Privacy Policy

Crash Pad Lda (“Limitada”, “we”) operates the Limitada platform at limitada.pt and app.limitada.pt (the “Platform”). This policy describes how we collect, use and protect personal data, in line with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portuguese Law 58/2019.

This English version is provided for convenience. In case of any discrepancy, the Portuguese version prevails.

Effective date: 13 May 2026

1. Data Controller

Crash Pad Lda NIPC 517 081 997 Rua de Xabregas 13, 3D 1900‑438 Lisboa, Portugal Privacy contact: info@limitada.pt

We have not appointed a formal Data Protection Officer (DPO), as we are not required to under GDPR Art. 37. All data-protection requests should be sent to the email above.

2. Who This Policy Covers

The Platform is business-facing (B2B). We process personal data about three groups of individuals:

• Users — people who create accounts and manage companies on the Platform.
• People connected to Users’ companies — directors, managers, shareholders, signatories and other individuals whose data appear in uploaded documents (minutes book, articles of association, registry excerpts, etc.).
• Customers invoiced by Users — individuals or legal entities to whom Users issue invoices through the Platform.

The Platform is not directed at children under 16.

3. What We Collect and Why

3.1 User Account

• Name, email, password (stored only as a bcrypt hash).
• Your personal NIF (Portuguese tax number), when you provide it, is used to automatically match you against director, manager or shareholder entries in the Certidão Permanente of the companies you manage on the Platform (cross-check by NIF). Providing it is optional; without it, the link can be made manually.
• Legal basis: performance of the contract with you (GDPR Art. 6(1)(b)).

3.2 Documents You Upload to the Platform

• Documents you upload — minutes, articles of association, resolutions, etc.
• May contain personal data about directors, managers, shareholders and signatories — and, on occasion, special categories of data (GDPR Art. 9) if mentioned in minutes (e.g. health-related leave, family relationships).
• Limitada’s role: processor for the User company (Art. 28). The documents are kept on your behalf, on your instructions, and are deleted when you delete the account.
• Legal basis: performance of the contract with you (GDPR Art. 6(1)(b)). For special categories, processing takes place to the extent necessary for the contract and for the establishment or defence of your company’s legal claims (Art. 9(2)(b) or (f), as applicable).

3.3 Data Fetched from the Certidão Permanente

• When you initiate a Certidão Permanente lookup (by providing the access code), we fetch the company registry record from the Portuguese Justice Portal — company name, tax number, registered seat, share capital, CAE codes, directors, managers, shareholders and other governing body members — and we store a copy on the Platform to avoid repeated lookups.
• We cross-reference the tax numbers of governing body members with the tax numbers of Users to auto-link them, as described in section 3.1.
• Limitada’s role: controller of this stored copy and of the NIF cross-reference. The initial fetch is made to the Instituto dos Registos e do Notariado (IRN), the public authority operating the official registry; Limitada has no contractual relationship with the IRN. The rights of directors, managers and shareholders whose data we store here are exercised with us directly (section 8).
• Retention: we keep this copy while the company remains on the Platform. When you remove the company (at /companies/<id>/details), all registry-derived data (including the names and tax numbers of governing-body members) is permanently deleted.
• Legal basis: legitimate interest in operating the Platform and verifying the legitimacy of Users (Art. 6(1)(f)).

3.4 Invoicing Issued by Users

• When you issue invoices through the Platform, we process your customers’ data (name, tax number, address, description of goods/services, amounts).
• We act as a processor (GDPR Art. 28) on your behalf. You remain the controller and are responsible for the legal basis of that processing.
• We store issued PDFs in our S3 bucket (EU) for your convenience. The canonical fiscal record is held by our certified invoicing partner, under their certification obligations to the Portuguese Tax Authority. As the taxpayer, you remain responsible for meeting the 10-year retention duty under article 52 of the Portuguese VAT Code and article 123 of the Corporate Income Tax Code.

3.5 Subscription and Payments (to Limitada)

• Email, company name, tax number and subscription data.
• Your card details never reach our servers — they are handled directly by Stripe.
• Legal basis: performance of the contract (Art. 6(1)(b)) and our legal obligation to issue and retain our own invoices (VAT Code Art. 52; Corporate Income Tax Code Art. 123).

3.6 Technical Data

• Access logs (IP address, user agent, request id) for security and diagnostics.
• Plausible Analytics — no cookies, no individual identification. Your IP is transmitted to Plausible’s servers in Germany to process the request and anonymised before storage (daily salted hash, per Plausible’s public documentation); the raw IP is not persisted.
• Sentry (error tracking) — before any event is sent, we apply a scrubber that removes emails, tax numbers, tokens and other sensitive values.
• Legal basis: legitimate interest in the security and proper operation of the Platform (Art. 6(1)(f)).

