Privacy Policy

Last updated: November 7, 2026

ENGIBOTS, LDA. (hereinafter "ENGIBOTS") is committed to protecting the privacy and personal data of its customers, website users and those who use its Engi360 and EngiFinance platforms. This Privacy Policy explains how we collect and process your personal data.

1. What Personal Data Do We Collect?

We collect the following personal data:

Name
Email address
Phone number
Company name
IP address and cookies (for website functionality and, if you accept them, for analytics and advertising)

1.1. Data processed in EngiFinance

When you use EngiFinance, we process the following data.

Account. Name, email, password (stored only as a cryptographic hash), email confirmation, last sign-in, failed attempts, the two-factor authentication secret (encrypted), preferred language and the role in each organisation (administrator, member or accountant). In invitations, the email and role of the person invited. The answer to the newsletter box, the date of that answer and the date you joined the list.
Organisation and companies. Name, trade name, tax number, country, currency, time zone, logo and VAT regime.
Bank accounts and transactions. Account name, bank, IBAN and opening balance. For each transaction, the date, the description as it comes from the bank, the amount, the balance, the counterparty, the reference, the notes and the name of whoever marked the transaction as completed, with the date. The statement file is not stored, only its name, size and a fingerprint to avoid duplicates.
Documents. The files of the invoices and other documents you upload, and what is extracted from them, such as the name and tax number of the issuer and the buyer, the totals, VAT, the ATCUD and the Portuguese tax authority (AT) QR code. These documents contain third-party data, such as suppliers and customers.
Payslips. The payslips and the lists of payments to workers, such as those for a meal card, that the organisation uploads, and, for each worker, the name, the tax number and the net amount. Only the organisation's administrators can see them. They are not sent through the API or to the event addresses, and they are only included in the export for the accountant when an administrator generates it.
Projects and people. The customer and tax number of each project and, in the plan that includes cost allocation, each person's name, email, tax number, start and end dates, monthly and hourly cost and allocated hours.
Notifications and integrations. Notifications sent by email, with the recipient, subject and text, and the data sent to the addresses the organisation configures to receive events.
Support requests. The requests the organisation opens with ENGIBOTS, with the subject, the description, the messages exchanged and the attachments, which are stored encrypted. The administrator sees all of the organisation's requests, and a member sees those they opened. The notice the ENGIBOTS team receives by email only carries the request number, the organisation, the type and the priority.
Activity log. Who did what and when, with the IP address and the names of the fields changed, without their values.
Cookies. Only technical cookies, needed for the session, form security, two-factor sign-in, the selected company, the language and the chosen theme (light, dark or automatic). EngiFinance does not use analytics or advertising cookies.

In EngiFinance, artificial intelligence reads documents and PDF statements and proposes how transactions are classified. It receives only what that task requires, described in the table of providers, and does not use the data to train models. The proposals can be reviewed and corrected by those using the platform.

1.2. Who is responsible for the data

ENGIBOTS is the controller of account and subscription data. For the data the organisation uploads to Engi360 or EngiFinance, such as statements, documents and data about people and projects, the organisation is the controller and ENGIBOTS processes it on its behalf, as a processor, only to provide the contracted service and according to the organisation's instructions.

2. How Do We Use Your Data?

We use your personal data for:

Responding to your inquiries and providing customer support
Sending you information about our services (with your consent)
Improving our website and services
Complying with legal obligations

3. Legal Basis for Processing

We process your data based on:

Performance of the contract (creating and maintaining the account and the organisation and providing the platform service)
Your consent (for marketing communications and cookies)
Legitimate interests (website operations, security, fraud prevention)
Legal compliance (accounting, tax obligations)

4. Data Retention

We retain your data for:

Contact inquiries: 2 years
Webinar registrations: 2 years
Cookie consent preference: 1 year
Invoices and accounting records: 10 years (art. 123(4) of the Portuguese Corporate Income Tax Code)
Data of a closed organisation: 12 months after closure, with notice to the administrators 30 days before deletion
Free trial that was never paid: 12 months after it was suspended
Notifications already handled in the platform: 90 days, a period the administrator can change between 7 and 730 days. Deliveries to the event addresses configured by the organisation: 30 days
Database backups: up to 8 days. Data of a deleted organisation may remain in these backups until they expire
Server access logs, with the IP address: up to 14 days
In EngiFinance, monthly summary of each organisation, containing only figures (the status, the plan, the subscription amount and the month's counts), without the organisation's name: no time limit, also after deletion

5. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

Encrypted data transmission (TLS), including the connection to the database
Servers with limited access
On the platforms, two-factor authentication, which the administrator can make mandatory, roles with different permissions and separation of each organisation's data in the database
Temporary account lock after several failed sign-in attempts

6. Sharing Your Data

We do not sell or rent your personal data. We may share data with:

Legal authorities when required by law

We use the service providers below, each bound by a data processing agreement and each receiving only what its purpose requires. Where a provider is outside the EU, transfers rely on the European Commission's Standard Contractual Clauses.

