Privacy Policy

Last updated: 9 October 2026

This policy explains how Clara processes personal data on the get-clara.com website and when providing the Clara service.

1. Who is the controller

EFFUSIVE WINDS, LDA, trading as Clara, tax number (NIPC) 519666321, registered office at Fintech House, Lisbon. For any question about personal data: info@get-clara.com.

2. What data we collect

On the website. When you fill in the contact form: name, email, company, phone (optional), approximate number of invoices per month, availability and the reason for contacting us. The website host also logs technical access data, such as IP address and browser, for security purposes.

On the platform. To provide the service, we process the data each customer entrusts to us: invoices, receipts, bank transactions, payment documents and contact details of the customer's clients, suppliers and employees. In these cases Clara processes data on behalf of the customer, as a processor, under the contract and data processing agreement signed with them.

Receivables analysis (optional). If you request the analysis before the demo, we receive your company's SAF-T file and bank statement, the tax number, the registered name, the name and job title of the person sending them, and the date and time the terms for the analysis were accepted. These files may contain data about customers, suppliers and employees, which we process on your company's behalf solely for the analysis.

3. Why we use data and on what legal basis

• Replying to demo, waiting list and contact requests: pre-contractual steps at your request and your consent.
• Providing the contracted service: performance of a contract.
• Invoicing and tax and accounting obligations: legal obligation.
• Security of the website and platform and abuse prevention: legitimate interest.

We do not sell personal data or use it for third-party advertising. We do not make solely automated decisions with legal effects on individuals.

4. How long we keep data

• Contact requests with no commercial relationship: up to 24 months after the last contact.
• Receivables analysis files and results: deleted, including copies, if you do not sign up for Clara within 30 days of the demo.
• Customer data: for the duration of the contract and, afterwards, only as needed to meet legal retention periods (for example, 10 years for accounting documents).
• Data processed on behalf of customers: returned or deleted at the end of the contract, as agreed with the customer.

5. Who we share data with

We use providers that process data on our behalf, under contract and with appropriate safeguards:

• Website hosting and form handling: Netlify, Inc.
• Email and work tools: Google Workspace (Google Ireland Limited).
• Website fonts: Google Fonts (your browser connects to Google servers, which receive your IP address).
• Platform hosting, databases and automation tools used to provide the service, all under a data processing agreement. An up-to-date list of these providers is available on request at info@get-clara.com.

We may also disclose data to authorities when required by law.

6. Transfers outside the European Union

Some providers may process data outside the European Economic Area, notably in the United States. In those cases, transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.

7. Cookies

This website does not use analytics or advertising cookies, and does not store information on your device to track you.

8. Your rights

You can request access, rectification, erasure, restriction or portability of your data, object to processing and withdraw consent at any time by writing to info@get-clara.com. We reply within one month. If the data was processed on behalf of a Clara customer, we forward the request to that customer.

You may also lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt).

9. Security

We use encrypted connections, access control and activity logging to protect data. No system is entirely immune to failure; if a data breach poses a risk to individuals, we notify the authorities and those affected as required by law.

10. Changes

We may update this policy. The date at the top shows the version in force.