Privacy Policy

The service ("Sail") is operated by ALCOFAGEOMÉTRICA — PROGRAMAÇÃO INFORMÁTICA, UNIPESSOAL LDA (NIPC 519501624), a company incorporated in Portugal, doing business as Sail Labs ("we", "us"). We are the data controller for the personal data described in this policy.

For any privacy or data-protection matter, contact us at [email protected].

• Account data — your name, email address and, if you register with a password, a salted cryptographic hash of it (we never store the password itself). If you sign in with Google, we receive your name, email and profile picture from Google.
• Bank account data — if you connect a bank account, we receive the accounts, balances, transaction history and account identifiers (such as IBANs) you consent to share, through our PSD2 account-information provider (see section 4).
• Receivables and payer data — details of the payment requests and payment pages you create, and the information payers submit on them (such as a name or email address).
• Invoicing data — your supplier details and your customers' billing details (names, tax numbers, addresses) needed to issue legally compliant invoices.
• Documents — files you upload to the service, such as supplier invoices and receipts.
• Assistant conversations — if you use the built-in assistant, the messages and attachments you share with it.
• Technical data — log data such as IP addresses, timestamps and device/browser information, used for security and troubleshooting.

• Performance of a contract — providing the service you signed up for: creating payment requests, issuing invoices, categorising transactions, showing budgets and cashflow.
• Explicit consent — accessing your bank account information (which you grant in your bank's own authorisation flow and can revoke at any time) and optional features you actively enable.
• Legal obligation — issuing tax-compliant invoices and retaining accounting records for the periods Portuguese law requires.
• Legitimate interests — securing the service, preventing fraud and abuse, and keeping audit trails of sensitive operations.

We do not sell personal data, and we do not use it for third-party advertising.

Bank account aggregation is provided through Enable Banking, an authorised account information service provider (AISP) under the EU Second Payment Services Directive (PSD2). Access to your bank data happens only after you give explicit consent in your own bank's authorisation flow. We never see or store your bank credentials.

Bank consents are time-limited under PSD2 and must be renewed periodically. You can disconnect a bank at any time in the app, which stops further data access. Sensitive account identifiers such as IBANs are stored encrypted (see section 6).

We share personal data only with the service providers needed to run Sail, under data-processing agreements, and only to the extent each one needs:

• Enable Banking — PSD2 bank account aggregation (section 4).
• Invopop — issuance of certified invoices and their communication to the Portuguese Tax Authority (AT), under InvoiceXpress's 192/AT certification.
• Resend — delivery of transactional email (payment links, reminders, order confirmations).
• Cloudflare — content delivery, and private storage of documents you upload (Cloudflare R2).
• Railway — cloud hosting of the application and its database.
• Google — only if you choose to sign in with Google.
• Upstash — rate limiting of public endpoints (processes IP addresses).

Where a provider processes data outside the European Economic Area, transfers are protected by safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses or an adequacy decision. We may also disclose data where the law requires it — for example, invoice data reported to the Portuguese Tax Authority.

• Sensitive identifiers such as IBANs and account-holder names are encrypted at rest with AES-256-GCM.
• All traffic is encrypted in transit with TLS.
• Access to personal data inside our organisation is role-based, and sensitive administrative operations are audit-logged.
• Public payment pages use unguessable tokens and are excluded from search-engine indexing.

• Account and product data — for as long as your account exists. When you delete your account, personal data is deleted or irreversibly anonymised, except where retention is legally required.
• Bank data — synced data is kept while the connection exists and remains part of your transaction history until you delete it or your account.
• Invoicing and accounting records — retained for the statutory periods required by Portuguese tax law (generally 10 years).
• Assistant conversations — kept according to the retention period you configure in the app (30 days by default).

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased ("right to be forgotten");
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent at any time — for bank access, by disconnecting the bank in the app — without affecting processing carried out before withdrawal.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt), or with your local EU supervisory authority.

Sail uses only essential cookies: session cookies that keep you signed in and protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies.

We may update this policy as the product evolves. Material changes will be announced in the app or by email, and the "Last updated" date above always reflects the current version.