Terms · privacy · cookies.

1 · Who controls your data

A sole trader registered in Portugal is the controller of the personal data described here. The name, registered address and tax number are behind the button below. Reach us through the contact form for anything in section 7.

Business details load in the browser.

2 · What we collect

• Account email. To send the Sunday email and let you sign in.
• Sign-in sessions. When you sign in we keep a session so you stay signed in. It holds your browser's user agent and when it expires, never your IP address.
• Sign-up and payment checks. When you create an account with an email address, we check that its domain is not a throwaway-address service and that it can receive mail, and we refuse the address if not. We also keep a matching form of your address (lower case, without a "+tag", and on Gmail without the dots), a keyed hash of your IP address each time you sign up, sign in or start a payment, and the card fingerprint Stripe gives us for the card that paid. We keep the hash, never the IP address itself, and the fingerprint is not your card number. We use them only to count accounts that look like one person and refunds that follow a pass already in use.
• Your Google profile, if you sign in with Google. Google gives us your email address, your name, a link to your profile picture and the id of your Google account, and we store all four with your account. We use the email and the id to sign you in, and the name to show in the account menu and to fill in your name at checkout. We do not show the picture anywhere. Google also gives us sign-in tokens, which we keep with your account and never use to read anything from it. We ask Google only for your basic profile, never for your contacts, your Gmail, your Drive or anything else, and we do not share what Google gives us with anyone or use it for advertising.
• Pass state. Which passes you have bought, what they cover and when they end, plus the country your card was issued in (we need it to work out the VAT on your invoice). Card details are handled entirely by Stripe. We never see your card number, and we do not store the last four digits either.
• A saved card, if you ask for one. If you tick "save" at checkout or add a card in settings, Stripe keeps the card on a customer record for you. We store only that record's id, so settings can ask Stripe for the card's brand and last four digits and let you remove it.
• Where you can work. If you answer the optional survey: whether you would relocate, which passports you hold, where you live, and where you would like to move. We work out the rest ourselves rather than asking. We use it for one thing, leaving roles out of your Sunday email that you could not take. Skip it and nothing is left out. You can change or clear it any time in settings.
• Tracker entries. Roles you save, their status, and your notes. They live in our own Postgres database, on encrypted disks, and only the operator has access. We do not encrypt them field by field, so we would rather say so than imply more than we do.
• Submission forms. Anything you send via the contact form (corrections, field reports, support). Stored for 24 months then archived to cold storage.
• Replies to our emails. If you reply to the Sunday email, your reply goes to the operator's inbox and nowhere else. We treat it like a contact form message and keep it for the same time. A reply to an account email, such as a password reset, is not delivered to anyone.
• Server logs. Requests reach us through Cloudflare, so our server logs hold Cloudflare's address, not your IP address. We keep them for 14 days to keep the site up and spot abuse.
• Visit counts. We count visits with Rybbit, which runs on our own server next to the site, not on anyone else's. For each visit it records the page address, where you came from, your browser, device type, screen size and language, the country and city worked out from your IP address, how long pages take to load, and a few named actions: how far down the homepage you scroll, which buttons you click, which FAQ questions you open, and how far you get through the subscribe steps. On your Watch board and in your account it also counts what you do, never what you write: which status you set on a role, which tab, filter and view you pick, when you open a role or go on to the employer's page, how far you get through the survey, and whether a sign-in worked. Your IP address is hashed together with your browser and a salt that changes every day, then thrown away, so the IP is never stored and the same visitor on two different days counts as two. Before a page address is stored we cut it down to campaign tags and the subscribe page's own settings, so an email in a link never reaches the counter. No event carries your email, your name, or anything you type.
• Linked visits when you are signed in. When you are signed in, the visit counter links your visits with a keyed code made from your account, never your email or name, so we can see whether readers come back. The code means nothing without a key we keep on our server, and Rybbit runs on our own server. You can turn this off in Settings, under Account. Visits are then counted the same way as for a visitor who is not signed in.
• Clicks on roles in our emails. A role link in an email we send you goes through domani.jobs on its way to the employer's page. We count that click with the email, the role's place in it and its category, so we learn which roles in which email get clicked. The link carries nothing that says who you are, so the click is never tied to you. Your IP address is used the same way as for a visit and is not stored.