3.7 Expense Receipts and Automated Extraction

• When you upload (or email in) supplier receipts and invoices to the Expenses section, the file may contain personal data — typically the supplier’s name and tax number, and occasionally an individual’s name on a receipt.
• To save you typing, we send the document image or PDF to specialist AI providers that read it and return the structured fields (supplier, tax number, date, totals, VAT, suggested accounting category). The primary provider is Mistral AI (OCR); Anthropic (Claude) is used as a fallback and for harder documents. Only the file itself is sent — not your account, the other documents, or any unrelated data.
• These providers act as sub-processors on your behalf. Per their commercial API terms they delete inputs and outputs within ~30 days (a short abuse-monitoring window) and do not use paid-API data to train their models.
• Limitada’s role: processor for the User company (Art. 28).
• Legal basis: performance of the contract with you (GDPR Art. 6(1)(b)). You may still use the Expenses section without automated extraction by filling the fields manually.

4. Notice to Third Parties (GDPR Art. 14)

Some of the data we process comes from people who have never interacted with Limitada directly — directors, managers, shareholders, signatories or customers of Users. The GDPR requires them to be informed, and the obligation falls differently depending on Limitada’s role:

• For data a User uploads to the Platform (company documents — section 3.2; invoice customer data — section 3.4), Limitada acts as processor. The User, as the controller, is responsible for informing those individuals that they use Limitada for this purpose and for pointing them to this policy.
• For data Limitada itself fetches from the Certidão Permanente and stores (section 3.3), Limitada acts as the controller and bears its own Art. 14 duty to inform. We meet that duty by (i) keeping this policy publicly accessible at https://limitada.pt/en/privacy/ and https://app.limitada.pt/privacy, and (ii) allowing anyone whose data is stored here to contact us directly at info@limitada.pt to exercise the rights set out in section 8.

5. Recipients and Public Sources

To run the service we share personal data with the recipients listed below and we query the Portuguese company registry. Processors (Art. 28) operate on our behalf and are contractually bound to data-protection standards equivalent to our own. Stripe also acts as an independent controller for fraud prevention and regulatory compliance. The IRN is a public authority operating an official registry; we query it only when you ask us to.

We do not sell your data. We do not use it for targeted advertising.

6. Transfers Outside the EEA

Most processing happens within the European Union — including the primary expense-extraction provider, Mistral AI (France). Exceptions are Stripe, Sentry and Anthropic (the expense-extraction fallback), which may process data in the United States. For those transfers we rely on the Standard Contractual Clauses approved by the European Commission under Implementing Decision (EU) 2021/914, together with each vendor’s own technical and organisational safeguards.

7. Retention

8. Your Rights

These rights belong to any natural person whose personal data is processed by Limitada, not only to Users of the Platform. If you are a director, manager, shareholder, signatory or customer whose data appears on the Platform — whether uploaded by a User or fetched through a Certidão Permanente lookup — you may exercise these rights with us directly at info@limitada.pt.

Who answers your request depends on Limitada’s role for the data in question:

• Where we act as a processor on a User company’s behalf (e.g., for company documents — minutes, articles of association, resolutions — uploaded by that User), we will route your request to the User company as the controller and coordinate the response with you.
• Where we act as a controller (e.g., for data extracted from the Certidão Permanente and stored by us, for the NIF cross-referencing described in section 3.1, and for your account data if you are a User), we respond directly.

Under the GDPR you have the right to:

• Access your personal data (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erase your data (Art. 17) — subject to the legal retention duties in section 7.
• Restrict processing (Art. 18).
• Data portability (Art. 20) — we provide a structured, machine-readable copy on request.
• Object to processing based on legitimate interest (Art. 21).
• Lodge a complaint with the Portuguese Data Protection Authority (CNPD) — Av. D. Carlos I, no. 134, 1.º, 1200‑651 Lisboa, www.cnpd.pt.

To exercise any of these rights, contact us at info@limitada.pt. To let us identify you securely, please include your full name, tax number (if applicable), and — if relevant — the company through which your data reached us. We will respond within 30 days, as required by GDPR Art. 12(3).

9. Security

• Communications encrypted with TLS 1.2+.
• Data at rest encrypted with AWS KMS (S3, RDS) and Cloak AES‑GCM for sensitive fields in the database.
• Internal access is least-privilege and protected by multi-factor authentication on management consoles.
• AWS WAF (web application firewall) in front of the Platform.
• Encrypted backups with keys managed by AWS.

10. Automated Decision-Making and Profiling

We do not make automated decisions with legal or similarly significant effects on you (GDPR Art. 22).

11. Cookies

We use only strictly necessary cookies — session and CSRF protection. We do not use tracking, advertising, or analytics cookies — our analytics provider (Plausible) is cookie-less.

12. Changes to This Policy

We update this policy when needed. Material changes will be communicated by email to active Users at least 30 days before they take effect. The effective date appears at the top of this page.

13. Language Versions

This policy is available in Portuguese and English. In case of discrepancy, the Portuguese version prevails.