Privacy Policy

Last updated: July 10, 2026

Descodify is a certified invoicing and tax reporting tool for solo entrepreneurs in Portugal. This policy explains what personal data we collect, why we collect it, how we protect it, and what rights you have.

We keep this policy in plain language. If anything is unclear, email us at privacy@descodify.pt.

Who we are

Descodify is operated from Portugal. We are the data controller for the personal data described in this policy. You can reach us at:

• Email: privacy@descodify.pt
• Location: Algarve, Portugal

What we collect and why

Account data

When you create an account, we collect:

• Email address - to identify your account, send verification emails, and communicate with you
• Name - to display in the app and on invoices
• Passkey credentials (if you register a passkey) - the public key for your device, never a password. Descodify has no passwords: sign-in is by magic link, passkey, or Google.
• Google account data (if using Google sign-in) - OAuth tokens for authentication only

Legal basis: Contract performance (we need this to provide the service).

Business profile

To configure your invoicing and tax reporting, we collect:

• Business name and NIF (Portuguese tax number)
• VAT regime (normal, simplified, or exempt)
• Activity type (goods, services, or mixed)
• Territory (mainland, Madeira, or Azores)

Legal basis: Contract performance (required for certified invoicing and tax calculations).

Customer data

When you add customers to issue invoices, we store their details as provided by you:

• Name, address, city, postal code, country
• Email and phone number (optional)
• VAT number or personal tax ID (NIF)

Legal basis:Contract performance (required for invoice generation). You are responsible for ensuring you have a lawful basis to provide your customers' data.

Invoices and financial records

We store all invoice data you create through Descodify:

• Invoice numbers, dates, amounts, and payment methods
• Line items with descriptions, quantities, and VAT rates
• A snapshot of the customer details at the time the invoice was finalized

Legal basis: Contract performance and legal obligation (Portuguese law requires retention of invoicing records).

Uploaded documents

You can upload expense receipts and other documents. We store the file, its filename, and metadata about when it was uploaded and by whom.

To extract structured data (supplier, amounts, VAT, dates) from uploaded documents, we send the document image and text to Mistral AI for OCR and extraction. Mistral is a French AI provider; processing runs against EU-region endpoints. Mistral does not use this data to train models.

Legal basis: Contract performance (extraction is part of the expense-tracking service).

Documents and emails sent to your inbox address

Each organization can be given a private inbox email address. When you — or a third party you share the address with, such as a supplier — email a document to that address, we receive the message and store it, so the document and the context around it are preserved in your inbox.

For every email received at your inbox address, we store:

• The sender's email address, the recipient inbox address, the subject, the date, and the message identifier (Message-ID)
• Any CC addresses and, when the forwarding route includes them, the original message headers
• The message body (plain text and, when present, HTML) — kept even when the email carries an attachment, because a supplier often puts the invoice details in the body itself
• Any attachments, stored as documents (as described above), and a spam score used only to protect against abuse

The sender may be someone other than you — for example a supplier who emails you an invoice. Their email address and message are stored as delivered, as part of the record of the document you received.

Legal basis: Contract performance (receiving documents by email is part of the inbox service) and legal obligation (an email that carries, or is itself, a supplier invoice forms part of your accounting archive, which Portuguese law requires us to retain).

Acknowledgement replies to senders

When an email arrives at your inbox address, we may send an automated reply to the sender telling them what happened to it — that the document was filed, or that we could not process it and they should resend the invoice as a file. This lets a supplier know their invoice reached you. You can change this in your inbox settings (confirm both outcomes, only confirmations, only rejections, or off); the default is to confirm both.

To protect against misuse, we never reply to bounce messages, automated “no-reply” addresses, or senders flagged as spam, and replies are rate-limited per sender. The reply is sent through the same EU email provider (AhaSend) we use for our other email.

Legal basis: Legitimate interest (confirming receipt of a document to the person who sent it, while protecting email deliverability).

Tax authority credentials

If you choose to connect your Portal das Finanças account, Descodify creates a dedicated subuser on the AT portal - a separate login used only by Descodify. We store only the subuser credentials, encrypted at rest using AES-256-GCM - we cannot read the password in plain text.

If you use automatic setup, your main portal credentials are used once to create the subuser and then immediately and permanently deleted. We never store your main login. Alternatively, you can create the subuser yourself and provide only those credentials.

Every interaction with the tax authority portal is logged in an audit trail (action type, success/failure, timestamp) so you can see exactly what was accessed and when.

Legal basis: Explicit consent (you choose to connect your portal account and can disconnect at any time).

