Privacy Policy

1. Data controller

The controller is the entity operating Licito (licito.pt). To exercise your rights or raise a privacy question, use the contacts shown on licito.pt.

2. What data we collect

Purchase data: the email address linked to the payment (collected at checkout) and, if you create an account, your sign-in email.

Payment data: processed directly by Stripe. Licito does not collect or store your card details.

Usage data: technical and statistical browsing information (pages visited, device) collected by analytics and monitoring tools.

Generated content: the reports you buy and the alerts and listings you save.

3. Purposes and legal bases

Providing the service and generating the purchased report — performance of the contract.

Delivering access to the report and purchase-related communications — performance of the contract.

Security, fraud prevention and service improvement — legitimate interest.

Usage statistics and site performance measurement — legitimate interest. This data is aggregated and is not used for advertising.

Advertising and campaign measurement (Meta) — legitimate interest in measuring and optimising our campaigns. ⚠️ In this phase these cookies and events are activated without asking for your prior consent and without a cookie banner on the site. You may object at any time, using the contacts listed on licito.pt.

4. Processors and third parties

We use providers that process data on our behalf: Stripe (payments), Supabase (database and authentication), Cloudflare (hosting, CDN and report storage), Anthropic (AI report generation over the property data), Brevo (email delivery), and analytics/monitoring tools (Google Analytics, New Relic).

We share conversion events with Meta Platforms Ireland Limited (Facebook/Instagram), via the browser pixel and the server-side Conversions API, to measure advertising effectiveness. ⚠️ In this phase this sharing happens for every visitor, without prior consent (see §8).

We use Cloudflare Turnstile to verify that bid-refresh requests come from a real user rather than automated scripts, protecting the service from abuse. The widget runs in invisible mode, with no interaction. Cloudflare's Turnstile Privacy Policy Addendum applies: https://www.cloudflare.com/application-services/terms/turnstile-privacy-policy-addendum/

Market reference data comes from public sources (e.g. Statistics Portugal, INE). Auction listings come from the public sources shown on the platform.

5. International transfers

Some providers may process data outside the European Economic Area. In those cases we ensure appropriate safeguards (e.g. standard contractual clauses).

6. Retention

We keep data only for as long as needed for the purposes described and to meet legal obligations (e.g. invoicing). Reports stay linked to your email so you can access them.

7. Your rights

You have the right to access, rectify, erase, restrict and object to processing, and to data portability. You may withdraw consent at any time, without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).

8. Cookies and similar technologies

We use three groups of cookies and local-storage technologies. In this phase we show no cookie banner and no in-site way to refuse (see the “Marketing” group below).

Essential (always on, no consent needed): the Supabase authentication session that keeps you signed in; your theme (licito-theme) and language (locale) preferences; the record of your own cookie decision (licito-consent); and Cloudflare Turnstile, which protects the bid-refresh request from automated abuse. The site does not work without these.

Analytics and performance (no advertising): Google Analytics 4 (_ga, _ga_*, up to 2 years) and New Relic, which measure usage and errors so we can keep the service running and improve it. We do not use them to target advertising to you, and the paid-report URL is stripped of its access token before anything is sent.

Marketing (active without prior consent): the Meta pixel and the _fbp and _fbc cookies (up to 90 days), which measure conversions from our campaigns. ⚠️ In this phase we show no cookie banner and no in-site way to refuse: these cookies are loaded and the events are sent to Meta for every visitor, from the browser and from our server. You can block them in your browser settings or object using the contacts listed on licito.pt. If we return to requiring consent, this section automatically says so.

9. Security

We apply technical and organisational measures to protect your data, including database access control and encryption in transit.

10. Changes

This Policy may be updated. The version in force is the one published on this page, with its date.