Privacy policy

The controller is Diogo Duarte, Sociedade Unipessoal Lda., NIPC 519603656. Tejobit is a brand of this company.

Any question or request about personal data can be sent to geral@tejobit.com.

The contact form asks for:

• name and email;
• company (optional);
• project type, budget and timeline;
• the message.

This data is used only to reply to the enquiry and, if it leads to work, to prepare a proposal. The legal basis is the pre-contractual steps the user asks for and the legitimate interest in replying to whoever gets in touch.

When the form is sent, the enquiry goes by email, through Resend, to Tejobit's mailbox, with the given email as the reply-to address. An internal notice with the same data and an excerpt of the message also goes to a private Telegram channel. The enquiry is not stored in a database on the site.

To stop abuse, the sender's IP address is recorded in a counter that limits submissions to five per hour.

Tejobit's emails are sent through Resend (Resend, Inc., USA). Incoming mail is hosted on a server in Germany (netcup GmbH).

Emails sent by Tejobit may include open measurement: a small invisible image that records when the message is opened, the approximate time and the device or mail client used. They may also measure clicks on links.

This information is used only to know whether the message arrived and was read.

To avoid it, block images from loading in the mail client.

To understand how the site is used, Tejobit uses OpenPanel, installed on its own server (openpanel-api.diogoduarte.net), the same server in Germany. The data does not go through third-party analytics services.

OpenPanel uses no cookies and stores no identifiers in the browser. It records:

• the pages viewed and the page the user came from;
• the browser and device type;
• clicks on links to other sites and on the contact buttons;
• technical errors while loading a page;
• the contact form being sent, only with the chosen project type, budget and language, never the name, email or message.

In the client area, the session is linked to an internal identifier and the account's role, never to the name or email. The legal basis is the legitimate interest in improving the site.

The client area (/area) is by invitation only. Each account has a name and email, and sign-in is with email and password, a Google account or a passkey. The password is never stored in readable form. If the user chooses to sign in with Google, Google receives the sign-in request and confirms the account's email.

The area stores each project's files and messages. Files are kept in Cloudflare R2, in private storage, and are only delivered to people with access to the project. Accounts, messages and comments are kept in Cloudflare D1.

The area sends emails through Resend: invitations, password recovery and notices about new files, messages, approvals and change requests.

The legal basis is the performance of the contract with the client.

The site uses no advertising or tracking cookies. It only uses:

• the lang cookie, set only when the user switches language, to remember that choice for 12 months;
• in the client area, session cookies strictly necessary to keep the user signed in;
• small markers in browser storage: one prevents a reload loop after a site update and, in the client area, another remembers whether creating a passkey has already been suggested.

The site and the client area run on Cloudflare (Workers, D1 and R2). The providers involved are:

• Cloudflare: hosting for the site and the client area, database and files;
• Resend, Inc. (USA): sending email;
• netcup GmbH (Germany): server for incoming mail and statistics;
• Telegram: internal notices of new contact enquiries;
• Google: only for people who choose to sign in to the client area with a Google account.

Contact enquiries that do not lead to work are kept in the mailbox for up to 24 months and then deleted.

Client data is kept for the duration of the contract and, after that, for the period the law requires for invoicing. Under Portuguese law, invoices are kept for 10 years.

Under the GDPR, the user can ask for:

• access to the data about them;
• rectification of incorrect or incomplete data;
• erasure of the data;
• restriction of processing;
• data portability;
• objection to processing.

Where processing is based on consent, that consent can be withdrawn at any time.

Requests are made by email to geral@tejobit.com. If the user believes their data has not been handled correctly, they can complain to the Portuguese data protection authority (CNPD) at www.cnpd.pt.

This policy may be updated. The date at the top of the page shows the last change.