VAT number and company lookups

When you verify a customer's VAT number, we send the country code and VAT number to the EU's VIES (VAT Information Exchange System) service. VIES returns whether the number is valid, along with the registered name and address for some countries. We store the verification result and timestamp.

To pre-fill a company customer's details (name, address, activity code), we also look the company registration number (NIPC) up against two additional sources: nif.pt (a business-registry service operated by Racius, a Portuguese company that is part of the Cegid group of France) and SICAE(Sistema de Informação da Classificação Portuguesa de Actividades Económicas), the official Portuguese government registry run by the Ministry of Justice (IRN). A NIPC identifies a legal entity (a company), not a person, so these lookups do not involve anyone's personal data.

We never send an individual's or sole trader's personal tax number (NIF) to nif.pt or SICAE when verifying a customer. The only time your own personal NIF may be sent to nif.pt is during your own onboarding, to pre-fill your business profile from data about you.

Legal basis: Legitimate interest (verifying and pre-filling counterparty details is required for correct invoicing under EU and Portuguese VAT rules).

AI assistant conversations (optional)

Descodify includes an optional AI assistant powered by Anthropic's Claude. The assistant is entirely optional - you can disable it in your organization settings, and Descodify works fully without it. No data is sent to Anthropic unless you actively use the assistant.

If you choose to use the assistant:

• Your messages and the assistant's responses are stored in our database so you can revisit past conversations
• Your messages are sent to Anthropic's API for processing against EU-region endpoints. Anthropic does not use your data to train their models (see Anthropic's privacy policy)
• We do not include your financial data or customer details in AI requests unless you explicitly type them into the chat

If you disable the assistant, no conversation data is collected and no requests are made to Anthropic.

Legal basis: Consent (you opt in by using the assistant and can disable it at any time).

Session and security data

When you log in, we collect:

• IP address - for session security and abuse prevention
• Browser and device information (user agent) - for session identification
• Session tokens - stored as encrypted cookies in your browser

Legal basis: Legitimate interest (security of your account).

Authentication and security event logs

To protect accounts against unauthorised access, we keep a security log of authentication events across the service. This is separate from the session record described above: it records every sign-in attempt — whether it succeeds or fails, and on failure the reason — and every use of an API key against our external API. For each event we record the account, organization, or API key involved where known (a failed attempt may identify none), together with the IP address, browser and device information, and the time.

We use this log only to detect and investigate attacks — brute-force and credential-stuffing attempts, and compromised API keys — and to reconstruct what happened after a suspected account compromise. We keep each entry for 90 days and then permanently delete it.

If you ask us to delete your data, we may keep these security-log entries for the remainder of their 90-day life where that is necessary for the security purpose above — for example, to finish investigating an incident — after which they are deleted automatically.

Legal basis: Legitimate interest (Article 6(1)(f)) — securing the service and protecting your account against brute-force, credential-stuffing, and compromised-key attacks. We record only the limited data described above, keep it for a short fixed window (90 days), and use it for no purpose other than security. This is processing you would reasonably expect from a service that holds your financial data, and it does not override your interests or rights.

External API request logs

If you use our external API (for developers and integrations), we keep a record of the requests made with your API key. Where the security log above records the authentication of a key — the fact that it was used — this log records what each authenticated request actually did, so we can detect and investigate abuse (such as scraping or systematic enumeration of your records), respond to a compromised key, and measure how the API is used.

For each request we record the account, organization, and API key used, the IP address and browser and device information, which endpoint was accessed and its outcome, and the time. We do not store the contents of your requests or responses — which is where your invoice and customer data would be — or your API credentials.

We keep each detailed request record for 90 days and then permanently delete it. Before deleting them, we condense each month's records into coarse usage totals — a count of requests per organization and API key, per month, with no request detail. We retain these totals for 36 months and then permanently delete them.

As with the security log above, if you ask us to delete your data we may keep the detailed request records for the remainder of their 90-day life where that is necessary for the security purpose — for example, to finish investigating suspected abuse — after which they are deleted automatically.

Legal basis: Legitimate interest (Article 6(1)(f)) — securing and operating the service, detecting and investigating abuse (scraping, enumeration, and compromised keys), and metering API usage. We record only the limited data described above, keep the identity-linked detail for a short fixed window (90 days), and retain only coarse aggregate counts beyond that. This is processing you would reasonably expect from a service that exposes an API over your financial data, and it does not override your interests or rights.

