Privacy Policy

Portugal Expats AI is a brand operated by OCEANIRREQUIETO - UNIPESSOAL LDA, Portugal, which is the controller. Company number: NIF/NIPC 518779700. Registered address: Rua das Murtas, n.º 13, Outeirinho, 2655-437 Ericeira, Mafra, Lisboa, Portugal. For any privacy request, write to hello@oceanirrequieto.com.

• What you type into the conversation with Poe, and the structured recommendation built from it.
• Your email address, and whether it has been verified.
• Account details if you create one: sign-in identifier, saved lists, notes and tags you add.
• Business listing information submitted by professionals, intended to be public.
• Technical and security data: one-way hashed visitor and network identifiers, timestamps, event types, and errors.
• Payment status for listing subscriptions. Card details are handled by the payment processor and never reach us.

We do not ask for special category data and ask you not to send any.

• To publish and maintain recommendations — consent.
• To verify that a contribution comes from a real person — legitimate interest in a trustworthy network.
• To run accounts, saved lists and business listings — performance of a contract.
• To prevent abuse, spam and fraud — legitimate interest.
• To meet tax, accounting and legal obligations — legal obligation.

To answer your search, the service builds a public profile for each professional or business: name, service, area covered, languages, contact details, opening hours and recommendation history. It then automatically matches and ranks those profiles against what you asked for — service, city, distance, languages and availability — using recommendation confidence and how recently the details were confirmed. That is a form of automated profiling, but it is not used for advertising and it does not produce legal effects about individuals. A street address or postcode a business gives us is shown only to people signed in to the service: it is never published on the public page, in a share card or in a search engine.

Some details in a profile come from a recommender or from the professional's own listing. When a recommendation or listing includes a website or social link, we may read that public page to fill in or confirm service, contact and location details. We only read pages the professional published or that the recommender pointed us to; we do not scrape registries or buy data. We record the source and confidence of each detail so its origin stays visible.

Recommendations carry a confidence value, and submissions are scored for abuse risk so anything suspicious can be held for human review. No decision with legal or similarly significant effect about a person is taken automatically.

If you are a sole trader or professional described in a profile, that profile may be personal data about you. You have the same rights as any other data subject, including correction and erasure, and you can claim the profile to manage or remove it.

Only with processors acting on our instructions: hosting and database, email delivery, payments, and the AI language service used by Poe. Each is bound by a data processing agreement. We never sell personal data or share it for advertising.

Published recommendations and business profiles are public by design. Your name is not attached to a recommendation unless you choose to display it.

Our core infrastructure is hosted in the European Union. Where a supporting service processes data outside the EEA, we rely on the European Commission's Standard Contractual Clauses and the safeguards documented by the provider.

Platform data residency and security: trust.lovable.dev

We use browser storage for things the site cannot work without: keeping you signed in, remembering your language, and holding an unfinished recommendation draft so a refresh does not lose your work. We do not use advertising or cross-site tracking cookies.

• Unfinished drafts: in your browser only, cleared when you start again.
• Published recommendations: while they stand; removed when withdrawn.
• Verification records: only as long as needed to prove verification and prevent repeat abuse.
• Security logs: a short rolling window, then deleted.
• Listings: for the subscription term and a short period afterwards.
• Payment records: as long as Portuguese law requires.
• Documents sent to claim a profile: kept privately only until the claim is decided, then deleted immediately.

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent. Email hello@oceanirrequieto.com and we will reply within one month. You can complain to the CNPD in Portugal, or to your own national supervisory authority.

Poe interprets language and structures recommendations and searches. The service also matches and ranks professional profiles automatically. None of this produces legal or similarly significant effects about a person; anything held for moderation is reviewed by a person.

The service is intended for adults. We do not knowingly collect data from children under 16 and will delete such data if we become aware of it.

If we change this notice materially we will update the date below and, where the change affects you directly, tell you by email.

There is exactly one optional category: usage analytics. It is off until you say yes, and you can withdraw it at any time from “Cookie & consent preferences” in the footer. Withdrawing is as easy as giving.

• Strictly necessary (no consent needed; legitimate interests and performance of a contract): your sign-in session, protection against abuse, your language choice, and a recommendation you are part-way through.
• Usage analytics (consent): counts of which pages and steps are used, so we can fix what confuses people. No advertising, no ad targeting, no cross-site or cross-device tracking, and no behavioural profiling of visitors for marketing.

When you choose, we keep a record of that choice for twelve months so we can demonstrate it was respected: a random browser identifier, a session identifier, the choice itself, how it was made, the version of this notice, the page, the language, your IP address and a code derived from it, the browser string, the country and approximate town or region your network reports, and — if you are signed in — your account and whether your email is confirmed. After twelve months the record is deleted.