation.

Permission to prepare examples for the future assistant is optional and separate from support. Only authorised, resolved conversations can become examples; Daniel rewrites and reviews each example to remove personal data and identifying details. Conversations are not automatically sent to AI models. Withdrawing permission or deleting the conversation removes its example from the selection. New messages or changes require another review.

Daniel can download only reviewed, currently authorised examples. Exported copies must be updated when permission is withdrawn. Before external use or future training, the conditions of use will be reassessed and participants will receive the necessary information.