Privacy Policy

Last updated: November 2, 2026

Descodify is an invoicing and tax reporting tool for solo entrepreneurs in Portugal. This policy explains what personal data we hold, why, who receives it, how long we keep it, and what rights you have. If anything is unclear, email us at privacy@descodify.pt.

The short version

• We hold what we need to run your user account, bill you, keep the service secure, and do what you ask.
• For your business's records, such as invoices, customers, expenses and uploads, we act only on your business's instructions.
• We never sell your data and do not use it for advertising.
• Your data is stored in the EU. The network that protects the site, and a few features you choose to turn on, use US-parented providers under EU safeguards.
• Our AI provider runs in the EU and does not use your data to train models.
• You can export your data and delete your user account in Settings. For 30 days after you ask, you can download your data or change your mind. A deleted user account's data is kept until you ask us to delete it.
• Portuguese law requires your business to keep its accounting records for at least 10 years, so export them before you delete your user account or close your business in Descodify.
• You must be at least 18 to use Descodify.
• You can complain to the Portuguese data protection authority (CNPD).

Who we are and our two roles

Descodify is operated from Portugal. You can reach us at:

• Email: privacy@descodify.pt
• Location: Algarve, Portugal

For your user account, billing, the newsletter, your IRS return and the records we keep to run the service, we decide how data is used and are responsible for it. For your business's records, we process them only for your business and on its instructions.

Data we are responsible for

Your user account and billing

What: your name and email address, how you sign in (a passkey, an emailed link or code, or Google sign-in if you choose it; there are no passwords), the IP address and browser of each signed-in session, and, if you pay for a plan, your subscription and payment status. You enter your payment details at our payment provider's checkout, never with us.

Why: to give you a user account, sign you in, keep it secure, and bill you.

Legal basis: contract. Session and security data: legitimate interest in the security of your user account. Billing records: legal obligation.

How long: see How long we keep it below.

Records we keep to run and protect the service

What: a log of sign-in attempts and of each use of an API key or a connected app; records of requests to our API, and daily usage totals; our response to a request that creates or changes something, so a repeated request is not done twice; the record and history of each API key; diagnostic logs when something breaks; a log of company and VAT number lookups and what each source returned; the record of your consent when you connect a tax or Social Security portal, with the IP address; and the subscription for each device you turn notifications on for.

Why: to protect user accounts and the service against attacks and abuse, find and fix defects, measure use, answer a dispute about what an API key was allowed to do, improve lookups, show that you consented, and deliver the notifications you asked for.

Legal basis: legitimate interest in keeping the service secure and working, measuring its use, and improving lookups. Contract for an API key while it works. Consent records: legal obligation, because the GDPR requires us to be able to show your consent. Notifications: consent, which you give per device and can withdraw at any time.

How long: see How long we keep it below.

Newsletter and updates

What: your email address and when you confirmed your subscription, or the email address you give us to receive something you asked for, such as the result of our free IRS reader.

Why: to send you the monthly newsletter, or what you asked for. The newsletter needs no user account and starts only after you confirm by email. Every issue has a one-click unsubscribe link.

Legal basis: consent.

How long: see How long we keep it below.

Your IRS return

What: past returns, read from the tax portal at your request or uploaded by you; your household records; and the values and documents you add. This includes your spouse's and dependants' details, and any disability degree the return needs. Your portal login is used only for that session and never stored. We prepare the file; you submit it to the tax authority yourself. Supporting documents are sorted by an AI provider in the EU.

Why: to help you prepare your IRS return.

Legal basis: contract.

How long: see How long we keep it below.

Data we process for your business

Your business's records

This covers your business's records; its customers and invoices; uploads, and the email sent to its inbox address, with the automatic replies we send to the senders; its filings; the lookups and portal connections made for it; the apps and API access it connects; its AI assistant conversations; and the history of changes to these records.

We act only on your business's instructions, as set out in our Terms of Service under When we process data for your business. Only members of the business, and apps it connects, can reach this data. We access it only to run the service or when you ask us for support. The sub-processors we use are listed on our GDPR page.

How long: see How long we keep it below.

What we do not do

• We do not use tracking pixels. We run our own privacy-friendly analytics, with no cookies, and it sends nothing to any third party.
• We do not set marketing cookies, only the cookies described under Cookies below
• We do not sell or share your data with advertisers
• We do not use device fingerprinting

Who receives data

We use service providers for hosting, email delivery, AI processing, payments, sign-in, our edge network, and notification delivery. We check VAT and company numbers against public registries, and we send data to the tax authority and Social Security when you file or connect. An app you connect yourself receives the data you allow it, under its provider's own terms. Our GDPR page names each provider. We do not sell your data.

Transfers outside the EU

Our edge network and the optional Google sign-in are run by US-parented companies. These transfers are covered by EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Optional notifications are delivered through the push service your browser or device uses, under that service's own terms. An app you connect yourself may be outside the EU, because you chose it.

How long we keep it

Your rights

As a user in the EU, you have the following rights. To exercise any of them, email us at privacy@descodify.pt. We will respond within 30 days.

• Access - request a copy of all personal data we hold about you
• Correction - ask us to fix inaccurate data
• Deletion - ask us to delete your data, subject to short-term retention of security records where deleting them would defeat their purpose. How to delete your user account sets out the steps, the 30-day window, and what is kept.
• Portability - receive your data in a machine-readable format
• Restriction - ask us to limit how we process your data
• Objection - object to processing based on legitimate interest
• Withdraw consent - for processing based on consent (e.g., a tax or Social Security portal connection, notifications, or the newsletter), you can withdraw at any time (for the newsletter, use the unsubscribe link in any issue)

For data we process for a business, the business answers requests about it, and we help.

You also have the right to lodge a complaint with the Portuguese data protection authority: CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt.

Cookies

We use four cookies. None of them is a marketing, analytics, or tracking cookie, and none of them follows you to another site:

• Session cookie - keeps you logged in. It is protected against theft and cross-site attacks.
• Session cache cookie - a short-lived copy of your session that makes pages load faster. It has the same protections and expires on its own after a few minutes.
• Language cookie - remembers whether you chose English or Portuguese, so the app opens in the language you picked. It stores nothing but that choice, and it is only ever written when you pick a language or when the language saved on your user account changes.
• Side menu cookie - remembers whether you opened or collapsed the side menu inside the app. It stores nothing but that choice, is only written when you open or close the menu yourself, and expires after seven days.

Under the ePrivacy rules a cookie needs consent unless it is strictly necessary to deliver what you asked for, or it records a preference you set yourself. The first two are strictly necessary and the other two record choices you made yourself (your language and your side menu), so we do not need a cookie consent banner. We would need one the day we added a cookie that measured or tracked you, and we have not.

Children

You must be at least 18 to use Descodify.

Changes to this policy

We may update this policy from time to time. When we make significant changes, we will notify you by email or through a notice in the app. The date at the top of this page always reflects the latest revision.

Contact

For any questions about this policy or your personal data, email us at privacy@descodify.pt.