Privacy Policy

Last updated: 2026-09-11

This is a summary. The full version in the application prevails. The authoritative text is in Portuguese.

1. Controller

Blindados. Data-protection contact: software@b-plan.pt.

2. Data we process

• Account: name, email, mobile, password (stored encrypted).
• Security: IP, browser and timestamp of sign-in attempts.
• Project: client names, addresses and contacts you enter in your projects; floor plans/images; equipment configuration — provided by you.
• Licensing and payment: plan, licence status; payment method, amount, status and reference; mobile only for MB WAY. Card data is entered on EuPago’s secure page and never passes through B-PLAN.
• Preferences: language and theme.

3. Purposes and legal basis

• Provide the service and manage the account — performance of a contract (Art. 6(1)(b)).
• Process subscription payments via EuPago — performance of a contract; keep the record for the tax period — legal obligation (Art. 6(1)(c)).
• Prevent unauthorised access — legitimate interest (Art. 6(1)(f)).

No targeted advertising, no automated profiling with legal effects, no data selling.

4. Recipients

Sub-processors: Amazon Web Services (hosting, EU), MongoDB Atlas (database), AMEN (email), EuPago (payments — Portuguese payment institution, data in the EEA), and Twilio (SMS, currently disabled).

5. Retention

• Account and project data: while the account is active; on closure, deleted or anonymised within 30 days, save legal obligation.
• Verification codes: deleted on expiry (5–30 min).
• Sign-in logs: 90 days.
• Completed payments: tax period (anonymised on account closure). Unfinished attempts: 90 days.

6. Your rights

Access, rectification, erasure, restriction, portability and objection, and a complaint to the Portuguese DPA (CNPD). To exercise: software@b-plan.pt. We reply within one month.

7. Security and cookies

httpOnly session cookie and preferences in localStorage — strictly necessary, no advertising or analytics cookies. In case of a data breach with risk, we notify the data subject and the CNPD within the legal deadlines.

8. Website server logs (b-plan.pt)

The public website uses no cookies and no tracking technology — it loads no Google Analytics, pixels or third-party scripts, and reads nothing from your device. To understand which pages are visited, the web server keeps an access log with the IP address anonymised at the moment it is written (the last group of an IPv4 address, or the last 80 bits of an IPv6 address, are set to zero, so the address can no longer be reconstructed), the timestamp, the requested page, the referring page and the browser type. Legal basis: legitimate interest in operating and improving the website (Art. 6(1)(f)). These logs are processed only on servers in the European Union and aggregated into statistics; the raw log is kept for at most 14 days, and the aggregated statistics, which contain no identifier, for up to 120 days.