Cookies

With your permission, we use Google Analytics cookies to measure visits and improve the site. Necessary cookies are always on. You can change your choice or withdraw consent anytime in the footer, under Cookie settings. Cookie Policy

Skip to content
PTEN
Get started

Privacy Policy

GDPR · Doutor AI

Last updated: October 11, 2026 · Version 2026-10-11

This is the English translation of the Portuguese Política de Privacidade. If the two versions differ, the Portuguese version prevails.

1. Data controller

Doutor AI (doutorai.pt) is operated by Miguel Diamond, a sole trader (empresário em nome individual), tax identification number (NIF) 245528598, with professional address at Avenida da República 2470, Vila Nova de Gaia, Portugal. If you have any questions about your data, contact info@doutorai.pt or use the contact page (subject "GDPR request about my data").

2. What data we collect

We only collect what is necessary, depending on what you do on the site:

  • Browsing: your IP address, your browser and the page requested are kept in the server access logs. We do not use advertising.
  • Visit statistics (only if you accept): if you accept the statistics cookies, Google Analytics collects the pages you visit and their titles, the page or site you came from, your device type, operating system, browser and language, your approximate location (country, region and city, derived from your IP address, which Google Analytics does not store) and some interactions with the pages (for example, how far you scrolled and the links to other sites you clicked), and a few steps on the site: creating an account with email, sending the contact form, going to payment (with the plan or pack name, not the amount) and sending your first message to the assistant each time you open or reload the site (without its text), linked to a random identifier stored in the _ga and _ga_ZHPYDJ35X5 cookies. We do not send your email, your account identifier or what you write to Google Analytics.
  • Account: email, password (we only store a cryptographic hash, never the password), creation date, industry, the version of the Terms you accepted, with the date of acceptance, and, if you turn on two-step verification, its secret.
  • Sign-in with Google: if you sign in with Google, we only receive your email and name. We only use the email, verified by Google.
  • Business profile: the business name, the industry, the goals, your level of experience with AI and the preferences you indicate, and the photo and the logo, if you upload them.
  • Use of the service: favorites, credit and message counters, an indicator of abusive use of the assistant, and the Pro plan and its validity.
  • AI assistant: the messages you write, the business profile and the prompt you are viewing are sent to the Anthropic AI model that generates each answer. We store on our server the messages you send to the assistant and the answers you receive, with the date and the length of each request; the IP address of each request is stored separately, for 12 months. We use these conversations to support you, fix errors, prevent abuse and improve the assistant, and our team can read them for those purposes. They are kept while the account exists and are deleted when the account is deleted. Do not write in the assistant any data you do not want to share with us, such as passwords or health data.
  • Payments: email, plan or pack, amounts, dates and payment status, the Stripe customer ID and, if you provide them, your tax number (NIF) and address for the invoice; for pack purchases, the date, time and IP address at which you confirmed immediate delivery. Payments are processed by Stripe: we do not store your card details.
  • Newsletter and notices: your email and the form where you signed up.
  • Contact requests: name, email, company, company size, interest or subject and the message you write.
  • Emails you send us: the content and your contact details.

3. Legal basis and purposes (GDPR)

We process your data to give you access to the service, the assistant and payments and to answer your requests (performance of the contract and pre-contractual steps), to comply with legal invoicing and tax obligations (legal obligation), to ensure security, prevent abuse and fraud, manage contacts with customers and prospects and improve the product with aggregated data (legitimate interest, which you can object to) and, only with your consent, to send you the newsletter and notices (consent, which you can withdraw whenever you want).

We use the conversations with the assistant to support you, fix errors, prevent abuse and improve the assistant (legitimate interest, which you can object to).

Google Analytics visit statistics are only collected with your consent (the statistics cookies, which you accept or reject in the cookie notice). You can withdraw it at any time under Cookie settings, in the footer of every page, without affecting the processing carried out before.

We do not make automated decisions with legal effects about you. The only automatic mechanism limits the assistant when it detects abusive use; if that happens to you, you can ask for a person to review the case.

4. Who we share it with

We use processors that handle data on our behalf:

  • Stripe (payments; Stripe Payments Europe, Limited, Ireland);
  • Anthropic (the Claude AI model that generates the assistant's answers; Anthropic Ireland, Limited, Ireland, which processes this data on our behalf under the data processing addendum that forms part of Anthropic's Commercial Terms; under those terms and Anthropic's data retention policy, the data sent and the answers are not used to train its models and are deleted within 30 days, unless Anthropic needs to keep them to enforce its usage policy (up to 2 years if its automated safety systems flag them) or the law requires them to be kept);
  • Google (sign-in with Google and backups on Google Drive, which are encrypted and whose key only we hold);
  • Google Analytics (statistics about visits to the site, only if you accept the statistics cookies; Google Ireland Limited, Ireland, which processes this data on our behalf under the Google Data Processing Terms that apply to Google Analytics);
  • Zoho (sending emails, from data centers in the European Union);
  • OVH (hosting of our servers, in France);
  • Moloni (invoicing software certified by the Portuguese Tax Authority, in which our system issues the invoices).

Customer and prospect contact management (CRM) runs on software installed on our own server, with no sharing with third parties. We also disclose data to the authorities when the law requires it. We never sell your data.

