Privacy policy
This English version is provided for convenience; in case of any discrepancy, the Portuguese version prevails.
1. Who is the controller
Cardi Invest is a service of LuxuryCardinal Unipessoal Lda, tax number (NIF) 517768119, Rua Marquesa de Alorna, 31, 3.º D, 1700-300 Lisboa, Portugal (“we”). Contact for privacy matters: contato@luxurycardinal.pt.
2. What data we process
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, e-mail, password (stored only as a hash), Google identifier if you sign in that way | Creating and managing your account, signing in, recovering your password | Performance of a contract (Art. 6(1)(b)) |
| Deals you analyse: links and text of listings, photos you upload, figures, scenarios, comparables, generated documents | Carrying out the analyses, saving them and letting you return to them | Performance of a contract |
| Messages exchanged with the Cardi assistant | Answering your questions and filling in the analysis | Performance of a contract |
| Technical data (IP address, browser type, access logs) | Security, prevention of abuse and automated accounts | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for advertising and we do not sell it. Third-party listings you analyse may contain contact details of sellers or agents; we process them only for your private analysis.
3. Visitors without an account
You can carry out a first analysis without an account. In that case, the analysis is stored only in your browser and is deleted automatically after 7 days, or when you create an account (it then moves to your account).
4. Who we share data with (processors)
- Supabase — database hosting and authentication, in the European Union.
- Vercel — application hosting.
- Anthropic — artificial intelligence processing (Cardi assistant, reading listings and searching for comparables). Requests may be processed outside the European Economic Area, with the safeguards of the European Commission’s standard contractual clauses.
- Cloudflare — bot protection (Turnstile).
- Google (Gemini) — renovated images in “before and after”: the photo you choose is sent to generate the simulation and is not stored by Cardi Invest. Do not send photos showing people or documents.
- Stripe — subscription payments (when enabled): Stripe receives your email, name, billing address and payment details; Cardi Invest never sees or stores card details.
- Google — only if you choose “Continue with Google”.
Shares you make. If you share a deal with a connected contact, that contact only sees the blocks you choose (by default: summary, numbers and scenarios), as a copy from the moment of sharing. Seller contacts and photos are never shared. You can stop sharing at any time; the share also disappears if the connection between you ends.
Running the platform. To run Cardi Invest (growth, usage and costs) we record, per account, usage counts (analyses, active days, energy used and how often you use each feature, such as the map, PDF or Excel) and the estimated cost of artificial intelligence, without storing the content of requests. Only authorised administrators can see this data, and every query is logged (audit log, kept for 24 months). Per-account costs are kept for up to 25 months and are included when you export your data. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Visit statistics, without cookies. We count page views in the app to know how many people visit it, where they come from (referring site or campaign), from which country and with what kind of device. We do not use cookies or store your IP address: each visitor is counted with a code that changes every day and is deleted after 2 days, and only daily totals are kept (for up to 25 months). If your browser asks not to be tracked (Global Privacy Control or Do Not Track), the visit is not counted. Legal basis: legitimate interest.
5. How long we keep data
For as long as you have an account. If you delete your account, your data is removed immediately from the live database and from backups within 30 days at most. Technical security logs: up to 90 days.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. In the app, under My profile, you can edit your data, export all your data (JSON file) and delete your account. For other requests, write to contato@luxurycardinal.pt. You can lodge a complaint with the Portuguese data protection authority, CNPD (cnpd.pt).
7. Security
Encrypted connections (HTTPS), passwords stored only as a hash, database access rules that prevent each user from seeing another user’s data, documents in private storage, and sessions with automatic renewal and sign-out.
8. Cookies and local storage
We use only what is strictly necessary: your sign-in session and temporary visitor analyses in the browser’s storage. We do not use advertising cookies or third-party analytics cookies.
9. Beta
Cardi Invest is in a free Beta phase. The analyses are preliminary and do not replace a valuation, document checks, or legal or tax advice.