Privacy Policy
Last updated: September 2026
Privacy, confidentiality, and data protection are fundamental foundations of every system and workflow designed by Rodrigo Silvano.
This Privacy Policy complies with the General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR), Portuguese Law no. 58/2019, and applicable European digital legislation, explaining how your personal data is collected, processed, and protected, as well as the statutory rights you may exercise at any time.
1. Data Controller
The data controller responsible for the personal data collected through rodrigosilvano.pt is:
- Name: Rodrigo Silvano
- Role: Automation Systems & Business AI Specialist (Independent Professional / Sole Trader)
- Tax ID (NIF): 275096688
- Professional Address / Jurisdiction: Rua Quinta do Pincho, Lote B8 R/C Direito, 6300-420, Guarda, Portugal
- Contact Email: info@rodrigosilvano.pt
- Official Website: https://rodrigosilvano.pt
2. Personal Data Collected and Methods of Collection
We collect only the data strictly necessary to answer your inquiries, deliver operational consulting, arrange meetings, or secure our platform:
- Contact & Project Scoping (Chat & Forms): Name, business email address, phone / WhatsApp number, and operational context voluntarily submitted in dialogue with our assistant or via email.
- Alignment Meeting Scheduling (Cal.com): Name, email, WhatsApp number, and meeting notes submitted via our embedded scheduling calendar.
- Technical Security & Audit Logs: To defend against abusive requests, prompt injection, and cyber threats, visitor IP addresses are instantly converted into an irreversible cryptographic hash (SHA-256) upon ingestion. Only technical request metadata (HTTP method, status code, timestamp) is logged.
- Browsing Session & Cookie Preferences: Ephemeral in-memory session tokens (
sessionStorage) for conversational continuity and persistent consent records. Performance analytics and marketing trackers are loaded strictly after your explicit consent. - Data Transmitted via Autonomous AI Agents: When contact information, project requirements, or company data are transmitted via autonomous AI agents, WebMCP protocols, or browser automation tools on behalf of a user, valid agency and lawful authority are presumed under the legal basis of taking pre-contractual steps at the request of the data subject (GDPR Art. 6(1)(b)).
3. Purposes and Legal Bases for Processing (GDPR Art. 6)
Every data processing activity is supported by an explicit legal ground:
| Processing Purpose | Data Categories | Legal Basis (GDPR) |
|---|---|---|
| Inquiry resolution & scoping | Name, email, WhatsApp, inquiry details | Pre-contractual steps at data subject's request (Art. 6(1)(b)). |
| Meeting booking & calendar coordination | Name, email, WhatsApp, time slot | Pre-contractual steps at data subject's request (Art. 6(1)(b)). |
| Formal quotes and contracts | Contact data & technical specifications | Pre-contractual and contractual performance (Art. 6(1)(b)). |
| Invoicing & tax compliance | Name, Tax ID, address, billing data | Legal obligation compliance (Art. 6(1)(c)). |
| System security & audit trails | Cryptographic IP hash (SHA-256), request logs | Legitimate interest in operational resilience (Art. 6(1)(f)). |
| Web analytics (GA4, Clarity) | Aggregated usage metrics, page views | Freely given, revocable consent (Art. 6(1)(a)). |
| Conversion and ad measurement (Meta Pixel) | On-site conversion interactions | Freely given, revocable consent (Art. 6(1)(a)). |
4. AI Transparency & EU AI Act Compliance
Pursuant to the EU Artificial Intelligence Act (Regulation (EU) 2024/1689 — EU AI Act) and GDPR Article 22:
- Clear Interaction Notice: The assistant on this website is an artificial intelligence conversational agent engineered for preliminary qualification and operational guidance.
- Human Oversight: The AI assistant does not execute automated decisions producing legal effects or significantly affecting you. All project estimates are exploratory; binding proposals are exclusively reviewed, validated, and signed by Rodrigo Silvano.
- Zero Training on Your Proprietary Data: Natural language processing is handled through secure enterprise APIs with infrastructure hosted within the European Union. Your messages and project specifications are never used to train third-party public foundational AI models.
5. Third-Party Processors & International Transfers
Your data is never sold or rented to third parties. We rely exclusively on audited technical processors complying with GDPR standards:
- Hosting & Infrastructure: Cloud data centers located within the European Union (EU).
- AI Processing: Enterprise language model infrastructure hosted within the European Union, adhering to contractual confidentiality and zero training retention.
- Calendar Infrastructure: Cal.com, Inc. for appointment synchronization.
- Analytics & Marketing (Subject to Consent): Google LLC (Google Analytics), Microsoft Corporation (Clarity), and Meta Platforms, Inc. (Meta Pixel).
Any incidental transfer outside the EEA is strictly governed by the EU-US Data Privacy Framework and European Commission Standard Contractual Clauses (SCCs).
6. Retention Periods
Personal data is stored solely for the duration required to achieve its stated collection purpose:
- Exploratory inquiries & chat sessions: Up to 12 months after the last interaction, unless an active contract is executed or deletion is requested earlier.
- Contractual, tax, and invoicing records: 10 years pursuant to Portuguese commercial and tax legislation.
- Security audit logs: 90 days rolling retention.
- Cookie Preferences: Stored for a maximum of 180 days (6 months).
7. Your Statutory Rights
Under the GDPR, you hold the right to:
- Right of Access: Obtain confirmation and copies of your personal data.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure ("Right to be Forgotten"): Request data deletion when no longer needed or upon consent withdrawal.
- Right to Restriction: Request temporary restriction of processing in statutory scenarios.
- Right to Object: Object to processing grounded in legitimate interest.
- Right to Data Portability: Receive your data in a structured, machine-readable format.
- Right to Withdraw Consent: Withdraw cookie or marketing consent at any time without retroactive impact.
To exercise your rights, please submit a written request to: info@rodrigosilvano.pt.
You also have the statutory right to lodge a complaint directly with the Portuguese National Supervisory Authority:
- Comissão Nacional de Proteção de Dados (CNPD)
- Address: Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, Portugal
- Website: www.cnpd.pt
For any consumer-related complaint or dispute, you may also access the official Portuguese Online Complaints Book (Livro de Reclamações Eletrónico) pursuant to Decree-Law no. 156/2005 and Decree-Law no. 74/2017.
8. Updates to This Policy
This Privacy Policy may be updated periodically to reflect regulatory adjustments or infrastructural enhancements. The date of the most recent revision will always be displayed at the top of this page.
