Privacy notice
Last updated: 19 October 2026.
Who holds your data
The controller is the holder of the promos.pt site. For anything to do with privacy, including exercising the rights below, write to [email protected].
What we collect
- Account: your email address, your username (generated for you, and editable in settings) and, if you set a password, only its hash — never the password itself.
- Signing in with Google: if you choose that button, Google tells us the account identifier, the email address and the name attached to it. We never receive your Google password.
- What you post: the deals, comments, votes and reports you write, and any images you upload.
- What you save: the deals you keep for later, and nothing else.
- Sessions: session and email-link tokens, which keep you signed in and confirm your email address.
- Where you came from: if you arrive through a link carrying a campaign label — an ad or a social-media post, for instance — we keep that label (such as "advento-ads") with the account you create, to see which channels bring people. On its own, it does not identify you.
- Weekly digest: if you subscribe, we keep that choice and the date you made it, so that your consent can be shown.
- The email list, without an account: if you subscribe to the weekly digest without creating an account, we keep the email address, the language of the page you did it from, the campaign label that brought you if there was one, and the date you confirmed.
- Language: the one you choose, used for the site and for the weekly digest. With none chosen, we use the one your browser asks for.
- Visits, counted in total: Cloudflare Web Analytics counts page views, with the page, the site the visitor came from, the country, the device type, the browser and the operating system. The counts are totals: it sets no cookies and does not follow a visitor from one visit to the next.
The application does not store your IP address: usage limits are per account, not per IP. The infrastructure providers see IP addresses as part of serving requests. Cloudflare also uses the country an address belongs to for those visit counts, and its own policies cover anything else it does with them.
Why we use it, and on what basis
- Providing the service — your account, signing in, posting, voting and commenting: performance of a contract.
- Preventing abuse — hourly limits on posts and comments: legitimate interest in keeping the site usable.
- Signing in with Google — your consent, given when you choose that button.
- Measuring where accounts come from — tying the campaign label to the account it created: legitimate interest in seeing which channels bring people, with no third-party analytics.
- Counting visits — how many people visit and which pages they read, as totals and not as a profile of anyone: legitimate interest in knowing whether the site reaches people.
- Sending the weekly digest — at most one email a week with the best deals, only if you subscribe: your consent, which you can withdraw at any time with the link that comes in the email, without logging in. On the email list without an account, consent is given by confirming the subscription in that link, and withdrawing it deletes the address from the list.
- Answering you about your own deals — at most one email a day when somebody votes or comments on a deal you posted: contract performance. You can turn it off in Account Settings, or from the link in the email without signing in.
We do not profile you and we do not make automated decisions about you. We send no third-party advertising and never pass your email address to anyone: the emails we send are the weekly digest, if you subscribe, and a note when somebody replies to a deal you posted.
Who we share it with
Only the providers that make the site work, and only what is needed:
- Hetzner — the server (Germany, EU).
- Cloudflare — DNS, protection and delivery of traffic; the visit counts of Web Analytics; and the domain's email authentication reports.
- Mailtrap — sending the service's email, such as sign-in links.
- Tutanota (Tuta) — the mailbox that receives email sent to promos.pt (Germany, EU).
- Google — only if you choose to sign in with Google.
- Sentry — application error monitoring (Germany, EU). It receives the technical details of an error, such as the request that caused it, so that it can be fixed. It is not used for advertising, analytics or profiling.
Some of these providers may be outside the European Union, in particular Cloudflare and Google, in the United States. Where that is the case, the transfer relies on the EU–US Data Privacy Framework and/or standard contractual clauses approved by the European Commission.
How long we keep it
Account data is kept for as long as the account exists. If you delete your account, the content you posted goes with it: your deals, comments, votes, reports and uploaded images, and the deals you saved. You can do it at any time in Account Settings, without having to ask. Session tokens expire on their own — the "stay signed in" option lasts 30 days. Traffic logs sit with the providers above, under their own policies. An address on the email list is deleted when you unsubscribe; until you confirm it, it receives only that confirmation email and nothing else.
Your rights
You can ask for access to, correction of, erasure of, portability of, restriction of or objection to the processing of your data. Write to [email protected] and we will answer within a month. You can also complain to the CNPD, the Portuguese data protection authority.
Cookies
We set no advertising cookies, no analytics cookies and no third-party cookies. We set three:
- a session cookie, needed to keep you signed in and to protect forms;
- a "stay signed in" cookie, written only when you choose that option, which lasts 30 days;
- a language cookie, written only when you choose a language, which lasts 30 days.
All three are strictly necessary or asked for by you, so no consent is needed — and there is no cookie banner because there is nothing to consent to. Cloudflare Web Analytics sets no cookies and keeps nothing in your browser for its counts, so it needs no consent either. If we ever add cookies for analytics or advertising, this section changes and consent is asked for first.
Changes
If this notice changes, the date at the top changes with it. Material changes will be announced on the site.