Privacy Policy

This Policy applies to the personal data for which Nevergetold, Lda. is the controller, namely:

the account and account holder data of each customer organisation ("Tenant") that subscribes to ModuHelp;

the billing and usage data relating to the contractual relationship between us and the Tenant;

the data of visitors to our corporate website and marketing pages.

This Policy does NOT cover the personal data of the End Customers who contact the Tenant through the service (for example, the name, email, message content and attachments of those requesting support). With respect to that data, the Tenant is the controller and Nevergetold, Lda. acts as processor, processing it exclusively on behalf of and according to the instructions of the Tenant. The framework for that processing is set out in the Data Processing Agreement ("DPA") entered into with each Tenant, available at https://moduhelp.com/dpa, and not in this Policy.

If you have contacted a company that uses ModuHelp and wish to exercise rights over your data, you should address that company (the Tenant) directly, as it is the one that decides on that data. See also Section 5.

In the scope of our role as controller, we collect and process the following categories of data:

Account and holder data: name, email address, password (stored only in the form of an irreversible cryptographic hash), job title/role, language preference, and Tenant organisation data (name, tax number, address, sector of activity).

Billing data: data necessary for billing the subscription to the Tenant (tax identification, invoice history, subscription payment status), processed with the support of Stripe and certified invoicing software. Full payment method data is processed by the payment provider; we retain only the payment method type and the last four digits, for identification purposes.

Technical data and logs: IP address, session identifiers, browser and device type, authentication and activity logs, error logs, for the purposes of security, abuse detection and technical diagnostics.

Support communications: the content of support requests you address to us and records of support interactions.

Website visitor data: information collected through contact or demonstration request forms.

We do not collect, within the scope of this Policy, sensitive data (special categories of data under Art. 9 GDPR).

Purpose: Creation and management of the Tenant account and provision of the ModuHelp service. Legal basis: Performance of a contract (Art. 6(1)(b)).

Purpose: Billing of the subscription and compliance with tax and accounting obligations. Legal basis: Legal obligation (Art. 6(1)(c)).

Purpose: Platform security, detection and prevention of fraud and abuse, traffic limitation and anti-bot verification (Cloudflare Turnstile), used at registration, in the embeddable widget and on the shareable contact page. Legal basis: Legitimate interest (Art. 6(1)(f)). The anti-bot verification is carried out on all of these surfaces on our own initiative and under our own responsibility, in our capacity as controller: we determine that it is used, the provider and the configuration, and it also protects our own infrastructure. Where it applies to End Customers, this does not change the qualification of the message content, which continues to be processed on behalf of the Tenant, in our capacity as processor, under Section 5 and the DPA.

Purpose: Technical diagnostics, maintenance and improvement of the service. Legal basis: Legitimate interest (Art. 6(1)(f)).

Purpose: Response to support requests and operational communications about the account. Legal basis: Performance of a contract / legitimate interest.

Purpose: Marketing communications. Legal basis: Consent (Art. 6(1)(a)), only when the data subject opts to receive them; consent may be withdrawn at any time.

The AI Features are described in Section 10. We do not resort to solely automated decisions with legal effects or a significant impact on data subjects, see Section 13.

With respect to the personal data of End Customers processed through ModuHelp (the content of tickets, messages, attachments and the Tenant's knowledge base), Nevergetold, Lda. acts exclusively as processor, processing that data only in accordance with the documented instructions of the Tenant, for the purposes defined by the Tenant.

The conditions of that processing, including technical and organisational security measures, authorised further sub-processors, retention periods, procedures for responding to data subject requests and for notifying data breaches, are set out in the DPA entered into with each Tenant, under Art. 28 GDPR. If in doubt about the processing of your data, consult the Tenant you contacted.

To provide the service, we rely on the following sub-processors and service providers, to whom personal data may be transmitted to the extent strictly necessary:

DigitalOcean: Application hosting and infrastructure. Location: European Union (Frankfurt, Germany).

Supabase: PostgreSQL database and vector search. Location: European Union (Frankfurt).

Upstash: Cache and processing queues. Location: European Union (primary region and replicas within the EU only).

Cloudflare: Attachment storage (R2, with EU data jurisdiction), DNS, TLS, CDN and anti-bot verification (Turnstile, at registration, in the embeddable widget and on the shareable contact page). Location: European Union / global.

Postmark: Sending and receiving email. Location: Principal location in the EU, with possible international access or transfers under a valid transfer mechanism.

Mistral AI: Artificial intelligence models (classification and drafting of responses). Location: European Union (France).

Sentry: Error monitoring. Location: European Union (Frankfurt).

Stripe: Subscription payment processing. Location: European Union and USA, with applicable transfer mechanism.

This list is kept up to date. We may also share data with public authorities when required by law. We do not sell personal data to third parties nor use it for third-party behavioural advertising.

The principal location of our infrastructure is in the European Union: the application and the database in an EU region (Frankfurt), the cache in EU regions only, the files in Cloudflare R2 with EU data jurisdiction and error monitoring (Sentry), when enabled, in Frankfurt. The AI provider (Mistral AI) processes data in the European Union (France).

