Boring Digital Limited · Last updated: March 2026

Privacy Policy

This Privacy Policy explains how Recibo Simples, operated by Boring Digital Limited ("we", "us", "our"), collects, uses, and protects your personal data when you use our platform. We are committed to GDPR compliance and transparency.

Data Controller

The data controller is Boring Digital Limited, 3 Elmfield Road, Potters Bar, England, EN6 2JH. Company Number: 11892929. VAT: 318 3575 91. For any privacy requests, contact us at legal@recibosimples.pt.

Personal Data We Collect

We collect the following categories of personal data:

  • Account information: email address, name, and encrypted password
  • Tax profile: NIF (tax ID), activity start date, Social Security status
  • Income and invoice records: amounts, dates, client names, descriptions
  • Tax estimation data: calculated IRS, Social Security, and IVA estimates
  • Usage analytics: pages visited, feature usage, device type
  • Payment data: processed by Stripe — we do not store card details

Legal Basis for Processing

Under GDPR Article 6, we process your data based on:

  • Contract performance (Art. 6(1)(b)): to provide the service you signed up for
  • Legitimate interest (Art. 6(1)(f)): to improve our platform and prevent fraud
  • Consent (Art. 6(1)(a)): for optional analytics cookies
  • Legal obligation (Art. 6(1)(c)): to comply with applicable laws

Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we remove your data within 30 days, except where retention is required by law (e.g., billing records for 7 years under Portuguese tax law).

Third-Party Processors

We use the following third-party processors:

  • Stripe — payment processing (USA, EU Standard Contractual Clauses)
  • Cloud hosting provider — data storage within the EU
  • Analytics tools — usage data, anonymised where possible

Your Rights

Under the GDPR, you have the right to:

  • Access: request a copy of your personal data
  • Rectification: correct inaccurate data
  • Erasure: request deletion of your data ("right to be forgotten")
  • Portability: receive your data in a structured, machine-readable format
  • Restriction: limit how we process your data
  • Objection: object to processing based on legitimate interest

To exercise any of these rights, email us at legal@recibosimples.pt. We will respond within 30 days.

Account Deletion & Data Export

You can request full deletion of your account and data or export your data at any time by emailing legal@recibosimples.pt. Data export is provided in JSON format.

Data Protection Authority

If you believe your rights have not been respected, you can lodge a complaint with the Portuguese Data Protection Authority (CNPD) at www.cnpd.pt.