Who we are

Claimpal is a personal-scale service that helps consumers in Portugal exercise their rights under Portuguese and EU consumer protection law. For the purposes of the General Data Protection Regulation (EU 2016/679), Claimpal is the data controller of the information you provide.

What we collect

• Your account: the email address you use to sign in.
• Your case: what you tell us about the product, the retailer, dates, and any evidence you choose to attach.
• Your correspondence: messages exchanged between you, Claimpal, and the brand through your dedicated case email address.
• Technical logs: request metadata needed to operate the service (timestamps, IP address, browser type) — retained only as long as needed to investigate abuse.

Why we process it

• Contract (Art. 6(1)(b) GDPR): to run your case — analyze it against the law, write the demand letter, send correspondence, and escalate to regulators on your behalf.
• Legitimate interest (Art. 6(1)(f) GDPR): to protect the service from abuse and keep it working.

We do not use your case data for advertising. We do not sell it. We do not train third-party AI models on it.

Where it is stored

Your data is stored in the European Union — Supabase (PostgreSQL) in Paris (eu-west-3) and Vercel serverless functions in Paris (cdg1) or Frankfurt (fra1). Outbound mail is routed via EU-based infrastructure.

To generate and review legal text we call the Claude API (Anthropic) and the Gemini API (Google). These calls are stateless: the providers process the content of your case to produce output, and we do not rely on provider-side retention.

How long we keep it

Case data is retained for up to three years from case submission. This matches the Portuguese limitation periods that may apply to follow-on disputes and keeps your correspondence available if a brand or a regulator asks for it. When you delete your account, all your data is erased before that period is up.

Your rights

Under the GDPR you can, at any time:

• Ask what we hold about you (right of access, Art. 15).
• Correct it (right of rectification, Art. 16).
• Delete it (right of erasure, Art. 17) — from your dashboard, “Delete my account” removes your cases, documents, correspondence, and account.
• Export your data in a portable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Complain to the Portuguese supervisory authority (Comissão Nacional de Proteção de Dados — CNPD, cnpd.pt).

Contact

To exercise any of the rights above, write to privacy@claimpal.app.