3 · What we do not collect

• No third-party analytics (Google Analytics, Mixpanel, Hotjar etc.). The visit counts in section 2 stay on our own server.
• No session recordings. We do not record what you see or type on the site.
• No tracking pixels in Sunday emails. No "open" tracking. Role links pass through domani.jobs so we can count clicks per email and per position, but never per person. We do not record who clicked, and we do not record whether you opened the email.
• No social-media SDKs. No "Like" buttons. No retargeting cookies.
• No data from advertisers, data brokers, or enrichment APIs.

4 · Why we may process it

The GDPR asks us to name a legal basis for each thing we do with your data, so here they are.

• To run the service you bought (your email, pass state, tracker entries, the Sunday sends): performance of a contract, article 6(1)(b).
• To sign you in with Google (your Google profile, if you chose Google sign-in): performance of a contract, article 6(1)(b).
• To issue and keep invoices (pass state, card country): a legal obligation under Portuguese tax law, article 6(1)(c).
• To keep the site up and spot abuse (server logs, Cloudflare's bot checks): our legitimate interest in running a secure service, article 6(1)(f). You can object (see section 7).
• To prevent fraud and misuse (the sign-up and payment checks): our legitimate interest in preventing fraud and the misuse of free accounts and refunds, article 6(1)(f) and GDPR Recital 47. Apart from refusing a throwaway address at sign-up, the checks only count: they decide nothing about your account. You can object (see section 7).
• To count visits and see where people stop (the visit counts): our legitimate interest in knowing which pages work and where the subscribe steps lose people, article 6(1)(f). The counts hold no IP and no identifier that lasts past the day. You can object (see section 7).
• To see whether readers come back (linked visits when you are signed in): our legitimate interest in seeing whether readers come back, article 6(1)(f). Turn it off any time in Settings, under Account.
• To filter your Sunday email by where you can work (the survey answers): your consent, article 6(1)(a). Withdraw it any time by clearing the answers in settings, and nothing is filtered out.
• To keep a card you asked to save (the Stripe customer id): your consent, article 6(1)(a). Remove the card in settings and we stop showing it. Delete the account and the customer id goes with it.
• To answer what you send us (contact form submissions and replies to our emails): our legitimate interest in replying, and a contract where the question is about your pass.

We do not make decisions about you by automated means that have legal or similarly significant effects. The survey filter only decides which of our roles you see. It never decides anything about you.

5 · Who we share it with

Only the processors strictly needed to run the service. No advertisers, no data brokers, no "marketing partners."

Google is not on this list because it does not process data for us. If you sign in with Google, Google runs the sign-in on its side under its own privacy policy, and we receive only the profile described in section 2.

6 · How long we keep it

• Account email, Google profile, pass state, tracker entries, survey answers: for as long as you have an account. Delete the account in Settings and we remove it at once. Our mailing list provider drops your address within a day, and Stripe keeps your email with the invoice records in this section.
• Invoice records: Portuguese tax law requires us to keep invoices and the minimum data on them (your card country, the amount, the date) for ten years, even after you delete your account. That is the one thing a deletion request cannot remove.
• Contact form submissions and replies to our emails: 24 months, then archived to cold storage.
• Sign-in sessions: deleted a day after they expire.
• Sign-up and payment checks: the IP hash for 90 days. The matching form of your email and the card fingerprint for as long as the account or the invoice record lives. When you delete your account, we keep the IP hashes and a keyed hash of the matching form of your email, with nothing that names you, until those 90 days end. We also keep a record of each payment without your name, email or card details, for the ten years the invoice records need.
• Server logs: 14 days.
• Visit counts: kept as history. They hold no IP address and no identifier that lasts past the day it was recorded.

7 · Your rights (GDPR)

You can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on our legitimate interests. Use the contact form. We respond within 7 days, and a deletion you ask for through the form is done within 30 days. You can also delete your account yourself in Settings, and it takes effect at once, apart from the invoice records in section 6.

You can also complain to your data-protection authority. Ours is the Comissão Nacional de Proteção de Dados (CNPD) in Lisbon, but please give us a chance first.

8 · Children

Domani is for adults pursuing professional employment. We do not knowingly collect data from anyone under 16.

9 · Changes

When this policy changes, the revision date at the top moves and we describe the change here. If a change would give us more of your data or a new reason to use it, we describe it here, with its date, before it applies. If the new use rests on your consent, we also ask you first, and it does not apply to you until you agree.

• 18 October 2026. You can now delete your account yourself in Settings, and section 6 says what a deletion keeps: the IP hashes and a keyed hash of your email's matching form until their 90 days end, with nothing that names you, and a record of each payment without your name, email or card details. Before this change a deletion removed the hashes at once.