Privacy policy
Last updated 26 September 2026
Summary
- We collect as little as we can. You log in with an email link, not a password.
- Information about your children is entered by you, as the parent or guardian, and is used only to run the tools you use.
- Your data is stored in the European Union (Frankfurt).
- When the AI tools work on your child's plan, log or tests, your child's name is not sent. We use a pseudonym.
- We use no advertising cookies and no tracking cookies, so there is no cookie banner.
- We never sell your data.
The rest of this page gives the detail required by the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese Law 58/2019.
Who is responsible for your data
The data controller is:
[Company name], NIF [NIF], with registered address at [Registered address], Portugal ("we", "us").
For anything related to privacy, write to privacy@homeschoolinginportugal.com.
What data we process and why
If you only read the site
We do not ask you for anything. Our hosting provider processes technical data needed to deliver pages (IP address, browser type, time of request) in server logs, which are kept for up to 30 days for security and troubleshooting. We use Vercel Web Analytics, which counts page views without cookies and without building a profile of you.
If you download a letter template or subscribe to our newsletter
We process your email address and, if you give it, your name and preferred language, to send you the template and, if you ask for them, occasional emails about new guides and changes in the rules. You can unsubscribe with one click in any email.
If you create an account
Account data. Your email address, language preference and the dates you signed up and last logged in. We use your email to send you a login link (we do not use passwords), service emails and the reminders you switch on.
Household and child data you enter. To make the tools work, you may enter, for each child:
- a display name or nickname (it does not have to be the child's real name);
- birth year (not the full date of birth);
- school year, school and agrupamento;
- details of the protocolo (such as the tutor's name, portfolio frequency and meeting dates);
- language profile (whether Portuguese is not the child's first language);
- learning log entries, including text and photos you upload;
- annual plans, portfolios, self-assessments and appraisals;
- sample tests and exercises, and the scores and answers you record.
You decide what to enter. Photos are never required.
Health and special educational needs. We do not ask for this information and the app has no fields for it. Please do not enter it in free-text notes. If you do, we store it only as part of your account, you can delete it at any time, and we treat it as special-category data under article 9 of the GDPR, processed on the basis of your explicit consent.
Billing data. If you subscribe, payments are handled by Stripe. We receive your name, billing email, country, the plan you bought, payment status and invoices. We never see or store your full card number.
Support messages. If you write to us, we keep the conversation so we can help you.
Technical and security data. Login events, IP addresses and error reports, to keep accounts secure, prevent abuse and fix bugs.
Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing your account and the tools you use, including AI features, reminders and exports | Performance of a contract with you, article 6(1)(b) |
| Processing child data you enter | Performance of the contract with you, as the holder of parental responsibility, article 6(1)(b) |
| Health or special-needs details you choose to write in a free-text note | Your explicit consent, article 9(2)(a) |
| Billing, invoices and tax records | Legal obligation, article 6(1)(c) |
| Security, fraud prevention, server logs and error monitoring | Our legitimate interest in running a safe and working service, article 6(1)(f) |
| Cookieless, aggregate site analytics | Our legitimate interest in understanding which pages are useful, article 6(1)(f) |
| Newsletter and updates by email | Your consent, article 6(1)(a) |
| Answering your messages | Our legitimate interest in replying, or steps at your request before a contract, article 6(1)(b) and (f) |
Where we rely on legitimate interest, you can object at any time (see "Your rights").
Children's data
The service is for adults. Children do not create accounts. Information about a child is entered by a parent or guardian, acting as holder of parental responsibility, for the child's education.
We apply data minimisation to children's data in particular:
- we ask for a birth year, not a date of birth;
- a nickname is enough, and the real name is only needed if you want it printed on an exported document;
- photos are optional;
- we never use children's data for marketing, profiling or advertising.
If you enter information about a child who is not in your care, you must have the authority to do so (see our terms).
AI processing
The paid tools use Anthropic's Claude API to draft plans, suggest curriculum links for log entries, and write sample tests and exercises.
