Who we are

ClaimPal is a personal-scale service that helps consumers in Portugal exercise their rights under Portuguese and EU consumer protection law. For the purposes of the General Data Protection Regulation (EU 2016/679), ClaimPal is the data controller of the information you provide.

What we collect

• Your account: the email address you use to sign in.
• Your case: what you tell us about the product, the retailer, dates, and any evidence you choose to attach.
• Your correspondence: messages exchanged between you, ClaimPal, and the brand through your dedicated case email address.
• Technical logs: request metadata needed to operate the service (timestamps, IP address, browser type) — retained only as long as needed to investigate abuse.

Why we process it

• Contract (Art. 6(1)(b) GDPR): to run your case — analyze it against the law, write the demand letter, send correspondence, and escalate to regulators on your behalf.
• Legitimate interest (Art. 6(1)(f) GDPR): to protect the service from abuse and keep it working.

We do not use your case data for advertising. We do not sell it. We do not train third-party AI models on it.

Where it is stored

Your data is stored in the European Union — Supabase (PostgreSQL) in Ireland (eu-west-1) and Vercel serverless functions in Paris (cdg1). Outbound mail is routed via EU-based infrastructure.

To generate and review legal text we call the Claude API (Anthropic) and the Gemini API (Google). These calls are stateless: the providers process the content of your case to produce output, and we do not rely on provider-side retention.

International transfer.Anthropic and Google are US-based providers, so when we call these APIs the content of your case is processed in the United States. That transfer relies on the European Commission’s Standard Contractual Clauses. Everything else — your account, your cases, your emails — stays in the EU as described above.

How long we keep it

Case data is retained for up to three years from case submission. This matches the Portuguese limitation periods that may apply to follow-on disputes and keeps your correspondence available if a brand or a regulator asks for it. When you delete your account, all your data is erased before that period is up.

Your rights

Under the GDPR you can, at any time:

• Ask what we hold about you (right of access, Art. 15).
• Correct it (right of rectification, Art. 16).
• Delete it (right of erasure, Art. 17) — from your dashboard, “Delete my account” removes your cases, documents, correspondence, and account.
• Export your data in a portable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Complain to the Portuguese supervisory authority (Comissão Nacional de Proteção de Dados — CNPD, cnpd.pt).

Contact

To exercise any of the rights above, write to privacy@claimpal.app.