Newsletter (optional)

If you sign up for our newsletter — the monthly email about working for yourself in Portugal (invoicing, VAT, Social Security, expenses, deadlines, tax) — we collect:

• Email address - to send you the newsletter
• Confirmation status and timestamp - the date you confirmed your subscription, recorded as proof of consent

The newsletter uses double opt-in: after you submit your email, we send a confirmation link, and you only start receiving the newsletter once you click it. We do not need an account, and the newsletter is entirely separate from the transactional emails that keep your account running (sign-in links, deadline reminders, billing) - those are sent whether or not you subscribe. Every newsletter email includes a one-click unsubscribe link.

Legal basis: Consent (you opt in, confirm by email, and can withdraw at any time by unsubscribing).

What we do not collect

• We do not use third-party analytics or tracking pixels. We self-host a privacy-friendly analytics service (Umami) that records anonymous page-view counts, with no cookies, no fingerprinting, and no cross-site tracking
• We do not set marketing cookies - only an authentication cookie
• We do not sell or share your data with advertisers
• We do not track your browsing behavior across pages
• We do not use device fingerprinting

Where your data is stored — and under whose jurisdiction

All application data is stored on servers in the European Union. We host with Hetzner Online GmbH in Germany (Nuremberg and Falkenstein data centres), send email via AhaSend B.V. in the Netherlands, and run document OCR via Mistral AI in France, and process subscription payments for paid tiers via Mollie B.V. in the Netherlands. Each of these is an EU-incorporated company on EU infrastructure — so neither the data nor the company answers to non-EU law.

This distinction matters: many “EU-hosted” services are operated by US-parented companies that remain subject to US extraterritorial law (CLOUD Act, FISA Section 702) regardless of which data centre the bits live in. We picked subprocessors under EU jurisdiction wherever a credible EU option exists.

Where a US-parented processor is unavoidable — Anthropic (optional chat assistant, routed to EU-region endpoints), Cloudflare (edge TLS and DDoS protection), Google (optional OAuth sign-in) — traffic to those providers is always TLS-encrypted in transit, and we never store sensitive payloads with them in plain form. Transfers are governed by EU Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

On the free tier, with the AI assistant disabled and magic-link or passkey sign-in instead of Google, zero of your application data ever touches a US-parented company.

Who has access to your data

Your data is accessible only to you and anyone you explicitly invite to your organization (e.g., your accountant). We access your data only when necessary to operate the service or when you contact us for support.

Service providers

We use the following third-party services to operate Descodify:

We do not share your data with any other third parties. We do not sell your data. We never will.

How we protect your data

• Encryption in transit: All connections use TLS (HTTPS)
• Encryption at rest: Sensitive credentials (AT Portal passwords) are encrypted with AES-256-GCM
• Passwordless sign-in: No passwords to store or leak - you sign in with a magic link, a passkey (WebAuthn), or Google
• Session security: Encrypted, httpOnly cookies with CSRF protection
• Access control: Organization-based permissions - users can only access data in organizations they belong to
• Audit logging: Tax authority interactions are logged for transparency

How long we keep your data

Your rights under GDPR

As a user in the EU, you have the following rights. To exercise any of them, email us at privacy@descodify.pt. We will respond within 30 days.

• Access - request a copy of all personal data we hold about you
• Correction - ask us to fix inaccurate data
• Deletion - ask us to delete your data (subject to legal retention requirements for invoicing records, and to short-term retention of security event logs where deleting them would defeat their security purpose, as described above)
• Portability - receive your data in a machine-readable format
• Restriction - ask us to limit how we process your data
• Objection - object to processing based on legitimate interest
• Withdraw consent - for processing based on consent (e.g., AT Portal connection or the newsletter), you can withdraw at any time (for the newsletter, use the unsubscribe link in any issue)

You also have the right to lodge a complaint with the Portuguese data protection authority: CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt.

Cookies

We use a single cookie:

• Authentication cookie - an encrypted session token that keeps you logged in. It is httpOnly (cannot be read by JavaScript), Secure (only sent over HTTPS), and SameSite=Lax (protects against cross-site attacks). No marketing, analytics, or tracking cookies.

Because we only use a strictly necessary cookie, we do not need a cookie consent banner.

Children

Descodify is a business tool for solo entrepreneurs and individuals exploring tax obligations in Portugal. Under Portuguese GDPR rules, users must be at least 16 to consent to data processing. If you believe someone under 16 has created an account, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make significant changes, we will notify you by email or through a notice in the app. The date at the top of this page always reflects the latest revision.

Contact

For any questions about this policy or your personal data, email us at privacy@descodify.pt.