1. Introduction and Scope

This Privacy Policy ("Policy") explains what personal data Skillful Sardine - Unipessoal Lda. ("we," "us," "our," or "Company") collects when you use the website manueltgomes.com (the "Website"), why we collect it, how long we keep it, and the rights you have over it.

Governing Law: This Policy is governed by and construed in accordance with the laws of Portugal, without regard to its conflict of law provisions.

2. Data Controller

The data controller responsible for your personal data is:

Skillful Sardine - Unipessoal Lda.
Email: legal@skillfulsardine.com

3. Information We Collect

3.1 Contact Form

When you submit a contact form, we collect the following information:

  • Full name
  • Email address
  • Message content

Purpose: This information is collected solely to respond to your inquiry and facilitate communication.

3.2 Estimation Request Form

When you submit an estimation request form, we collect the following information:

  • Full name
  • Email address
  • Company name (optional)
  • Project details and description
  • Budget range and timeline preferences
  • Additional project requirements

Purpose: This information is collected solely to provide project estimations and facilitate business communication.

3.3 Newsletter Subscription

If you subscribe to the newsletter, we collect:

  • Email address (required)
  • Name (optional)
  • The topics you chose to receive
  • The date you subscribed

No confirmation email. You are subscribed as soon as you submit the form. Every email we send you contains a link that unsubscribes you in one click.

Our emails contain no tracking. There are no tracking pixels, no open tracking, and no click tracking. We cannot tell whether you opened an email or which links you clicked.

Purpose: Solely to send you the emails you subscribed to.

3.4 Server Request Logs

Our servers keep a log of requests made to the Website. This log records:

  • IP address
  • Browser user agent
  • The page requested, the response status, and how long the request took
  • The referring page, if any
  • Standard request headers (never cookies, never authorisation headers)

Purpose: Security. These logs allow us to investigate abuse, automated scraping, and attacks against the Website.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in keeping the Website secure and available.

An IP address is personal data under the GDPR, and we treat these logs accordingly, even though we never link them to a name.

Security-sensitive values are removed before they are written. If a link you follow contains a confirmation token (for example a newsletter confirmation link), that token is stripped from the log rather than stored.

3.5 Reactions

Reactions record no personal data. When you react to an article, we store which article it was and which reaction you chose. We store no IP address and no other identifier with a reaction.

3.6 Comments

If you comment on an article, we collect:

  • Your comment text (required)
  • Name (optional; comments can be anonymous)
  • Email address (optional; never displayed publicly)

No IP address and no browser data are stored with a comment. Every comment is reviewed by a person before it appears on the Website, and we may decline to publish or may remove a comment at any time.

Purpose: To display your comment alongside the article and to moderate discussion.

3.7 Booking a Session

You book a session through Cal.com, a scheduling service run by Cal.com, Inc. The Website links to the booking page and sends Cal.com no information about you. Cal.com handles bookings on our behalf. Its own privacy policy applies to its website and to its account holders (cal.com/privacy).

When you book, we and Cal.com receive:

  • Your name and email address
  • Your answers to the booking questions (what you are working on, and optionally a link)
  • The date and time you choose, and your time zone
  • Technical data Cal.com records when you use its page: IP address, browser and device, referring page and timestamps

Cal.com sends you a confirmation email and a meeting invitation with a Microsoft Teams link.

Payment. Sessions are paid when you book. The payment is processed by Stripe through Cal.com, and we never receive or store your card number. We receive confirmation that the payment was made, together with your name and email address.

Video call. The session takes place on Microsoft Teams, so Microsoft processes the call and its meeting details.

Invoices. For paid sessions we issue an invoice in Moloni, an invoicing service. The invoice carries your name and the details needed for it. If you give them to us, it also carries a company name, tax number and address.

Purpose: To provide the session you booked, take payment, communicate with you about it, and issue the invoice.

3.8 Information We DO NOT Collect

We do not collect, store, or process any of the following:

  • Payment card details (payments for sessions are handled by Stripe, see Section 3.7)
  • Device identifiers or advertising IDs
  • Cross-site tracking data
  • Any data sold, rented, or shared with advertisers

3.9 Information Collected via Umami Analytics

We use Umami, a privacy-focused analytics platform that collects anonymized usage data. Umami operates without cookies and does not track you across websites.

