Privacy policy

This Privacy Policy explains what personal information Imaginando Lda ("Imaginando", "we", "us") collects when you use our website, our desktop and mobile software, or talk to us through support — and what we do with it.

The short version is below; each section unpacks the detail. This policy is governed by the General Data Protection Regulation (EU 2016/679⁠, "GDPR") and Portuguese data-protection law.

• AAccess — get a copy of everything we hold on you.
• BRectify — fix anything that's wrong or out of date.
• CDelete — close your account and erase your data.
• DPort — export your data in a machine-readable format.
• EObject — opt out of marketing or specific processing.
• FComplain — to your local data-protection authority.

To exercise any of these rights, contact us. We respond within 30 days⁠, free of charge.

Activation and use of any of our desktop products requires the creation of an Imaginando account, using an email address⁠ and a password⁠. This is the only data strictly required for the licence system to work.

Optionally, you may add a name, country, profile picture, and newsletter preference. None of these are required to use the software.

Our website chat is provided by Crisp⁠. If you write to us through the chat widget, you may submit an email address so we can identify you and continue the conversation outside the widget. Whatever you type into the chat is processed by Crisp on our behalf — see third parties below.

When you buy something from our store, your billing details are processed by our payment provider (Stripe⁠ or PayPal⁠) — we never see or store your full card number. We keep an order record (your name, email, what you bought, when, and the invoice amount) for accounting purposes, as required by Portuguese tax law.

When you use our software or website, we collect details of your device hardware and software properties — system specification, operating system, app version, locale. This helps us debug crashes and decide which platforms to keep supporting.

The website chat functionality provided by Crisp uses your IP address⁠ to determine approximate location and timezone, so support replies arrive at a reasonable hour and in a sensible language. We do not use IP for advertising or build location profiles.

Under GDPR we have to tell you not just what we do with your data but why we're allowed to⁠. Here's the breakdown:

If you'd rather we stopped any of the legitimate-interest uses above, contact us and we will, unless we have to keep that processing for one of the other reasons listed.

The following third-party processors handle data on our behalf. Each is bound by a data-processing agreement that obliges them to handle your data to GDPR standards.

A cookie is a small file stored on your device by the browser. We use them in three categories — only the first runs without asking you:

• 6.1Essential cookies. Keep you signed in, remember what's in your cart, store your theme, language and time zone (so email reaches you at a sensible hour). These can't be turned off because the site won't work without them.
• 6.2Analytics cookies. Aggregate counts of which pages get visited, which products people look at. We use this to decide what to build next. Optional — defaults to off.
• 6.3Marketing cookies. Measure ad performance and avoid showing you the same ad twice. Optional — defaults to off.

You can opt out of push notifications by visiting your device settings — the notification settings on your phone or computer — and switching them off for the relevant app, either entirely or by category. Different OS versions surface this control in slightly different places; if you can't find it, our support chat will help.

We send push notifications from our apps (never from the website) for:

• 7.1Releases. A new version of an app you have installed is available.
• 7.2Account events. Sign-in from a new device, password reset, billing-related notices.
• 7.3Product news. With your consent, occasional news about our products, expansions and offers.

On iOS you're always asked to allow notifications before we send any, and you can withdraw consent at any time in your device settings. We don't send push from the website.

To decide which devices a notification goes to, we use which of our apps have been opened on the device and when — recognised by the device identifier our apps already report — and the notifications we have already sent to it. That is how, for example, a notification reaches only devices that have never opened a new app, or skips devices that heard from us in the last few days. When you tap a notification, the app tells us it was opened, so we can see whether it was useful. None of this is used for advertising or shared with anyone.

If you're in the European Economic Area, the United Kingdom, or any jurisdiction with comparable consumer-protection law, you have the rights listed below. Imaginando Lda is the data controller⁠. Some rights may be limited where another law (e.g. Portuguese tax retention rules) requires us to keep specific records.

