oAfonso

Privacy Policy

Version of 27/10/2026

Here we explain, in plain language, what personal data oAfonso processes, why, and what your rights are under the General Data Protection Regulation (GDPR).

Who is responsible for your data

[data controller — to be defined]. For any questions about your data: [contact email — to be defined].

What data we process

  • Account (if you create one): name and email. There's no password: to sign in, we email you a code, which we only store encrypted and which expires in 10 minutes. Optionally, you can add your mobile number, NIF and address.
  • Conversations with Afonso: what you ask and the answers, so you can look back at them.
  • Requests you make through Afonso (e.g. PAYT bag reservations): the contact details you give in the request.
  • Itineraries you create with Afonso, saved to your account.
  • Payments for the 24-hour pass: the date, the amount and the Viva Wallet reference (never your card details).
  • Voice: when you use voice mode, the audio is sent to be transcribed and isn't stored.
  • IP address: used only to limit the number of free messages; it's deleted automatically after 24 hours of inactivity.
  • In your browser we store an anonymous identifier and, if you sign in, your session — no advertising cookies.

What we use it for and on what legal basis

  • Providing the service you ask for (answering, saving conversations, handling requests) — performance of the service you request.
  • Sending you news by email — only if you give your consent, which you can withdraw at any time.
  • Preventing abuse (message limit) — legitimate interest in keeping the service available to everyone.

We don't sell your data or use it for advertising.

Who else processes the data (processors)

To make Afonso work, we use these services, which process data only on our behalf:

  • Vercel — Website hosting and anonymous usage statistics.
  • MongoDB Atlas — Database: account, conversations and requests.
  • Anthropic (Claude) — Generates Afonso's answers from your questions.
  • Google (Gemini) — Turns your voice into text and the answers into speech when you use voice mode.
  • Mailjet — Sending emails (access codes and confirmations).
  • Viva Wallet — Processes the payment for the 24-hour pass; your card details stay with Viva Wallet only, never with us.
  • OpenStreetMap (Nominatim) — Converts your location into an address when you share it in a request.

Some of these services may process data outside the European Union, with the safeguards provided for in the GDPR.

When you submit a request addressed to the Câmara Municipal or Vitrus Ambiente, the data in that request is sent to that entity, which then becomes responsible for it.

How long we keep it

  • Account and conversations: for as long as you have an account. When you delete it, they're deleted too.
  • Collection requests and reservations: the request record is kept for the entity handling it, but without your personal data once you delete your account.
  • IP address: up to 24 hours.
  • Payment records: for the period required by law for tax and accounting purposes, even after you delete your account.

Your rights

You have the right to access, correct, delete and take your data with you, and to object or withdraw your consent. In your account, under Account → My data, you can:

  • view and correct your data;
  • download a copy of everything we store (JSON file);
  • stop receiving news;
  • delete your account.

For other requests, write to [contact email — to be defined]. If you think your data hasn't been handled properly, you can file a complaint with the Comissão Nacional de Proteção de Dados (cnpd.pt).

Translation provided for your convenience; in case of doubt, the Portuguese version prevails.