Privacy Policy

The service ("Sail") is operated by ALCOFAGEOMÉTRICA — PROGRAMAÇÃO INFORMÁTICA, UNIPESSOAL LDA (NIPC 519501624), a company incorporated in Portugal, doing business as Sail Labs ("we", "us"). We are the data controller for the personal data described in this policy.

For any privacy or data-protection matter, contact us at [email protected].

• Account data — your name, email address, your preferred language and how you sign in. Sign-in itself (your password, a Google or Microsoft account you link, and any two-factor method) is handled by WorkOS, our identity provider: if you set a password, WorkOS stores a salted cryptographic hash of it and we never see the password itself. If you sign in with Google or Microsoft, we receive your name, email and profile picture from that provider.
• Bank account data — if you connect a bank account, we receive the accounts, balances, transaction history and account identifiers (such as IBANs) you consent to share, through our PSD2 account-information provider (see section 4). Incoming payments also carry the payer's own account identifier. We store it encrypted, and remember which accounts a customer pays from, so a payment can be matched to the customer who sent it.
• Receivables and payer data — details of the payment requests and payment pages you create, and the information payers and buyers submit on them: a name, email address and, where you ask for it, a tax number, answers to your checkout questions and files they upload. Tickets record the seat and, for guest tickets, the name and email you enter.
• Invoicing data — your supplier details and your customers' billing details (names, tax numbers, addresses) needed to issue legally compliant invoices. To register you for certified invoicing we collect your Portal das Finanças web-service credentials, which we store encrypted and use only to register your invoice series and communicate your documents to the Tax Authority.
• Card, MB WAY and direct-debit payments — if you accept them, the status, amounts, Stripe's fee and the VAT on it, the net amount and the payout each payment belongs to, so you can reconcile them. Card and bank details are entered at and held by Stripe; we never see them.
• Customer email records — for every email Sail sends to your customers: the recipient, the kind of email, when it was sent and whether it was delivered, bounced or marked as spam. We do not keep the body of the email, and we do not track opens or clicks.
• Billing data — your subscription, invoices and payments. Card details are entered at and held by Stripe; we store only the plan, the amounts and a reference to the Stripe invoice.
• Documents — files you upload to the service, such as supplier invoices and receipts.
• Assistant conversations — if you use the built-in assistant, the messages and attachments you share with it.
• Technical data — log data such as IP addresses, timestamps and device/browser information, used for security and troubleshooting.
• Business contacts we approach — to offer Sail to schools and organisations, we keep publicly available contact details of those organisations and the people we correspond with, and our email exchanges with them, sent from our own Google Workspace mailboxes. Anyone can ask us to stop at any time, and we then do not contact them again.
• Early-access waitlist — if you join the waitlist on our website: your email address, the country you choose, which button you used and a one-way hash of your IP address (never the address itself). We use it only to tell you when Sail opens in your country and to decide which country opens next.

• Performance of a contract — providing the service you signed up for: creating payment requests, issuing invoices, categorising transactions, showing budgets and cashflow.
• Explicit consent — accessing your bank account information (which you grant in your bank's own authorisation flow and can revoke at any time), optional features you actively enable, and joining our early-access waitlist.
• Legal obligation — issuing tax-compliant invoices and retaining accounting records for the periods Portuguese law requires.
• Legitimate interests — securing the service, preventing fraud and abuse, keeping audit trails of sensitive operations, understanding how Sail is used so we can fix defects and improve the product, and approaching organisations that may benefit from Sail. You can object to the last two of these at any time.

We do not sell personal data, and we do not use it for third-party advertising.

Bank account aggregation is provided through Enable Banking, an authorised account information service provider (AISP) under the EU Second Payment Services Directive (PSD2). Access to your bank data happens only after you give explicit consent in your own bank's authorisation flow. We never see or store your bank credentials.

Bank consents are time-limited under PSD2 and must be renewed periodically. You can disconnect a bank at any time in the app, which stops further data access. Sensitive account identifiers such as IBANs are stored encrypted (see section 6).

We share personal data only where running Sail requires it, and only to the extent each recipient needs. Most of those below are processors acting on our instructions under a data-processing agreement. Some are not: the European Commission's VAT register is a public authority we query, logo.dev is contacted by your browser rather than by us, Stripe also acts on its own account where the law requires it to verify identity, and an external AI app you connect through MCP is chosen and authorised by you.

