Legal
Privacy policy
Version of 20 October 2026, to be reviewed by a lawyer before launch.
- Controller
- Eduardo Viegas, author of Dubio, an academic project of the Master’s in Finance and Accounting at the University of Beira Interior. Contact: contacto@dubio.app.
- What data
- The account email and name and the profile. For each session: the browser, the system, the approximate city and country (from the network), when it started and when it was last used, to the nearest hour. When a change of email is requested, the new address is kept for 15 minutes awaiting confirmation, and the old one for 7 days, so it can be restored.
- The IP address
- The IP address is used to protect sign-in against abuse, such as repeated link requests. Cloudflare uses it in counters that last one minute. Supabase, the authentication provider, keeps it with each session while the session is open, and in its technical logs for one day. Dubio’s own tables do not keep it.
- What for
- Signing in, producing the reports, sending the account emails (sign-in, invitation, change of email) and showing in My account where sessions are open.
- Legal basis
- Performance of the account’s terms of use (Article 6(1)(b) of Regulation (EU) 2016/679) and the legitimate interest in securing sign-in (point (f)).
- How long
- While the account exists. A session lasts 30 days, and an unaccepted invitation, 7. When the account is deleted, it closes at once and, after 7 days, the email, the name, the sessions and the devices are deleted for good. During those 7 days, the account can be restored. Reports stay, with no personal data. When the author removes access, the account is blocked and nothing is deleted, until it is deleted.
- Who processes the data
- Supabase (accounts, authentication and files), in the Frankfurt region, in the European Union; Cloudflare (site hosting, protection against abuse and forwarding of the contact email), on a global network; Resend (sending the emails).
- Cookies and storage
- Three cookies, all Dubio’s own and needed to sign in: two for the session, which last 30 days, and one for the sign-in request, which lasts one hour. There are no third-party, analytics or advertising cookies. The browser’s storage, which never leaves the device, keeps the theme, a note that the opening has been seen and, during sign-in, the email asked for, until the tab is closed. The language is the address itself (/en/ for English).
- Rights
- Access and portability (Download my data), rectification (name and email, in My account), erasure (Delete the account) and objection, by email. Complaints to the Portuguese data protection authority (CNPD).
- Contact
- contacto@dubio.app