This principal location in the EU does not, in itself, exclude remote access, support, network routing or occasional transfers by providers located outside the European Economic Area (EEA). In particular, the transactional email service (Postmark) provides, in its terms, for the possibility of international access or transfers, and so its location is not presented as exclusively European residence. In such cases, we ensure adequate safeguards under Arts. 44 to 49 GDPR, namely an adequacy decision of the European Commission or Standard Contractual Clauses (SCCs), accompanied by the necessary supplementary measures.

Without prejudice to longer periods required by law:

Billing data and tax documents: for the legal retention period in Portugal, currently 10 years.

Account data and content: for as long as the account is active. Following a request for deletion of the workspace, we apply a grace period of 30 (thirty) days, after which the data is permanently deleted, including from backups within their respective rotation cycles, save for a legal retention obligation.

Technical records and security logs: for a limited period appropriate to the security and diagnostic purposes, after which they are deleted or anonymised.

Support communications: for as long as necessary to resolve the request and for support history purposes.

With respect to the data for which we are the controller, you may exercise, under the GDPR, the rights of: access; rectification; erasure ("right to be forgotten"), where applicable; restriction of processing; portability; objection to processing based on legitimate interest or for direct marketing; and withdrawal of consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us through hello@modulardigital.pt. We will respond within the applicable legal period. Please note that certain data cannot be erased while a legal retention obligation subsists (for example, billing data).

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, through www.cnpd.pt (https://www.cnpd.pt).

Important note: if your data was processed because you contacted a company that uses ModuHelp, requests relating to that data should be addressed to that company (the Tenant), which is the controller, see Sections 2 and 5.

10.1. The service uses language models to classify requests and draft proposed responses and, where the Tenant enables it, to send responses automatically. For this purpose, the relevant content is transmitted to our AI provider, Mistral AI, based in the European Union (France).

10.2. We do not use Tenants' content to train artificial intelligence models. The processing carried out by Mistral AI, as the AI provider, is governed by its own terms and data policy, namely the Data Processing Addendum (https://legal.mistral.ai/terms/data-processing-addendum) and the Privacy Policy (https://legal.mistral.ai/terms/privacy-policy), which we recommend consulting. Under those terms, data sent through the API is not used for model training, with automated moderation applied for abuse prevention, except where the zero data retention option is enabled.

10.3. The AI Features do not make solely automated decisions producing legal effects or significantly affecting data subjects, within the meaning of Art. 22 GDPR. The sending of AI responses is under the control of the Tenant, which may require human approval and disable automatic sending at any time.

11.1. The application uses only strictly necessary cookies: a session cookie (encrypted) indispensable to maintaining authentication and a language preference cookie. We also use the Cloudflare Turnstile anti-bot mechanism, for security reasons, at registration, in the embeddable widget and on the shareable contact page, in invisible mode in the embeddable widget. Turnstile is provided by Cloudflare, Inc. and collects client-side signals strictly necessary for the detection and blocking of bots, namely the IP address, the User-Agent, the TLS fingerprint and the sitekey, under the Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/), which we recommend consulting. These cookies and the technical information associated with the anti-bot verification do not require prior consent under Law no. 58/2019 and the ePrivacy Directive, as they are strictly necessary for the provision of the service expressly requested by the user, including, in the embeddable widget and on the shareable contact page, the sending of the support message that the user themselves initiates.

11.2. The embeddable widget and the shareable contact page do not use analytics, advertising or profiling cookies nor track visitors across sites. Each load requests a short-lived token, associated with that page and that moment, which expires and cannot be reused after the visitor leaves. The anti-bot verification referred to in 11.1 may involve storing, in the visitor's browser, technical information strictly necessary for that verification.

11.3. As at the date of this Policy, we do not use third-party analytics, advertising or profiling cookies. Should we introduce non-essential cookies, we will request prior consent through an appropriate mechanism and update this Policy.

12.1. We adopt technical and organisational measures appropriate to the risk, including, among others: encryption of credentials and of data in transit, role-based access control, segregation of data by Tenant, and activity logging and monitoring. No system is entirely immune to incidents; should a breach occur of personal data for which we are responsible, we will notify the CNPD and the affected data subjects in the cases and within the periods required by the GDPR, in the shortest possible time.

13.1. We use automatic security and abuse detection checks and AI Features for the drafting of responses. These do not produce solely automated decisions with legal effects or a similarly significant impact on data subjects, within the meaning of Art. 22 GDPR. Any measure with a relevant impact on an account, and the sending of AI-generated responses, allow for human intervention and control.

14.1. We may update this Policy to reflect changes to the service, to the sub-processors or to applicable legislation. The date of the last update is indicated at the top. In the event of material changes, we will seek to inform Tenants by email or through a notice on the platform.

In the event of a conflict between the Portuguese version and any translation, the Portuguese-language version prevails.