How we stay compliant

Portugal Expats AI is a brand operated by OCEANIRREQUIETO - UNIPESSOAL LDA, Portugal, which is the data controller for the personal data described on this page. Company number: NIF/NIPC 518779700. Registered address: Rua das Murtas, n.º 13, Outeirinho, 2655-437 Ericeira, Mafra, Lisboa, Portugal.

Official registered address:

• Rua das Murtas, n.º 13, Outeirinho
• 2655-437 Ericeira
• Freguesia: Ericeira
• Concelho: Mafra
• Distrito: Lisboa
• Portugal

Any question about privacy, data protection or compliance can be sent to hello@oceanirrequieto.com and will be answered by a person, not an automated system.

We are an EU business serving EU residents, so EU and Portuguese law applies to everything we do. In particular:

• General Data Protection Regulation (Regulation (EU) 2016/679) — lawful basis, transparency, minimisation, security and your rights as a data subject.
• Lei n.º 58/2019 — the Portuguese law implementing the GDPR, including the supervisory role of the CNPD (Comissão Nacional de Proteção de Dados).
• ePrivacy rules as implemented in Portugal (Lei n.º 41/2004) — what we may store on your device and when we may email you.
• EU consumer protection law, including the Unfair Commercial Practices Directive as amended by Directive (EU) 2019/2161 — the rules on consumer reviews, endorsements and ranking transparency.
• Digital Services Act (Regulation (EU) 2022/2065) — the duties that apply to a small platform that hosts content submitted by its users, including notice-and-action and a clear point of contact.
• Portuguese consumer and distance-selling rules (Decreto-Lei n.º 24/2014) for paid business listings.

EU consumer law makes it unlawful to present recommendations as genuine when they are not, and to conceal paid placement. We build to that rule rather than around it.

• Every recommendation on the platform comes from a real person who says they used that professional, and who verifies an email address before it is published.
• We do not invent testimonials, and we do not publish star ratings or review scores.
• Nobody can pay for a higher position. A paid business listing buys a profile, never ranking.
• Recommendations can be withdrawn by the person who made them, and withdrawn recommendations stop counting.

• Recommendation drafts and published recommendations — the professional's name, service, location and your reason for recommending them. Purpose: running the network. Basis: your consent, withdrawable at any time. The record also holds the professional's details because the recommendation is about them.
• Your verified email address — proof that a recommendation came from a real person, and account sign-in. Purpose: fraud prevention and account access. Basis: legitimate interest in a trustworthy network, and contract where you hold an account.
• Business listing details submitted by professionals — contact and service information intended to be public. Purpose: performing the listing agreement. Basis: contract.
• Payment records for listings — handled by our payment processor; we never see or store full card details. Basis: contract and legal record-keeping obligations.
• Security and abuse logs — one-way hashed visitor identifiers, timestamps and event types. Purpose: rate limiting and abuse prevention. Basis: legitimate interest in keeping the service safe.
• Conversation content you type to Poe — used to structure your recommendation or request. Basis: consent.

We ask for the minimum needed for each step. We do not sell personal data, and we do not use it for advertising or behavioural profiling of visitors for marketing.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable form. Where we rely on consent, you can withdraw it at any time — including by withdrawing a recommendation.

Write to hello@oceanirrequieto.com and we will respond within one month, as the GDPR requires. We do not charge for this. If you are not satisfied, you can complain to the CNPD, Portugal's data protection authority, or to the supervisory authority in your own EU country.

The application database, file storage and authentication run on managed cloud infrastructure hosted in the European Union. Where a supporting service processes data outside the EEA, that transfer is covered by the European Commission's Standard Contractual Clauses together with the safeguards the provider documents publicly.

The compliance posture of the platform our infrastructure is built on — including its regions, certifications and subprocessors — is published at its trust centre:

trust.lovable.dev

Portugal Expats AI is built and hosted on the Lovable platform. Rather than making claims about that platform on its behalf, we point you at the source: its trust centre publishes its security programme, certifications and audit reports, its subprocessor list, its data residency options and its incident response practices, and it is kept current by the platform itself.

Review the platform trust centre

What this means in practice is that the controls beneath our application — physical security, network isolation, patching, backup and monitoring of the hosting layer — are operated and evidenced by the platform, while the application-level decisions on this page are ours. Where you need formal assurance about the infrastructure layer for your own due diligence, the trust centre is the authoritative place to get it.

https://trust.lovable.dev/

We do not claim any certification of our own. Any certification, audit outcome or compliance report referenced here belongs to the platform and is published by the platform at its trust centre.

