Version of 2026-08-01
Privacy Policy
How Antevo handles personal data. The data controller is Aljubarrota IT (Lisboa, Portugal). Data-subject requests: geral@aljubarrota-it.pt.
Two categories of data
First, the data of your activity in the service: account, saved searches and subscriptions, capability profile, pipeline items, recommendation ratings. You create these yourself.
Second, public procurement data from official sources. This is mostly data about legal entities, but in some records the primary source publishes the names of natural persons (for example, sole traders).
Natural-person data in procurement
A natural person’s tax number (NIF) is not exposed in the anonymous interface or in exports. This is a technical measure, not a complete solution: the publication of names in public procurement itself follows from Portuguese transparency law.
The legal basis for processing such data is our legitimate interest (GDPR art. 6(1)(f)) as an analytics service over open public data, balanced against the data subjects’ interests. You may object to the processing — see “Your rights”.
Why we hold your data
Account and working data exist so the service can function: authentication, your subscriptions and alerts, the personalised “picked for you” feed, pipeline history. Basis: performance of the contract (art. 6(1)(b)). We do not sell this data or use it for advertising.
Your IP address is processed briefly for security (protecting sign-in against brute force) on the basis of legitimate interest (art. 6(1)(f)).
Recommendation ratings are used in pseudonymised form (tied to the capability profile, not your name) to calibrate the relevance formula.
Alerts and delivery channels
If you enable subscriptions, we send a digest to the channels you choose: email, Telegram or WhatsApp. You can unsubscribe and disable channels in settings. The message contains only what you selected with your filters.
Each channel is activated by your explicit action: Telegram by linking the chat to the bot, WhatsApp by entering the number and confirming a code. When delivering via Telegram (Telegram FZ-LLC) and WhatsApp (Meta Platforms Ireland/USA), the digest content and the chat identifier/number are transmitted to those services as independent recipients.
Recipients and transfers outside the EEA
Core data is stored on servers within the EU/EEA. Some processing is carried out on our behalf by providers: hosting and email delivery (SMTP). If you use Google or Apple sign-in, their servers verify your login; if you enable Telegram or WhatsApp, the digest goes to those operators.
Such transfers may occur outside the EEA (notably WhatsApp/Meta and OAuth providers), relying on European Commission adequacy decisions or standard contractual clauses (SCCs). If you do not want these transfers, use only the email channel and password sign-in.
Retention periods
Account data — while your account exists. Alert events are deleted 180 days after delivery; recommendation ratings after 12 months. After account deletion your personal data and organisation data are erased; some records may be kept for a limited period to meet legal obligations.
Cookies and third-party scripts
We use only strictly necessary cookies: the session token and the chosen interface language. There are no advertising or tracking cookies.
The Google and Apple sign-in scripts load only after you click the corresponding sign-in button — no request reaches their servers before that.
Your rights
Under the GDPR you have the right to request access, rectification, erasure, restriction or portability of your data and to object to processing. You can delete your account with all personal data in settings; for other requests contact geral@aljubarrota-it.pt.
You also have the right to lodge a complaint with the supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).