1. Introduction and Scope

This Privacy Policy ("Policy") explains what personal data Skillful Sardine - Unipessoal Lda. ("we," "us," "our," or "Company") collects when you use the website manueltgomes.com (the "Website"), why we collect it, how long we keep it, and the rights you have over it.

Governing Law: This Policy is governed by and construed in accordance with the laws of Portugal, without regard to its conflict of law provisions.

2. Data Controller

The data controller responsible for your personal data is:

Skillful Sardine - Unipessoal Lda.
Email: legal@skillfulsardine.com

3. Information We Collect

3.1 Contact Form

When you submit a contact form, we collect the following information:

  • Full name
  • Email address
  • Message content

Purpose: This information is collected solely to respond to your inquiry and facilitate communication.

3.2 Estimation Request Form

When you submit an estimation request form, we collect the following information:

  • Full name
  • Email address
  • Company name (optional)
  • Project details and description
  • Budget range and timeline preferences
  • Additional project requirements

Purpose: This information is collected solely to provide project estimations and facilitate business communication.

3.3 Newsletter Subscription

If you subscribe to the newsletter, we collect:

  • Email address (required)
  • Name (optional)
  • The topics you chose to receive
  • The date you confirmed your subscription

Double opt-in. We send you a confirmation link and you are not subscribed until you click it. If you never confirm, nothing is sent to you.

Our emails contain no tracking. There are no tracking pixels, no open tracking, and no click tracking. We cannot tell whether you opened an email or which links you clicked.

Purpose: Solely to send you the emails you subscribed to.

3.4 Server Request Logs

Our servers keep a log of requests made to the Website. This log records:

  • IP address
  • Browser user agent
  • The page requested, the response status, and how long the request took
  • The referring page, if any
  • Standard request headers (never cookies, never authorisation headers)

Purpose: Security. These logs allow us to investigate abuse, automated scraping, and attacks against the Website.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in keeping the Website secure and available.

An IP address is personal data under the GDPR, and we treat these logs accordingly, even though we never link them to a name.

Security-sensitive values are removed before they are written. If a link you follow contains a confirmation token (for example a newsletter confirmation link), that token is stripped from the log rather than stored.

3.5 Reactions

Reactions record no personal data. When you react to an article, we store which article it was and which reaction you chose. We store no IP address and no other identifier with a reaction.

3.6 Comments

If you comment on an article, we collect:

  • Your comment text (required)
  • Name (optional; comments can be anonymous)
  • Email address (optional; never displayed publicly)

No IP address and no browser data are stored with a comment. Every comment is reviewed by a person before it appears on the Website, and we may decline to publish or may remove a comment at any time.

Purpose: To display your comment alongside the article and to moderate discussion.

3.7 Information We DO NOT Collect

We do not collect, store, or process any of the following:

  • Payment information (there is no e-commerce functionality)
  • Device identifiers or advertising IDs
  • Cross-site tracking data
  • Any data sold, rented, or shared with advertisers

3.8 Information Collected via Umami Analytics

We use Umami, a privacy-focused analytics platform that collects anonymized usage data. Umami operates without cookies and does not track you across websites.

Data collected by Umami (anonymized):

  • Page views and page URLs visited
  • Referrer source (where you came from)
  • Browser type and version
  • Operating system
  • Device type (desktop, mobile, tablet)
  • Screen resolution
  • Country, region, and city (derived from the IP address; the IP address itself is not stored)
  • Session duration and timestamp of visit

What Umami does not do:

  • No cookies are set on your device
  • No IP address is stored
  • No cross-site tracking
  • We cannot identify individual visitors from this data

3.9 Theme Preference (Local Storage)

If you change the Website's theme (light/dark mode), your preference is stored locally in your browser's localStorage. This data:

  • Is stored exclusively on your device
  • Is never transmitted to our servers
  • Can be deleted by clearing your browser's local storage

4. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process data under the following legal bases:

  • Consent (Article 6(1)(a) GDPR): When you submit a contact form, an estimation request, or a comment, you provide explicit consent for us to process the personal data you include.
  • Consent (Article 6(1)(a) GDPR): The newsletter. You confirm your subscription by clicking a link we email to you. You may withdraw that consent at any time by unsubscribing, and withdrawing consent is as easy as giving it (Article 7(3) GDPR).
  • Legitimate Interests (Article 6(1)(f) GDPR): We have a legitimate interest in understanding how users interact with the Website to improve content quality, user experience, and Website performance through anonymized analytics.
  • Legitimate Interests (Article 6(1)(f) GDPR): Server request logs, including the IP address. We have a legitimate interest in keeping the Website secure, available, and free of automated abuse.