Provider	Purpose	What it receives
Microsoft Azure (Netherlands)	Hosting and database	All data you store in the platform, including, in EngiFinance, the documents uploaded
Resend	Email delivery	Recipient name and address, and the content of the message sent. Kept for up to 37 days, counting Resend's backups, in the United States
Stripe	Subscription payments for Engi360 and EngiFinance	Billing name, address, tax number and payment details. Card numbers never reach us.
TOC Online	Certified invoicing	Billing details required by law to issue an invoice
VIES (European Commission)	Validating the VAT number of the subscriber	The VAT number given at subscription
Microsoft Azure OpenAI (Netherlands)	In Engi360, optional assistants inside the product	Only the text of the item you ask it about. Nothing is used to train models. Requests to the model may be processed by Microsoft outside the European Union, under the European Commission's Standard Contractual Clauses.
Microsoft Azure OpenAI (Netherlands)	Reading documents and classifying transactions in EngiFinance	The text or page images of documents, payslips and PDF statements, the company's name and tax number, and the date, description and amount of the transactions to classify. Nothing is used to train models. Requests to the model may be processed by Microsoft outside the European Union, under the European Commission's Standard Contractual Clauses.
Microsoft Teams	Running the webinars you register for	Your first name, last name and email, to send you your personal joining link and record your attendance
Google Analytics	Measuring how many visits lead to a sign-up	When an organisation is created, a sign_up event with the analytics identifiers held in your browser (client and session id) and the country of the organisation. Not your name, not your email.
OpenAI (ChatGPT Ads)	Measuring sign-ups that came from an advert on ChatGPT	Only if you reached us through a ChatGPT advert. In that case, and only then, the sign-up is reported with your email address in irreversible hashed form (SHA-256), used to match the advert click. If you did not arrive through such an advert, nothing is sent.
Sender.net	Sending our newsletter	When you subscribe to the newsletter on this website, when you request a free guide on this website and confirm your email, or, unless you untick the newsletter box, when you fill in the contact form or create an Engi360 account. In EngiFinance, only if you tick the newsletter box, which is unticked by default. In that case your name, email address and company name are added to our mailing list, so that we can reply to you and send you occasional news about Engibots. On the contact form, this only happens after you confirm the subscription in the email we send you. If you only subscribe to the newsletter, we only keep your email address, and we add it to the list only after you confirm the subscription in the email we send you. Creating an Engi360 account adds you to this same list, unless you untick the newsletter box when you sign up or when you accept an invitation. In EngiFinance, the box is unticked when you sign up and when you accept an invitation with a new account. Only those who tick it are added to the list, with their first name, last name, email address and organisation name, and, when signing up, only after confirming the email address. You stay on the list after the account or the organisation is deleted. If you ask for erasure, we also remove you from the list. You can leave at any time, using the link at the bottom of any of those emails or by writing to geral@engibots.com. When you register for a webinar, your name, email and, when you provide them, company, job title, company size and the process you indicated go into that webinar's list, for the confirmation, the reminders and, where there is one, the recording. The newsletter only reaches those who tick that box.

Google Analytics and ChatGPT ads relate to the website and Engi360, and Microsoft Teams and the LinkedIn Insight Tag only to the website. EngiFinance does not use analytics or advertising. Our newsletter only reaches those who ask for it in EngiFinance, by ticking the box, which is unticked by default, when signing up or accepting an invitation.

The Google Analytics and OpenAI rows exist to measure advertising. You can object to them at any time by writing to geral@engibots.com, and doing so does not affect your account or your use of the product.

7. Your Rights

Under GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Request erasure of your data
Object to processing
Data portability
Withdraw consent at any time
Lodge a complaint with the supervisory authority (CNPD in Portugal)

In EngiFinance, administrators can export the organisation's transactions, cash flow and documents at any time, and close the organisation in the settings. For the other rights, including deleting an account, write to geral@engibots.com. Where the data belongs to a customer organisation, we forward the request to that organisation.

8. Cookies

This website uses a cookie to record your cookie choice and, if you accept them, cookies from Google Analytics, Google Ads and the LinkedIn Insight Tag. For details, see our Cookies Policy.

9. Third-Party Links

Our website may contain links to third-party sites. We are not responsible for their privacy practices.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page, with the date of the last update, which is also the version recorded with EngiFinance accounts.

11. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact:

ENGIBOTS, LDA.
Email: geral@engibots.com
Address: Av. D. João II, Lote 1.07.2.1, Piso 0, Parque das Nações, 1990-096 Lisboa, Portugal
Tax ID: 517227096