• 8.1Right of access. Ask us for a copy of the personal data we hold about you, in a readable format. We will respond within 30 days.
• 8.2Right to rectification. Ask us to correct anything that's wrong or out of date. Most fields you can edit yourself in your account settings.
• 8.3Right to erasure ("be forgotten"). Ask us to delete your account and the personal data tied to it. We'll keep the minimum we have to (invoices, fraud records) for the period the law requires, and erase the rest.
• 8.4Right to restriction. Ask us to stop processing your data while we sort out a query, dispute, or rectification request.
• 8.5Right to data portability. Get your data in a structured, machine-readable format (JSON or CSV) so you can take it elsewhere.
• 8.6Right to object. Tell us to stop processing your data for direct marketing or for any purpose based on legitimate interest.

We keep different categories of data for different lengths of time, based on what each is for:

• 9.1Account data⁠ — for as long as you use your account. We delete it within 30 days of you closing the account, except where retention is legally required. For an account left unused, see below.
• 9.2Invoices & tax records⁠ — 10 years⁠, as required by Portuguese accounting law (Decreto-Lei 28/2019⁠).
• 9.3Support tickets⁠ — 3 years, so we have context if you come back with a follow-up.
• 9.4Newsletter consent record⁠ — until you unsubscribe, plus 12 months as proof of the unsubscribe.
• 9.5Crash logs & aggregate analytics⁠ — 18 months, then aggregated and anonymised.
• 9.6Fraud / abuse records⁠ — up to 5 years, where there is a legitimate interest in preventing repeat misconduct.
• 9.7Clicks in our marketing emails⁠ — for each marketing email we send you, whether you clicked a link in it (the first click within 30 days of sending), so a follow-up reaches the people it is relevant to. Kept for 12 months, or until your account is deleted if that comes first.

Accounts left unused. If an account holds no licences and no purchase history, and 12 months pass without it being used, we delete it — keeping data nobody needs is not something we should do. Using it means signing in here, or opening one of our apps while signed in; either one is enough on its own. We never delete without telling you first: we email you 30 days before the date and again 7 days before, and a single sign-in cancels the deletion and keeps the account. An account that holds a licence or a purchase is never deleted this way.

Imaginando is based in Portugal and most of your data is stored in the European Union. However, several of our processors — Stripe, Meta — operate from the United States and may store data there, and a push notification reaches your device through Apple's or Google's delivery service, which also operate from the United States.

Where data leaves the EU, we rely on one of the following lawful transfer mechanisms required by GDPR Articles 44–49:

• 10.1EU-US Data Privacy Framework⁠ — for processors that have self-certified.
• 10.2Standard Contractual Clauses⁠ — the European Commission's pre-approved contract template, signed with each processor.
• 10.3Supplementary measures⁠ — encryption in transit and at rest, plus pseudonymisation where the use case allows.

We protect personal data with technical and organisational measures appropriate to the risk:

• 11.1Transport encryption⁠ — TLS 1.2+ on every endpoint.
• 11.2Storage encryption⁠ — at-rest encryption on databases and object storage.
• 11.3Password hashing⁠ — passwords are stored as bcrypt hashes; we never see the plain text.
• 11.4Access controls⁠ — least-privilege access for staff, MFA on every administrative account.
• 11.5Audits⁠ — annual review of access logs, processor agreements, and retention periods.

Our products are intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, please contact us and we will delete the account and any associated data.

By accepting this Privacy Policy and proceeding to use any of our apps, you give your consent for us to collect and process the data described above. You must accept this policy to use our apps; if you do not accept, you will not be able to use them.

You can withdraw consent at any time by closing your account or by contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, nor does it affect data we are legally required to retain.

We don't currently have a formally designated Data Protection Officer because the size of our processing doesn't require one under GDPR Article 37 — but the privacy mailbox is monitored by a member of the engineering team and answered within 30 days.

We may update this Privacy Policy from time to time, for example to reflect new processors, new product features, or changes in the law. The revision date at the top of the page indicates when the latest version was published.

For material changes⁠ — anything that meaningfully expands what data we collect or how we use it — we will email account holders before the change takes effect, so you have time to review and, if you prefer, close your account.