Poe is our helper. It reads what you write in plain language and turns it into structured information — which professional, which service, which town, and why you recommend them. Interpretation happens on our servers; the model never receives more than the conversation needs.

To answer searches, the service builds and evaluates a profile for each professional or business: service, area covered, languages, contact details, opening hours and recommendation history. It automatically matches those profiles against what you asked for — service, city, distance, languages and availability — and ranks results using recommendation confidence and how recently details were confirmed. Recommendations carry a confidence value, and submissions are scored for abuse risk so anything suspicious can be held for review.

When a recommendation or listing includes a website or social link, we may read that public page to fill in or confirm service, contact and location details. We only read pages the professional published or that the recommender pointed us to; we do not scrape registries or buy data. We record where each detail came from so its origin stays visible.

• No decision with legal or similarly significant effect about a person is taken automatically. Publication, moderation holds and listing decisions are governed by rules we define, and a person reviews anything held for review.
• Poe cannot invent a recommendation. Required details come from you, and the application — not the model — decides when a recommendation is complete.
• Poe's scope is deliberately narrow. Off-topic and manipulative input is screened before it reaches the model, and screened again on the way out.
• We keep short, versioned records of AI requests for quality and safety monitoring, without storing more personal detail than the conversation already contained.

• All traffic is served over HTTPS; data is encrypted in transit and at rest.
• Every database table is protected by row-level access rules, so an account can only read and write its own records.
• Our security and abuse logs identify visitors by one-way hashes, not by stored raw IP addresses or names. The separate consent log does store an IP address because that is standard evidence of a consent choice under Article 7 GDPR.
• Recommendations require a verified email address before they can be published.
• Rate limits and abuse screening apply to conversations, verification codes and submissions.
• Private uploads are scoped to the account that uploaded them and cannot be signed into a public gallery by anyone else.

Hosting-layer security is operated by the platform and evidenced at its trust centre.

trust.lovable.dev

• Unfinished recommendation drafts: kept in your own browser only, and cleared when you start again.
• Published recommendations: kept while they stand, and removed when withdrawn or when the listing is removed.
• Verification records: kept only as long as needed to prove a contribution was verified and to prevent repeat abuse.
• Security and abuse logs: kept for a short rolling window for detection purposes, then deleted.
• Business listings: kept for the duration of the subscription and a short period afterwards, then removed.
• Payment records: kept for the period Portuguese tax and accounting law requires.
• Documents sent to claim a business profile (licence, identity document or passport selfie): held in private storage only until the claim is decided, then deleted immediately. We keep only a note of which kind of document was checked, by whom and when.

We use a small number of processors, each under a data processing agreement and each limited to what it needs:

• Application hosting, database, authentication and file storage — the Lovable platform and its EU-hosted cloud infrastructure.
• Transactional email delivery — for verification codes and account messages.
• Payments — for business listing subscriptions; card data stays with the processor.
• AI language interpretation — for Poe, called server-side only.

The platform publishes its own subprocessor list and keeps it current at its trust centre:

https://trust.lovable.dev/

To report a security issue, a listing that should not be published, content that infringes your rights, or a profile that describes you and should be corrected or removed, email hello@oceanirrequieto.com. We aim to acknowledge within two working days and to act on clear cases promptly.

Please do not publicly disclose a suspected vulnerability before contacting us. We will not pursue anyone who reports a genuine issue in good faith and without accessing other people's data.

Consent is asked once, in a small bar, with accepting and refusing equally easy, and only for one optional category: usage analytics. Nothing optional runs before the choice is made. The choice can be changed or withdrawn at any time from “Cookie & consent preferences” in the footer.

Every choice is written to an internal consent log, readable only by our administrators, recording the choice, the method, the version of the notice shown, the moment, the browser and session identifiers, the IP address and a code derived from it, the country and the approximate town or region your network reports, and the account where there is one. Where the record belongs to an account, our administrators can see that address and approximate place alongside the account, which we use only to keep the network safe and to understand which towns it serves. These records are our evidence under Article 7 GDPR and are deleted after twelve months.

We run no advertising, no ad targeting, no cross-site or cross-device tracking, and no behavioural profiling of visitors for marketing. We do not sell personal data. The service does build public profiles of professionals and businesses to answer searches, and it does score recommendation confidence and abuse risk; those are explained in the Poe, AI and profiles section above. No automated decision with legal or similarly significant effect is taken about a person.