5. Purpose and Use of Data

We use collected data exclusively for the following purposes:

  • Responding to contact form inquiries
  • Providing project estimations and consultations
  • Measuring Website traffic and popularity of content (anonymized)
  • Understanding user behavior patterns (anonymized)
  • Improving Website design, content, and performance
  • Sending the newsletter you subscribed to, and only the topics you chose
  • Publishing and moderating the comments you submit
  • Investigating abuse, automated scraping, and attacks against the Website

We will never use data for:

  • Unsolicited marketing or advertising
  • Selling or sharing data with third parties
  • Profiling or behavioral targeting
  • Any purpose not explicitly stated above

6. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with any third parties for marketing purposes.

Third-party services used:

  • Umami Analytics: Self-hosted analytics platform. Data is stored on our own servers and is not accessible to external parties.
  • Lettermint: Delivers our newsletter and transactional emails. They receive your email address and the content of the message so that it can be delivered. They do not use it for anything else. Lettermint operates entirely within the European Union.
  • Infrastructure Providers: Our hosting infrastructure may process data as part of providing services, but they have no independent right to use your data.

Our error tracking and log storage are self-hosted on our own infrastructure. Diagnostic data does not leave it.

Legal Disclosure: We may disclose information if required by law, court order, or governmental authority, or to protect our legal rights, safety, or property.

7. Data Retention

Contact Form Submissions: personal data from contact forms is deleted automatically six months after submission. You may request deletion sooner at any time (see Section 8).

Estimation Requests: personal data from estimation requests (including your name, email, company and project description) is deleted automatically six months after submission. You may request deletion sooner at any time.

Newsletter: we keep your subscription details while you are subscribed. If you unsubscribe, your subscription record is deleted immediately. A subscription request you never confirm is deleted automatically once the confirmation link expires.

Emails We Send You: a record of each email we send you, including your address and the message itself, is kept for thirty days so we can look into a delivery problem you report. It is then deleted automatically.

Comments: published comments remain on the Website alongside the article. You can ask us to delete a comment, or the name and email attached to it, at any time (see Section 8).

Umami Analytics Data: Anonymized analytics data is retained indefinitely for statistical and historical analysis purposes. It contains no personal data.

Server request logs (including IP addresses): retained for a maximum of seven months, then deleted automatically. Residual copies in our backups are deleted within a further 90 days. You can ask us to delete data relating to you at any time (see Section 8).

Theme Preference: Stored locally on your device until you manually clear your browser's local storage.

8. Your Rights

The following rights are granted by the GDPR. We extend them to all visitors, regardless of location.

  • Right to Access: You have the right to access the personal data we hold about you.
  • Right to Rectification: You may request correction of inaccurate data.
  • Right to Erasure: You may request deletion of your personal data ("right to be forgotten").
  • Right to Restrict Processing: You may request limitation of how we use your data.
  • Right to Data Portability: You may request a copy of your data in a structured format.
  • Right to Object: You may object to analytics tracking or data processing.
  • Right to Withdraw Consent: Where processing is based on your consent (forms, comments, the newsletter), you may withdraw it at any time. Withdrawal does not affect processing that happened before it.
  • Right to Lodge a Complaint: You may complain to a data protection authority. Our supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), and you may also complain to the authority in your own country.

Providing personal data on this Website is always voluntary. It is never a statutory or contractual requirement. The only consequence of not providing it is that the related feature (a reply, an estimate, the newsletter, a comment) cannot be provided.

We make no automated decisions about you and do not profile you (Article 22 GDPR).

To exercise your rights or ask questions, contact us at legal@skillfulsardine.com. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures to protect data integrity and prevent unauthorized access:

  • HTTPS encryption for all Website traffic
  • Content Security Policy (CSP) to prevent XSS attacks
  • Regular security updates and server hardening
  • Access controls and authentication for server infrastructure
  • Secure credential management

Limitation of Liability: While we strive to protect data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Opt-Out and Do Not Track

You may prevent analytics tracking using the following methods:

  • Use browser extensions like uBlock Origin or Privacy Badger
  • Disable JavaScript (will affect Website functionality)

Do Not Track and Global Privacy Control: we do not act on these signals. Your browser may send a "Do Not Track" (DNT) or Global Privacy Control (GPC) header, but our analytics do not read it. The browser extensions listed above do block our analytics.

11. Children's Privacy

This Website is not directed at individuals under the age of 16. We do not knowingly collect data from children. If we become aware that a child under 16 has provided personal information, we will take steps to delete such data immediately.

12. International Data Transfers

Our servers are located within the European Union. All personal data described in this Policy is stored there and is not transferred outside the EU/EEA.

13. Changes to This Privacy Policy

We may update this Policy when our data practices change. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically.

14. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your data, contact us at:

Email: legal@skillfulsardine.com

We will respond to all inquiries within 30 days.

15. Severability

If any provision of this Policy is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.