/ Privacy
Privacy policy
What personal data techforma.pt processes, why, for how long, and how you can exercise your rights.
Last updated: 31 October 2026
1. Data controller
João Pacheco, sole trader, trading as Techforma.
Tax number (NIF) 230301606
Rua Central da Ordem, 643, Ordem, Lousada, Portugal
Privacy contact: [email protected]
2. What we process and why
Contact requests
Name, email, phone, company, website, industry, company size, services of interest, challenges, preferred date and time, message and language. We use them to answer your request and, where relevant, prepare a proposal. Legal basis: steps taken at your request before a contract (Article 6(1)(b) GDPR).
Free website scan
The website address you enter and the scan results. The report stays available for one hour. If you ask for the complete report, we keep your email to send you the private link and follow up about that scan. We don't send newsletters. Legal basis: providing the service you asked for (Article 6(1)(b) GDPR).
Competitor analysis
The business name, website and industry you enter, used to produce the analysis. Legal basis: providing the service you asked for (Article 6(1)(b) GDPR).
Security and abuse prevention
We store the IP address and browser (user agent) with each contact request and each scan, to detect abuse and keep the service secure. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
Client area
The email and session of account holders, and any reviews they submit. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
Audience measurement and advertising
Only if you accept: Google Analytics and Google Ads record the pages you visit, events such as starting a form or a conversion, and identifiers stored in cookies, so we can measure visits and campaign results. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw it at any time in .
3. Cookies and browser storage
Necessary cookies are always on. Measurement cookies are only created after you accept; until then, the page loads no Google script.
| Name | Purpose | Duration | Type |
|---|---|---|---|
csrf_token | Protects forms against forged requests | 1 hour | Necessary |
language | Remembers the language you chose | 1 year | Necessary |
auth_token | Keeps you signed in to the client area | 7 days | Necessary |
tf_consent | Remembers your choice about measurement cookies | 6 months | Necessary |
techforma_contact_conversion | Reports a contact-request conversion to Google Ads | 2 minutes | Measurement, only with consent |
_ga, _ga_* | Google Analytics: tells visitors apart | Up to 2 years | Measurement, only with consent |
_gcl_au | Google Ads: measures conversions | 90 days | Measurement, only with consent |
With consent, the free scan also keeps the ID of the scan in progress in your browser's session storage (sessionStorage), so the same conversion is not counted twice. It disappears when you close the tab.
4. Who processes data on our behalf
- Supabase: the database that stores requests and scans, hosted in Ireland.
- Website hosting: servers in Ireland.
- Cloudflare: delivers and protects the website; handles the traffic, including your IP address.
- Google: email delivery (Gmail); Google PageSpeed Insights, which receives the address of the website being scanned; and, only with your consent, Google Analytics and Google Ads.
- An AI provider: receives the public content and technical results of the scanned website and, for competitor analysis, the business name, website and industry you enter, to write the analysis text. It does not receive contact form data.
- SORO: the platform we publish blog articles on; article images load from that platform's servers.
We do not sell personal data.
5. Transfers outside the European Economic Area
The data we store stays in Ireland. Google and Cloudflare may process data outside the European Economic Area, including in the United States. Those transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses approved by the Commission.
6. How long we keep data
- Contact requests and complete-report requests: 24 months after the last contact.
- Scan records (website, results, IP address and browser): 12 months.
- Free scan reports: one hour.
- Cookies: the duration shown in the table above.
- Google Analytics data: the retention period set in our Google Analytics account.
7. Your rights
You can ask for access to your data, its correction or erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. You can withdraw consent at any time without affecting processing carried out before. Write to [email protected]; we reply within one month. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
8. Security
The website only runs over HTTPS, and access to stored requests is limited to authorised accounts.
9. Changes
If this policy changes, we publish the new version here with its update date.