• Enable Banking — PSD2 bank account aggregation (section 4). Requests you trigger yourself also carry your IP address and browser identification, which PSD2 requires so your bank can tell an action you took from a background refresh.
• Stripe — subscription billing and, if you accept card, MB WAY or SEPA Direct Debit payments, a Stripe account opened in your name on which those payments are processed and paid out to your bank. Stripe receives your name, email, billing address and tax number, verifies your identity and your business's as the law requires, and handles card and bank details, which we never see. For each payment it receives the payer's name and email and the amount; for Direct Debit, your customers' IBANs, which it stores on your behalf. We receive back the payment status, Stripe's fee and the payouts.
• Invopop — issuance of certified invoices and their communication to the Portuguese Tax Authority (AT), under InvoiceXpress's 192/AT certification.
• Resend — delivery of transactional email (payment links, reminders, order confirmations, invoices, tickets). Where an email carries a document — an invoice PDF, for example — Resend receives the attachment too. Resend reports back whether each email was delivered, bounced or marked as spam, which we show you on the Emails screen.
• Expo — delivery of mobile push notifications, and through it Apple and Google. It receives your device's push token and the notification text, which can include an amount and a counterparty name.
• Anthropic — the AI model provider behind the built-in assistant, smart transaction labelling, and receipt and invoice extraction. It receives your assistant messages, the documents you upload for extraction, and the account data the assistant reads to answer you — transactions, customers and invoices. In the assistant's own lookups, the IBANs and tax numbers in your records are masked before they are sent; documents you upload for extraction are sent as they are, because reading the supplier's IBAN and tax number off them is the point. Anthropic does not use this data to train its models. If you add your own provider key and switch the app to use it, your AI requests go to the provider you chose instead — OpenAI, Google, or OpenRouter, which forwards them on to the model vendor you pick — under that provider's own terms.
• External AI apps you connect (MCP) — on Plus, Pro and Custom you can connect an AI app of your choice to Sail. It receives only the data you authorise when you connect it, within your own permissions, under that app's own terms; changes it proposes run only after you confirm them in Sail. You can revoke the connection at any time from your account settings.
• Your own systems (API and webhooks) — on Pro and Custom you can create API keys and webhook endpoints. Programs holding a key read and change your data within the scopes you gave it, and each webhook endpoint you add receives details of your payments, invoices and orders — including your customers' names, email addresses and amounts — at the address you chose. You decide where that data goes and are responsible for it from there.
• European Commission (VIES) — checking a Portuguese or EU tax number against the public VAT register when you onboard or add a customer, which returns the registered name and address.
• logo.dev — merchant logos shown beside your transactions. Your browser requests the image directly, so logo.dev sees your IP address and the merchant's domain.
• Cloudflare — content delivery, and private storage of documents you upload (Cloudflare R2).
• Railway — cloud hosting of the application and its database.
• Google — if you choose to sign in with Google (through WorkOS), and as an AI provider if you select it above.
• Microsoft — if you choose to sign in with a Microsoft account (through WorkOS).
• Upstash — rate limiting of public endpoints and connected apps (processes IP addresses, user identifiers and, on password changes and invitation emails, email addresses).
• Other services that receive no personal data — healthchecks.io, which tells us when a scheduled job did not run, and Frankfurter, from which we fetch currency exchange rates.

Where a provider processes data outside the European Economic Area, transfers are protected by safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses or an adequacy decision. We may also disclose data where the law requires it — for example, invoice data reported to the Portuguese Tax Authority.

• Sensitive identifiers such as IBANs and account-holder names are encrypted at rest with AES-256-GCM.
• All traffic is encrypted in transit with TLS.
• Access to personal data inside our organisation is role-based, and sensitive administrative operations are audit-logged.
• Public payment pages use unguessable tokens and are excluded from search-engine indexing.

• Account and product data — for as long as your account exists. When you delete your account, personal data is deleted or irreversibly anonymised, except where retention is legally required.
• Bank data — synced data is kept while the connection exists and remains part of your transaction history until you delete it or your account. Payer account identifiers we have learned are kept with the customer record, and go when you delete that customer or your account.
• Invoicing and accounting records — retained for the statutory periods required by Portuguese tax law (generally 10 years).
• Assistant conversations — kept until you delete them or your account. You can switch on automatic deletion after a period you choose in the app; it is off by default.
• Customer email records — delivery records are kept for 365 days, then deleted.
• Connected-app records — the audit log of what a connected AI app requested (never the data it received) is kept for 90 days.
• API and webhook records — a log of each API request (never its content) for 90 days; webhook events and their delivery log for 30 days.
• Business contacts — kept while we are in contact, and removed on request; we keep only a note not to contact you again.
• Waitlist — kept until we have told you Sail is open in your country and for up to 12 months after, or until you ask us to remove it, whichever comes first.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased ("right to be forgotten");
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent at any time — for bank access, by disconnecting the bank in the app — without affecting processing carried out before withdrawal.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt), or with your local EU supervisory authority.

Sail uses only essential cookies: session cookies that keep you signed in and protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies. Some page elements are fetched by your browser from a third party — see logo.dev in section 5.

We may update this policy as the product evolves. Material changes will be announced in the app or by email, and the "Last updated" date above always reflects the current version.