Data collected by Umami (anonymized):

  • Page views and page URLs visited
  • Referrer source (where you came from)
  • Browser type and version
  • Operating system
  • Device type (desktop, mobile, tablet)
  • Screen resolution
  • Country, region, and city (derived from the IP address; the IP address itself is not stored)
  • Session duration and timestamp of visit

What Umami does not do:

  • No cookies are set on your device
  • No IP address is stored
  • No cross-site tracking
  • We cannot identify individual visitors from this data

3.10 Theme Preference (Local Storage)

If you change the Website's theme (light/dark mode), your preference is stored locally in your browser's localStorage. This data:

  • Is stored exclusively on your device
  • Is never transmitted to our servers
  • Can be deleted by clearing your browser's local storage

4. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process data under the following legal bases:

  • Consent (Article 6(1)(a) GDPR): When you submit a contact form, an estimation request, or a comment, you provide explicit consent for us to process the personal data you include.
  • Consent (Article 6(1)(a) GDPR): The newsletter. You give consent by submitting the subscription form. You may withdraw that consent at any time by unsubscribing, and withdrawing consent is as easy as giving it (Article 7(3) GDPR).
  • Contract (Article 6(1)(b) GDPR): When you book and pay for a session, we process your data to provide that session, take payment and communicate with you about it.
  • Legal Obligation (Article 6(1)(c) GDPR): We keep invoices for paid sessions because Portuguese tax and accounting law requires it.
  • Legitimate Interests (Article 6(1)(f) GDPR): We have a legitimate interest in understanding how users interact with the Website to improve content quality, user experience, and Website performance through anonymized analytics.
  • Legitimate Interests (Article 6(1)(f) GDPR): Server request logs, including the IP address. We have a legitimate interest in keeping the Website secure, available, and free of automated abuse.

5. Purpose and Use of Data

We use collected data exclusively for the following purposes:

  • Responding to contact form inquiries
  • Providing project estimations and consultations
  • Providing the sessions you booked, taking payment for them and issuing invoices
  • Measuring Website traffic and popularity of content (anonymized)
  • Understanding user behavior patterns (anonymized)
  • Improving Website design, content, and performance
  • Sending the newsletter you subscribed to, and only the topics you chose
  • Publishing and moderating the comments you submit
  • Investigating abuse, automated scraping, and attacks against the Website

We will never use data for:

  • Unsolicited marketing or advertising
  • Selling your data, or letting third parties use it for their own purposes
  • Profiling or behavioral targeting
  • Any purpose not explicitly stated above

6. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with any third parties for marketing purposes.

Third-party services used:

  • Umami Analytics: Self-hosted analytics platform. Data is stored on our own servers and is not accessible to external parties.
  • Lettermint: Delivers our newsletter and transactional emails. They receive your email address and the content of the message so that it can be delivered. They do not use it for anything else. Lettermint operates entirely within the European Union.
  • Cal.com: Scheduling and booking. Cal.com, Inc. is a US company. It receives the details you enter when you book and handles them on our behalf, as our processor.
  • Stripe: Processes the payment for a session. It receives your payment details directly, and we never receive your card number.
  • Microsoft: Provides the Microsoft Teams video call for the session. It processes the call and its meeting details.
  • Moloni: The invoicing service we use to issue invoices. It receives the name and invoicing details that appear on the invoice.
  • Infrastructure Providers: Our hosting infrastructure may process data as part of providing services, but they have no independent right to use your data.

Our error tracking and log storage are self-hosted on our own infrastructure. Diagnostic data does not leave it.

Legal Disclosure: We may disclose information if required by law, court order, or governmental authority, or to protect our legal rights, safety, or property.

7. Data Retention

Contact Form Submissions: personal data from contact forms is deleted automatically six months after submission. You may request deletion sooner at any time (see Section 8).

