Privacy Policy

Last updated: 8 November 2026

This policy explains how Contabify handles the personal data of people who use the iPhone app, the web app (app.contabify.pt) and the contabify.pt website. The Portuguese version prevails in case of discrepancy.

1. Who is responsible

2. Data we process

Account

• Name, email and password (stored only as a hash, never in plain text).
• If you sign in with Google or Apple: the account identifier, email and name that service shares (with Apple, this may be a private relay email).
• Profile photo, if you add one.

Companies and teams (workspaces)

• Workspace name, company name and tax number (NIF).
• Emails of the people you invite and the roles you give them.

Documents

• The photos, PDFs and emails with invoices you send, and the data read from them: issuer, tax number, dates, amounts, VAT, ATCUD, items and address.
• Labels, statuses and comments you add.
• Invoices may contain personal data of third parties (for example, the tax number of a sole trader). By sending them, you confirm you have grounds to do so.

Subscription and payments

• Plan, subscription status, invoices we issue to you and usage counters.
• Payments are processed by Stripe. We do not store your card number; we keep only the card brand and expiry date to identify it.

Technical data

• Server logs (for example, requests and errors), used for security and troubleshooting.
• In the iPhone app: usage data (screens opened, features used, uploads, purchases), device model and OS version, an install identifier and your account's internal identifier. It never includes invoice contents, amounts, VAT numbers, names or email.

3. Why we use the data and on what basis

• Providing the service — creating your account, storing and organising documents, reading invoices with artificial intelligence, exporting, working as a team (performance of contract).
• Billing the subscription and meeting tax obligations (performance of contract and legal obligation).
• Security, abuse prevention and support (legitimate interest).
• Measuring usage to improve the app, and measuring the campaigns that bring new installs (legitimate interest).
• Service communications — verification codes, invitations, account notices (performance of contract). Marketing communications only with your consent, which you can withdraw at any time.

4. The iPhone app

• It shows no advertising and does not track your activity across other apps or websites: it does not use Apple's advertising identifier (IDFA) or ask for tracking permission.
• It uses Google Firebase Analytics for usage statistics, linked to your account's internal identifier.
• It uses the Meta SDK to know how many installs, sign-ups and purchases come from our campaigns on Facebook and Instagram. Attribution is aggregated, through Apple's SKAdNetwork; your account identifier is not sent to Meta.
• It only accesses the camera and photos when you ask it to, to send an invoice.
• Data shown in widgets and the share extension stays on your device.

5. Who we share data with

We do not sell personal data. We use providers that process data on our behalf, under contract and only for the purposes above:

• Hosting, database and file storage: Google Cloud and Amazon Web Services.
• Reading invoices with artificial intelligence: Google (Gemini API), which receives the file to extract the data.
• Sending emails: Amazon Web Services (Amazon SES).
• Payments: Stripe.
• Sign-in: Google and Apple, if you choose those options.
• Internal communication and service monitoring tools.
• On the contabify.pt website and the web app: Google Analytics and Meta (pixel), to measure visits and campaigns.
• In the iPhone app: Google (Firebase Analytics), for usage statistics, and Meta (SDK), to measure install campaigns.

Members of your workspace can see that workspace's documents, according to the role you give them. We may also disclose data to authorities where required by law.

6. Transfers outside the EU

Some providers process data in the United States. In those cases the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission.

7. How long we keep data

• For as long as your account is active.
• You can delete your account in the app (Settings → Account → Delete account). The account stops giving access immediately; documents and other data are kept so that an account deleted by mistake can be recovered.
• To delete all your data permanently, write to contato@tandhitpartners.pt from your account email. We handle the request within 30 days, except what the law requires us to keep (for example, the invoices we issued to you).

8. Your rights

You can request access, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interest and withdraw consent. You can export your invoices as CSV and the originals as ZIP at any time in the app. To exercise your rights, contact contato@tandhitpartners.pt. You may also lodge a complaint with the Portuguese data protection authority, CNPD (cnpd.pt).

9. Security

Communications are encrypted (HTTPS) and storage providers encrypt data at rest. Internal access to data is limited to what is needed to provide and maintain the service.

10. Children

The service is intended for professionals and businesses and is not directed at children under 16.

11. Changes

If this policy changes materially, we will let you know in the app or by email before the change takes effect.