Privacy Policy

Last updated: March 2026

1. Data Controller

Portugal Travel Hub (available at portalturismoportugal.com) is the controller of personal data collected through this website. For any privacy-related queries, please contact us via our contact page.

2. Information We Collect

We collect only the data necessary to provide our service:

• Account data — name and email address, voluntarily provided when creating an account or filling in contact or lead-capture forms
• Usage data — pages visited, filters used and search preferences, generated automatically during browsing
• Technical data — IP address, browser type and operating system, for security and diagnostic purposes

3. How We Use Your Information

• Provide, operate and improve the platform
• Authenticate and manage your user account
• Process and manage Pro plan subscriptions
• Respond to your messages and support requests
• Send service-related communications (no commercial newsletters without consent)
• Comply with applicable legal obligations

4. Legal Basis for Processing

The processing of your data is based on the following legal grounds under the GDPR:

• Contract performance — to provide user account and Pro plan features
• Legitimate interests — for platform security and service improvement
• Consent — for optional communications, which you may withdraw at any time

5. Sharing Data with Third Parties

We do not sell your personal data to third parties. We share information only with the following essential service providers, always under confidentiality and data protection agreements:

• Supabase — database and authentication, with servers in the European Union
• Cloudflare — hosting and DDoS protection, with transfers governed by standard contractual clauses
• LemonSqueezy — subscription payment processing (acting as Merchant of Record)

The platform also includes affiliate links to external partners such as Booking.com and GetYourGuide. Those partners have their own independent privacy policies.

6. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption in transit via HTTPS/TLS
• Role-Based Access Control
• Row Level Security in the database — each user accesses only their own data
• Passwords never stored in plain text

7. Your Rights (GDPR)

As a data subject, you have the following rights, which you may exercise at any time:

• Access — request a copy of your personal data
• Rectification — correct incomplete or inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Complaint — lodge a complaint with the CNPD (Portuguese Data Protection Authority) or your local supervisory authority

To exercise any of these rights, contact us via our contact page. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies for the platform to function and functional cookies to improve your experience. Please see our Cookie Policy for detailed information on the cookies we use and how to manage them.

9. Data Retention

Your data is retained for as long as your account is active. After account deletion, personal data is erased within 30 days, except where we are required by law to retain it (e.g. transaction records for 10 years for tax purposes).

10. Changes to This Policy

We may update this policy periodically. In the event of significant changes, we will notify you by email or through a prominent notice on the website. The date of the last update is always shown at the top of this page.