Estimation Requests: personal data from estimation requests (including your name, email, company and project description) is deleted automatically six months after submission. You may request deletion sooner at any time.

Newsletter: we keep your subscription details while you are subscribed. If you unsubscribe, your subscription record is deleted immediately.

Emails We Send You: a record of each email we send you, including your address and the message itself, is kept for thirty days so we can look into a delivery problem you report. It is then deleted automatically.

Comments: published comments remain on the Website alongside the article. You can ask us to delete a comment, or the name and email attached to it, at any time (see Section 8).

Umami Analytics Data: Anonymized analytics data is retained indefinitely for statistical and historical analysis purposes. It contains no personal data.

Server request logs (including IP addresses): retained for a maximum of seven months, then deleted automatically. Residual copies in our backups are deleted within a further 90 days. You can ask us to delete data relating to you at any time (see Section 8).

Booked Sessions: Cal.com keeps your booking details, and Stripe keeps the payment record, each under its own retention terms, which are set out in their privacy policies. Our copy of the booking confirmation is kept for as long as we need it to provide the session and to meet our legal obligations. You can ask us to delete the booking data we hold about you at any time (see Section 8).

Invoices: invoices for paid sessions are kept for the period Portuguese tax and accounting law requires, and cannot be deleted on request before that period ends.

Theme Preference: Stored locally on your device until you manually clear your browser's local storage.

8. Your Rights

The following rights are granted by the GDPR. We extend them to all visitors, regardless of location.

  • Right to Access: You have the right to access the personal data we hold about you.
  • Right to Rectification: You may request correction of inaccurate data.
  • Right to Erasure: You may request deletion of your personal data ("right to be forgotten").
  • Right to Restrict Processing: You may request limitation of how we use your data.
  • Right to Data Portability: You may request a copy of your data in a structured format.
  • Right to Object: You may object to analytics tracking or data processing.
  • Right to Withdraw Consent: Where processing is based on your consent (forms, comments, the newsletter), you may withdraw it at any time. Withdrawal does not affect processing that happened before it.
  • Right to Lodge a Complaint: You may complain to a data protection authority. Our supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), and you may also complain to the authority in your own country.

Providing personal data on this Website is voluntary. If you choose not to, the related feature (a reply, an estimate, the newsletter, a comment, a booked session) cannot be provided. Booking a paid session needs your name and email address so that we can provide it.

We make no automated decisions about you and do not profile you (Article 22 GDPR).

To exercise your rights or ask questions, contact us at legal@skillfulsardine.com. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures to protect data integrity and prevent unauthorized access:

  • HTTPS encryption for all Website traffic
  • Content Security Policy (CSP) to prevent XSS attacks
  • Regular security updates and server hardening
  • Access controls and authentication for server infrastructure
  • Secure credential management

Limitation of Liability: While we strive to protect data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Opt-Out and Do Not Track

You may prevent analytics tracking using the following methods:

  • Use browser extensions like uBlock Origin or Privacy Badger
  • Disable JavaScript (will affect Website functionality)

Do Not Track and Global Privacy Control: we do not act on these signals. Your browser may send a "Do Not Track" (DNT) or Global Privacy Control (GPC) header, but our analytics do not read it. The browser extensions listed above do block our analytics.

11. Children's Privacy

This Website is not directed at individuals under the age of 16. We do not knowingly collect data from children. If we become aware that a child under 16 has provided personal information, we will take steps to delete such data immediately.

12. International Data Transfers

Our servers are located within the European Union. All personal data described in this Policy is stored there, except the data involved in booking a session (Section 3.7).

Booking a session involves services that process data outside our servers. Cal.com, Inc. is a US company and processes bookings in the United States. It states that it complies with the EU-U.S. Data Privacy Framework, and where that does not apply it relies on the EU Standard Contractual Clauses. Stripe, Microsoft and Moloni process data under the safeguards described in their own privacy notices.

13. Changes to This Privacy Policy

We may update this Policy when our data practices change. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically.

14. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your data, contact us at:

Email: legal@skillfulsardine.com

We will respond to all inquiries within 30 days.

15. Severability

If any provision of this Policy is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.