5. Transfers outside the European Economic Area

Some of these processors may process data outside the European Economic Area. For each one, we state where the data goes and the safeguards for the transfer:

  • Anthropic, where the data is kept: we contract with Anthropic Ireland, Limited, in Ireland, but the data we send it is stored, and the answers are generated, on infrastructure in the United States, using the cloud providers on Anthropic's subprocessor list (Google Cloud Platform, Amazon Web Services and Microsoft Azure);
  • Anthropic, access by other group entities: Anthropic states that Anthropic, PBC and other group entities may have access to its customers' data, and that it may process that data for internal processes, such as safety reviews, product support or incident response, in the countries where those entities are located. Outside the European Economic Area, those countries are the United States, the United Kingdom, Canada, Switzerland, Japan, South Korea and Australia. Of these, the United Kingdom, Switzerland, Canada (commercial organizations), Japan and South Korea have an adequacy decision from the European Commission; the United States has one only for companies in the EU-US Data Privacy Framework, which Anthropic is not part of, and Australia has none;
  • Anthropic, safeguards for the United States and Australia: Anthropic's data processing addendum requires it to enter into a contract with each entity it engages to process the data we send to Anthropic, imposing data protection obligations substantially as protective as those of that addendum, to the extent applicable. It also requires Anthropic to remain liable to us for those entities' acts and omissions on the same terms as for its own. The addendum does not state which transfer instrument applies to data going to these two countries;
  • Stripe (transfers to Stripe, LLC, United States): EU-US Data Privacy Framework, under which Stripe, LLC is certified;
  • Google (United States): EU-US Data Privacy Framework, under which Google LLC is certified;
  • Google Analytics (transfers from Google Ireland Limited to Google LLC, United States): EU-US Data Privacy Framework, under which Google LLC is certified, and, where Google does not rely on it, the Standard Contractual Clauses provided for in the Google Data Processing Terms;
  • Zoho (Zoho group companies in the United States and in other countries outside the European Economic Area): Standard Contractual Clauses, provided for in the agreement between the group companies.

You can ask for a copy of these safeguards by email to info@doutorai.pt.

6. How long we keep it

We keep account data while your account is active. Invoicing records are kept for the period required by law. When you ask for deletion, we delete your data, except what the law requires us to keep. Specifically:

  • Account and profile: while the account is active; after you ask for deletion, we delete it within 30 days.
  • Invoices and payment records: 10 years, as tax law requires.
  • Server access logs: 14 days.
  • Assistant security log: 12 months.
  • Assistant usage counters: 13 months.
  • Contact requests: 24 months.
  • Newsletter and notices: until you unsubscribe; after that we only keep the email on a suppression list, so that we do not send you the newsletter or notices again.
  • Conversations with the assistant: on our server, while the account exists; they are deleted when the account is deleted.
  • Copy of the conversation in your browser: until you delete it.
  • Google Analytics statistics (only if you accept): data linked to the cookie identifier is kept in Google Analytics for up to 14 months (reports with aggregated totals, such as visits per month, do not depend on this period); the _ga and _ga_ZHPYDJ35X5 cookies last up to 13 months after your last visit and are removed from your browser when you withdraw your consent.
  • Your cookie choice: in your browser, for 6 months; after that we ask again.
  • Backups: up to 30 days (14 days on the website server; 30 days on our backup server and in the encrypted copy on Google Drive); deleted data disappears from the backups at the end of that period.

The copy in our contact management (CRM) follows the same periods.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, export (portability) and restrict the processing of your data, to object and to withdraw your consent at any time (contact info@doutorai.pt or use the contact page). We answer within one month. To protect your account, we may ask you to write from the account email or to confirm your identity in another way.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. If you live in another country, you can also complain to the data protection authority of that country.

8. Cookies and browser storage

We use cookies that are essential for the site to work (session and sign-in), which do not require consent. Only if you accept the statistics cookies do we also use the Google Analytics cookies (_ga and _ga_ZHPYDJ35X5), to measure visits; we do not use advertising cookies. You can accept, reject or withdraw your consent at any time under Cookie settings, in the footer of every page; when you withdraw it, the site stops sending data to Google Analytics and deletes those cookies from your browser. Your Saved items, a copy of the conversation with the assistant and some preferences are kept in your browser (local storage), and you can delete them whenever you want. On the payment page, Stripe uses its own cookies. The full list is in the Cookie Policy.

9. Security

Passwords are never stored as text (we only store a cryptographic hash, PBKDF2), the site uses HTTPS and access to data is restricted. The session uses a protected cookie (HttpOnly), you can turn on two-step verification, there are request limits against abuse and the backup kept on Google Drive is encrypted. If we detect an incident that affects you, we will inform you as required by law.

10. Minors

Doutor AI is not intended for people under 16, and purchases require you to be 18 (Terms and Conditions, section 3). If you know that someone under 16 has given us personal data, write to us and we will delete it.

11. Emails

We only send the newsletter and notices to people who ask for them, and each of those emails has an unsubscribe link. Account emails (purchase confirmations, invoices, security and password resets) are part of the service and do not depend on the newsletter.

12. Changes

If we update this policy, we will publish the new version on this page with the revised date. If the change is significant, we will let account holders know by email.