- No names. Your child's name is never sent. The AI sees a pseudonym, such as "Aluno A". Names are added back only on our servers when you export a document.
- Photos only on request. A log photo is sent only when you ask the AI to map that specific entry. We do not send the photo's metadata.
- No training. Under Anthropic's commercial terms, API inputs and outputs are not used to train models.
- Anthropic may keep API inputs and outputs for a limited period to detect and prevent misuse, as set out in its commercial terms.
- You decide. Every AI output is a draft. Nothing is sent to a school or anyone else by us, and AI outputs do not produce decisions with legal effects about you or your child.
Who processes data for us
We use the following providers (processors) under data processing agreements. They may only use your data to provide their service to us.
| Provider | What they do | Where data is stored |
|---|---|---|
| Vercel Inc. | Hosting, serverless functions, file storage (Vercel Blob), cookieless analytics | Functions in the EU (Frankfurt); see international transfers |
| Neon, Inc. | Database hosting | EU (Frankfurt, AWS eu-central-1) |
| Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices, VAT calculation | EU, with transfers to Stripe group companies |
| Resend | Sending login links, reminders and newsletters | See international transfers |
| Anthropic PBC | AI processing for the paid tools | See international transfers |
| Functional Software, Inc. (Sentry) | Error monitoring | See international transfers |
We do not sell or rent personal data, and we do not share it with advertisers. We may disclose data if a court or public authority lawfully requires it.
International transfers
Several of our providers are companies based in the United States, and some processing (for example AI requests, email delivery and error reports) may take place outside the European Economic Area. Where that happens, transfers are protected by the European Commission's Standard Contractual Clauses or, where the provider is certified, by the EU-U.S. Data Privacy Framework, together with the provider's security measures. You can ask us for a copy of the relevant safeguards.
How long we keep data
| Data | How long |
|---|---|
| Account, household and child data | Until you delete it or close your account |
| Data after account deletion | Removed from live systems immediately, and from backups within 30 days |
| Billing records and invoices | 10 years, as required by Portuguese tax and accounting law |
| Server and security logs | 30 days |
| Error reports | Up to 90 days |
| Newsletter subscription | Until you unsubscribe |
| Support messages | Up to 2 years after the conversation ends |
Your rights
Under the GDPR you have the right to:
- access the data we hold about you and your household;
- rectify inaccurate data (most of it you can edit directly in the app);
- erase your data. You can delete individual entries, a child profile or your whole account from the settings page;
- portability: download all your data (JSON plus your uploaded files) from the settings page at any time;
- object to processing based on legitimate interest;
- restrict processing in certain cases;
- withdraw consent at any time, without affecting processing already carried out.
To use any of these rights, write to privacy@homeschoolinginportugal.com. We reply within one month. We may ask you to confirm your identity, usually by replying from the email address on the account.
You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt. We would appreciate the chance to fix the problem first.
Security
We take reasonable technical and organisational measures to protect your data, including:
- hosting in the EU with providers that encrypt data in transit and at rest;
- passwordless login with single-use links that expire after a short time;
- every database query scoped to your household, so no family can see another family's data;
- private file storage, with photos served only through short-lived signed links checked against your account;
- rate limiting on login and AI features, security headers and verified payment webhooks;
- access to production data limited to the people who need it to run the service.
No system is perfectly secure. If a breach affects your data and is likely to put your rights at risk, we will tell you and the CNPD as the law requires.
Cookies
We use only strictly necessary cookies:
- a session cookie that keeps you logged in;
- a cookie that remembers your language choice, if you change it.
We use no advertising, social media or tracking cookies, and our analytics work without cookies. Because strictly necessary cookies do not require consent, we do not show a cookie banner. When you pay, Stripe's checkout pages may set their own cookies for fraud prevention, under Stripe's privacy policy.
If we ever add non-essential cookies, we will ask for your consent first and update this page.
Changes to this policy
We will update this page when our processing changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell account holders by email before it takes effect.
Contact
Privacy requests: privacy@homeschoolinginportugal.com
[Company name], [Registered address], Portugal.