Privacy policy
The Portuguese version is the main version. This English version is a translation.
- Your invoices stay in your browser. We do not receive amounts, dates, invoice numbers, your name or your NIF.
- For each invoice, we send only the merchant's NIF, the share of each VAT rate, an exempt flag and counts of categories already chosen.
- There are no accounts and no ads. We do not sell data.
- If you buy the season pass, a payment provider processes the payment. We do not keep your email or payment details.
- e-Fatura Rescue is an independent project, not affiliated with the Autoridade Tributária e Aduaneira or the Portal das Finanças.
1. Controller and contact
The data controller is e-Fatura Rescue.
For privacy questions and to use your rights, write to info@cre8ivepixellabs.com.
2. Data we collect
The extension reads, on your computer, the invoice data that the Portal das Finanças shows you. This data does not leave your browser. The amounts are used only to show an estimate of your deduction on your screen. The extension does not read or keep your password.
| Data | When |
|---|---|
| Merchant NIF, VAT-rate shares (no euro amounts), exempt flag and counts of categories already chosen | For each pending invoice. Your NIF is never sent. |
| Install ID and signed install pass | The ID is a random number made when you install the extension. It is not linked to your name or your NIF. It is used to limit daily use and stop abuse. |
| IP address | The server sees it on each request. Our code does not keep it. |
| Anonymous usage counts | Once a day, with no install ID or other identifier. See section 3. |
| Season pass data | Only if you buy. A random code made on your computer (we keep only a fingerprint of it), the season, the number of activations, the payment session ID and the payment status and time. |
| For payment and code recovery (we do not keep it), or if you join the email list. | |
| Registered name and activity of sole traders | Obtained from the merchant's NIF, from a public company lookup service. |
We do not receive: amounts, dates, invoice numbers, item descriptions, the merchant's name as printed on the invoice, your name, your NIF, your cookies or your portal session.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Classify invoices and protect the service from abuse and unlimited costs (merchant cache, daily cap and per-network counters) | Legitimate interest, article 6(1)(f). We send the minimum data, make no accounts, keep nothing that identifies you and use the data for nothing else. |
| Anonymous daily totals: to learn whether the extension works and whether it is right. They count, for example, runs, rows filled in or corrected, errors and free-limit reached. | Legitimate interest, article 6(1)(f). You can turn them off in the extension's settings. |
| Season pass payment, code recovery and refunds | Performance of a contract, article 6(1)(b). |
| Invoices and tax records | Legal obligation, article 6(1)(c). |
| Email list, with a confirmation email (double opt-in) | Consent, article 6(1)(a). You can withdraw it at any time. |
We do not sell or rent data. We do not use it for ads, credit assessment or training models.
Sole traders. Some merchants are individual people, such as a doctor or a tutor. The registered NIF, name and activity of these people are personal data. They come from public records and are used only to classify invoices. If you are a sole trader and want us to delete your record from our cache, write to us with your NIF. An invoice from a health professional can show that you went to an appointment, so we keep no request linked to you or to your install ID.
Providing data. You are not required to provide personal data. To buy the pass, the payment provider needs your email.
4. Recipients
We share data with service providers, only what each one needs to work.
| Category of recipient | What it receives |
|---|---|
| Hosting and database | The per-invoice data in section 2. The server is in a data centre in Paris, France (EU). |
| AI classification service | The merchant's public details, the VAT-rate shares, the exempt flag and the category counts. It does not receive the install ID or your IP address. |
| Public company lookup | Only the merchant's NIF. It receives nothing about you. |
| Payment provider (only if you buy the pass) | What you type on the payment page (card or MB WAY): email, payment method details and acceptance of the terms. It also receives the unlock code, in the session data. It processes payment data as an independent controller, under its own privacy policy. We receive only the payment status. |
| Email delivery provider (only if you ask to recover your code) | Your address and the message with the code. It also gets the daily sales summary we send to the owner, with the buyer's email, so the owner can issue the invoice. |
| Email list provider (only if you sign up) | Your email address. |
| Public authorities | Only if the law requires it. |
Our code keeps no request logs, but the hosting and AI classification providers can keep their own technical and billing logs, such as the IP address and the time of requests, under their policies.
If you turn on advanced mode and use your own keys, the extension talks directly to the classification service and the company lookup, not through our server, and sends them the same reduced data. Those services see your IP address and apply the terms of your account.
5. International transfers
Some of our providers belong to groups based outside the European Economic Area (EEA) or process data outside it. When data goes to a country that does not offer a level of protection equal to the EU's, we make sure it stays sufficiently protected. For example, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can ask us for more information about these safeguards at info@cre8ivepixellabs.com.
6. Retention
We keep data only as long as needed for the purpose we collected it for. Then we delete it.
| Data | How long |
|---|---|
| Merchant cache (registered name, CAE and activity per NIF) | 12 months after the lookup. |
| Classification answer cache (fingerprint of the request, category and probabilities; not the request or the install ID) | 90 days. |
| Daily cap and per-network counters | Deleted at the end of each day (00:00 UTC). Per-network counters are kept in memory only. |
| Anonymous daily, cost and sales totals | While the project runs. They hold no personal data. |
| Paid passes (fingerprint of the code, season, activations, payment session ID, status and time) | Unfinished payments: 30 days. Paid or revoked passes: 12 months after the end of the season. The 2027 season ends on 31 December 2027, so these are deleted on 1 January 2029. |
| Email list | Until you leave the list or the project ends. |
Our database holds no install ID, request content, email addresses or IP addresses.
The email of someone who buys the pass exists outside our database: in the payment provider's records and receipts, in the daily sales summary and in the invoice records. The invoice is issued on the Portal das Finanças, and tax law requires it to be kept for the legal period.
7. Your rights
You have the right to ask for access to, correction, deletion or restriction of your data, to object to processing based on legitimate interest and, where it applies, to data portability. Where processing is based on your consent, you can withdraw it at any time.
To use a right, write to info@cre8ivepixellabs.com. We answer within one month.
Because we keep nothing linked to you, we usually cannot find data about you on our server (GDPR article 11). We can find your address on the email list, a sole trader's record by NIF and, if you bought the pass, the purchase through the payment provider. For the data that provider holds, you can also contact it directly.
To stop all processing, remove the extension. To stop only the daily totals, turn them off in the settings.
Automated decisions. The extension picks categories automatically and presses buttons on the page, but it never submits anything. You check the rows and submit. No decision with a legal effect on you is made without you.
You can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
8. Local storage
The extension does not use cookies. It keeps in Chrome's local storage your settings, the install ID and pass, the day's counts before they are sent, the season's free auto-fill counter and, if you started buying the pass, the unlock code and payment status. In advanced mode, it also keeps your own keys and the answers it got.
The paid pass is also kept in Chrome's syncable storage, which Chrome can sync between your computers through your Google account if you have sync turned on. When you remove the extension, Chrome deletes the local data.
9. Changes
If we change what we send or keep, we update this page and the date at the top. If the change is important, we tell you in the extension before it takes effect.