Privacy Policy

The data controller is charmedgiraffe, operated as an independent project based in Porto, Portugal. If you have any questions about how we handle your data, you can reach us at privacy@charmedgiraffe.com.

We collect only the minimum data necessary to provide the service:

• Email address — provided voluntarily when you sign up or request a magic-link sign-in.
• WhatsApp number — provided voluntarily if you choose WhatsApp as a digest delivery channel.
• Digest preferences — your chosen delivery day, channel, and event category interests.
• Usage data — anonymised analytics on pages visited and events clicked, used solely to improve the service. We do not track you across other websites.

We do not collect payment information. charmedgiraffe is a free service.

Your data is used exclusively for the following purposes:

• Authentication — your email is used to send a secure, one-time magic link so you can access your account. We never store passwords.
• Event digest delivery — to send you a curated list of Porto events by email or WhatsApp according to your preferences.
• Service improvement — aggregated, anonymised analytics help us understand which categories and events are most relevant.
• Communications — occasional service notices such as changes to these terms or scheduled downtime.

Our legal basis for processing your data is your explicit consent given at sign-up, and our legitimate interest in operating and improving the service. You may withdraw consent at any time by deleting your account.

We use a small number of strictly necessary cookies to maintain your authenticated session. We may also use privacy-respecting analytics (such as Plausible Analytics or a self-hosted solution) that collect no personally identifiable information and set no cross-site tracking cookies. We do not use Google Analytics or any advertising network.

We do not share, rent, or sell your personal data to third parties. We may share data only in the following limited circumstances:

• Service providers — infrastructure partners (hosting, transactional email) who process data on our behalf under strict data-processing agreements.
• Legal obligations — if required to do so by a court order or applicable law.

Under no circumstances do we sell or monetise your personal data.

We retain your email address and preferences for as long as you have an active account. If you delete your account, your personal data is permanently removed within 30 days, except where retention is required by law. Anonymised analytics data has no personal identifiers and may be retained indefinitely.

Under the GDPR you have the following rights regarding your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate data.
• Right to erasure — you may ask us to delete your account and all associated data.
• Right to portability — you may request your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests.

To exercise any of these rights, email us at privacy@charmedgiraffe.com. We will respond within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) at www.cnpd.pt.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. Access to personal data is restricted to authorised personnel on a need-to-know basis. Authentication is handled via signed, short-lived magic links — no passwords are stored.