Átrio Privacy Policy

Last updated: October 11, 2026

This policy explains what personal data Átrio processes, why, with whom, for how long, and how you can exercise your rights. It applies to the app (iPhone, iPad, Android) and to the web version.

Who is responsible

The data controller is Starthrop Dynamics, Unipessoal Lda., Tax ID (NIPC) 519488261, Rua da Sociedade, 4, 2695-567 São João da Talha, Portugal. For any privacy matter, write to info@starthrop.com.

What data we process

• Account data: name, email, phone number (optional), and preferred language.
• Service data: what you request and describe, the proposals, your replies and notes, the progress of the services, and the history.
• Documents you send and receive (for example, an identity document, receipts, or the outcome of a request). They are stored exactly as sent, without conversion.
• Payments: amount, status, and payment reference. Card details are processed directly by Stripe; Átrio neither receives nor stores them.
• Technical data needed for the service to work: sign-in sessions, sign-in codes (stored only as a cryptographic fingerprint and valid for 10 minutes), the installation identifier and the device's notification token, and technical security logs.

What we use it for and on what legal basis

• Providing the services you request and purchase: reviewing the request, the proposal, carrying out the work, communication, and delivery (performance of a contract and pre-contractual steps).
• Complying with legal obligations, including keeping accounting and tax records (legal obligation).
• Protecting the account and the service against abuse and unauthorized access (legitimate interest).
• Sending emails and notifications about your service. We do not send advertising and we do not sell data.
• Measuring our advertising on Meta, on the web and in app versions that offer this choice, and only if you allow it (consent) — see “Advertising measurement with Meta” below.

Who we share it with

Only with the necessary providers, who process the data on our behalf and under contract:

• Netlify (hosting of the app, the database, and the documents, in the European Union region, Frankfurt).
• Google (sending emails from info@starthrop.com and notifications on Android).
• Apple (notifications on iPhone and iPad).
• Stripe (payments).
• Meta Platforms Ireland Limited, only if you allow advertising measurement on the web or in app versions that offer this choice (see below; here Meta does not act only on our behalf).

When carrying out a service requires it, the strictly necessary data are submitted to the competent public authority or to a licensed professional involved in your case, always within the scope of the service you purchased. Some providers are companies based outside the European Union; in those cases, transfers are made with the safeguards provided for in the GDPR (such as standard contractual clauses or adequacy decisions).

How long we keep it

• Account, services, and documents: for as long as the account exists. When you delete the account, they are deleted immediately.
• Database backups: used only to recover from a failure. Daily backups are replaced after 30 days; the backups taken at each service update are replaced by the following ones (the 10 most recent are kept). Deleted data may remain in these backups until they are replaced, without being used.
• Payment records (amount, dates, provider reference, and the purchased proposal): kept without your identification data for 10 years, as required by law (Código do IRC, artigo 123.º, n.º 4 — Portuguese Corporate Income Tax Code, Article 123(4)).
• Sign-in codes: 10 minutes. Sessions: until they end or expire.
• Meta measurement (if allowed): the record of each step, up to 7 days; sending data and the payment origin, up to 30 days; after that, only counts that do not identify the account.

Advertising measurement with Meta (optional)

If you allow it, in Átrio (on the web and in the iPhone, iPad and Android apps), Starthrop notifies Meta Platforms Ireland Limited, through the Conversions API (server to server), when these steps happen: sign-up completed, first request sent, start of each payment, and payment confirmed. The purpose is to evaluate our advertising on Meta. It is optional: declining changes nothing in your service.

What we send: the name of the step and when it happened; a pseudonymous identifier of your account (a code derived from the account that does not show your name or email, but is not anonymous — it links the steps of the same account); on the web, the browser used (user agent), the public address of the app and, if you reached the app through a Meta ad, that click’s identifier (only if it is up to 7 days old); in the apps, technical device data (app version, operating system and version, model, language, time zone, screen size and density, and number of processor cores) and whether tracking is allowed in the system. For the start of a payment and the confirmed payment we also send the amount, the currency and a cryptographic code of the payment. We do not send your name, email, phone number, IP address, device advertising identifier, or the content of your requests, documents or messages. The data is sent from our servers, not from your device.

How you choose: we ask on each device; the permission applies to that device and we keep the version of the text you accepted. Declining or withdrawing at any time, in Meta preferences, applies to the whole account and cancels pending sends. A permission given later does not authorize steps that happened before, and a step is sent only if the permission in force when it happened is still valid. If this text changes in a relevant way, we ask again. On iPhone and iPad, the measurement only happens if you also allow tracking in the system prompt (App Tracking Transparency); if the system does not allow it, nothing is sent from that device. On Android we do not read the advertising identifier.

Legal basis and responsibility: the legal basis is your consent (GDPR, Art. 6(1)(a)). Starthrop and Meta Platforms Ireland Limited (Block J, Serpentine Avenue, Dublin 4, Ireland) are joint controllers (Art. 26 GDPR) for collecting this data and sending it to Meta, under Meta’s Controller Addendum, which is part of the Meta Business Tools Terms. We agreed that Starthrop gives you this information and that Meta Ireland handles your rights of access, rectification, erasure, restriction and portability for the data it stores after receiving it. To match the events and produce measurement reports, Meta processes the data on our behalf; what Meta then does with it, for example for advertising, is Meta Ireland’s responsibility. Meta’s Privacy Policy (www.facebook.com/about/privacy) explains Meta’s legal basis, any transfers it makes outside the European Union and how to exercise your rights with Meta. You can also contact us (info@starthrop.com).

Retention and deletion: the record of each eligible step is kept for up to 7 days, so that a technical failure does not lose it; steps older than 7 days are not sent. Sending data and the payment origin are kept for up to 30 days; after that only daily counts that do not identify the account remain. When you withdraw, we immediately delete the click identifier and the record of steps not yet sent; when you delete your account, we delete everything related to this measurement. What Meta has already received is handled under Meta’s policy.

Your rights

You may request access, rectification, erasure, restriction, and portability, and you may object to processing, by writing to info@starthrop.com. You can delete your account at any time in the app itself (Your account › Delete account) or on the web. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, the Portuguese Data Protection Authority, www.cnpd.pt).

Security

Connections are encrypted (HTTPS). Documents are kept in private storage and leave it only through the app, for the account holder or for whoever is handling the case. There are no public links to documents. Sign-in codes are not stored in plain text.

Children

Átrio is intended for adults. We do not knowingly collect data from children.

Changes

If this policy changes, we will publish the new version here with the date it was updated.

Optional product measurement

With your permission, we use Google Analytics/Firebase to measure navigation, language, platform and actions such as signing in, submitting a request and deleting an account. This measurement does not receive document contents, your name, email, phone number, address or request identifiers. Optional collection starts only after your choice and can be disabled in analytics preferences.

The provider also processes technical information needed for the service. Analytics event and user data retention is configured for 14 months; web cookies are configured for up to one year, subject to browser limits. This device’s choice remains until changed or cleared. Withdrawal stops new transmissions and resets local SDK identification; it does not automatically delete earlier data or independent copies. To exercise rights concerning previously processed data, contact info@starthrop.com.