Privacy Policy

This site (bolalabs.pt) and its associated client portal are operated by BolaLabs, a brand registered in Portugal that provides software engineering and applied AI consulting services.

For any question about this document or the data we process, contact suporte@bolalabs.pt.

The data controller is BolaLabs, Portugal, Europe. Legal identification details are provided on request by email to data subjects and competent authorities. Contact: suporte@bolalabs.pt.

When you submit the contact form, we collect your name, email, company (optional field), the type of service you're interested in, and the message you write. If you fill them in, we also collect three optional context fields — company size, current system and expected timeframe — so we arrive at the conversation already informed. This data is stored in our database (Convex), in a table dedicated to incoming messages.

Submitting the form requires accepting this Privacy Policy; we store that fact (and the date/time you accepted it) alongside your message, as a record of consent.

Only an authenticated administrator session can read these messages in the backoffice. When one arrives, its contents are also e-mailed to BolaLabs through Resend (see the processors section), so a message does not sit unread until someone opens the panel. They are not used for any purpose other than responding to your inquiry, and are shared with nobody else.

We use this data only to respond to your contact request; the email you enter is validated on the server before being accepted.

To access the portal as a client, you provide an email. We do not create the account at that moment: we send a single-use confirmation link to that email, valid for 15 minutes. Only after you click it is the client account created (the first time) or reactivated, and the session begins — this ensures only whoever has access to that mailbox can sign in. Administrator accounts do not use this confirmation email: they always require an additional access key, validated on the server, and the session is created immediately.

To generate the confirmation link, we temporarily store, linked to your email: a cryptographic digest of the token (never the token itself), its expiry time, and whether it has already been used. This record is deleted automatically shortly after it expires or is used.

To prevent abuse, we also limit how many access or confirmation requests can be made in a short period from the same email; this counter is not linked to any other data about you and is likewise deleted automatically.

Once authenticated (after confirming your email, or after validating the administrator key), we create a session with a token stored in your browser, valid for 30 days. When you log out, or once that period elapses, the token is no longer accepted by the server.

If you open a support request in the portal, we store its subject, type and priority, the messages exchanged with BolaLabs, the files you attach (up to 10 MB each, work formats only such as images, PDF or spreadsheets) and when each side last read it. Only your account and BolaLabs can access this conversation; BolaLabs internal notes stay on our side and hold no data beyond what you sent us.

When there is a reply, we email you a notice with the request number, its subject and a link to the portal — never the conversation itself. Files uploaded but never attached to a message are deleted automatically after 24 hours.

This site does not use cookies. It only uses browser local storage (localStorage) to hold four values:

• bolalabs_theme — your theme preference (light or dark).
• bolalabs_lang — your language preference.
• bolalabs_a11y — your reading preferences from the accessibility panel (text size, contrast, motion), only if you change them.
• bolalabs_session_token — your portal session, only after you log in.

You can clear these values at any time in your browser settings; doing so does not affect public browsing of the site — it only ends your portal session, if any.

The site's typefaces (Archivo, IBM Plex Sans, JetBrains Mono) are self-hosted — none are loaded from an external CDN.

We do not currently use any traffic analytics, advertising or tracking cookie tool. A cookieless, self-hosted analytics tool is planned for a later phase; when that happens, this policy will be revised before it goes live.

Sending the access confirmation email (see previous section) and notifying us of contact messages are handled by Resend (Resend, Inc.), configured on 12 September 2026. Resend acts as a data processor under its data processing agreement, with delivery and processing in the United States on the basis of EU standard contractual clauses. It receives the recipient address and the message body — nothing else.

The site's backend (database, authentication and server functions) is provided by Convex. Convex, Inc. acts as a data processor under its data processing agreement (DPA), with the data hosted and processed in the United States on the basis of EU standard contractual clauses.

Contact messages are kept for a maximum of 24 months after the last contact. Account data, including support requests and their attachments, is kept for as long as the account remains active and deleted on request.

Under the General Data Protection Regulation, you have the right to:

• Access the personal data we process about you.
• Rectify inaccurate or incomplete data.
• Request the erasure of your data.
• Restrict the processing of your data in certain circumstances.
• Request the portability of your data to another service.
• Object to the processing of your data.

To exercise any of these rights, contact suporte@bolalabs.pt.

No data protection officer (DPO) has been appointed: given the size and nature of this activity, such an appointment is not required by the GDPR. Any question about personal data can be addressed directly to suporte@bolalabs.pt.

The competent supervisory authority in Portugal is the CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt, geral@cnpd.pt), with which you can lodge a complaint.

Should any material changes be made to this policy, this page will be updated.