Privacy and data protection
Last updated: 11/10/2026. Draft pending legal review — this text has not yet been reviewed by a lawyer.
1. Who processes the data
Dotec OÜ, NIF EE102436491, with registered office at Sepapaja, 6 ("we"), operates the ospais service, available at ospais.app. Contact: [email protected].
2. Two different roles
There are two distinct things here, and the law treats them differently:
- Your account data (name, email, subscription, payments): we are the controller.
- The content you upload (conversations, calls, photographs, diary, expenses, locations): the controller is you. We are only processors — we store and process on your behalf and on your instructions.
This means that you decide what goes in, how long it stays and who has access to it. And it also means that you are the one answerable for the lawfulness of what you upload.
3. What we collect, and why
| Data | What for | Legal basis |
|---|---|---|
| Email, name, encrypted password | Creating and securing the account | Performance of the contract |
| Subscription, payments, invoices | Taking payment and meeting tax obligations | Contract and legal obligation |
| Access log (date, IP, action) | Security and proof of integrity | Legitimate interest |
| Content you upload | Providing the service | Customer instructions (as a processor) |
We do not use your data for advertising, we do not sell it and we do not pass it to third parties for their own purposes. We do not build profiles and we make no automated decisions about you.
4. Sensitive data and other people's data
The content you upload almost certainly includes other people's communications and data about minors. You must only do so as far as is necessary to exercise your rights in proceedings — that is what the service is for. Do not use this to monitor, stalk or expose anyone: besides being unlawful, it is grounds for immediate closure of the account.
The app only records your location, from your own device, and only when you ask it to.
5. Where the data is kept, and how
- Servers in the European Union ([FORNECEDOR / PAÍS]). We do not transfer data outside the European Economic Area.
- Each family has its own database and its own file folder, separate from all the others.
- The connection is always encrypted (HTTPS), passwords are stored as cryptographic hashes, and two-step authentication and passkeys are available.
- Encrypted backups, stored 30 dias.
6. How long the data is kept
- Content: for as long as the account exists. You can delete it at any time.
- After the subscription ends or you cancel it: 7 days in which nothing changes, then 90 days with the account read-only, so you can reactivate or export. After that we delete everything for good — the database and the files — and we send an email before and on the day.
- Invoices and accounting records: 10 years, as required by law.
- Security logs: 12 meses.
7. Your rights
You can ask for access, correction, erasure, restriction, objection and portability of your data, and withdraw consent. Write to [email protected]; we reply within one month. You also have the right to complain to the Comissão Nacional de Proteção de Dados (the Portuguese data protection authority) (cnpd.pt).
In the app, under Administration, you can export everything and delete the account without having to talk to anyone.
8. Processors
We use: [alojamento], Stripe (pagamentos por cartão), Ifthenpay (MB Way), [email transacional]. All of them are bound by contract and process data only on our instructions.
9. Data breaches
If there is a security breach that puts your rights at risk, we tell you and notify the CNPD within 72 hours, in accordance with Article 33 of the GDPR.
10. Cookies
Besides the cookies needed for the app to work, we use the ones ticked below, and only after you say yes. You can change your choice whenever you like.
| Cookie | Category | What it is for | Lasts |
|---|---|---|---|
arquivo_sid | Necessary | Keeps you signed in after you log in. | Until you close the browser |
idioma | Necessary | Stores the language you chose. | 1 year |
consentimento | Necessary | Stores this choice, so you are not asked again. | 6 months |
_ga, _ga_* | Statistics | Google Analytics: tells visits apart in order to count them. | 2 years |