Privacy

This is a private, by-invitation working space. Nothing you send us here is made public, sold, or handed to a third party. This page tells you plainly what we hold, why, for how long, and what you can ask us to do about it.

1 Who we are · who is responsible

“curator.consulting” is the trading name of a Portuguese-based, sole-operator practice that reads content closely against the advertising law of the market it will run in, the platforms it will run on, and the craft standards good copy has to earn. In the language of data-protection law, that practice is the responsible party (POPIA) / controller (GDPR) for the engagement information it holds in its own right — your intake and invoicing details. For the content you upload — which stays yours, and which you instruct us to review — we act only as an operator (POPIA) / processor (GDPR): we handle it on your documented instruction, for the review alone, and for no purpose of our own. Contact details are at the bottom of this page.

2 What we hold

Only what the review needs. In practice, that is:

• Intake details — the entity name, sector, contact name, role, email, phone, and address you enter on the intake form. If you gave us a registration or VAT number, that too. These become the signed record of the engagement.
• The content you upload — decks, images, videos, captions, scripts. It may itself contain personal information (of employees, competition entrants, testimonial contributors, and so on). You confirmed on the intake covenant that any such information carries a lawful basis on your side.
• The notes we produce — the survey findings, editorial magazine, calendar read, and any curator's comments. These are yours; they exist to hand back to you.
• Invoicing details — the sealed record of what was reviewed, when, and what was invoiced. Portuguese tax law (Decreto-Lei 28/2019) obliges us to keep this for ten years.
• Access records — a minimal, ephemeral log of when your private link opened your review, kept only so long as it takes us to close the review — and, where you have engaged zero-retention, to honour the 24-hour destruction window.

3 Why we hold it · the lawful basis

The intake details, content, and notes are held to perform the review contract you entered when you consumed your invite and submitted the intake form — POPIA §11(1)(b) · GDPR Art 6(1)(b). Personal information in the content you upload is processed under your authorising consent as given on Group 3 of the intake — POPIA §11(1)(a) · GDPR Art 6(1)(a). The invoicing record is retained to meet a legal obligation — Portuguese tax law · POPIA §11(1)(c) · GDPR Art 6(1)(c). We do not use your information for marketing, analytics, or profiling; we do not train any model on it.

4 How long we keep it

As short as the work honestly requires:

• Your content and our working copies — by default, only for as long as the engagement needs them, held on our own equipment so we can re-open or revise the work, and no longer; you may ask us to erase them sooner. Where you engage zero-retention, your content is instead held under encryption and cryptographically erased twenty-four hours after you open the finished review (the recognised method — NIST SP 800-88 Rev.1, Cryptographic Erase · GDPR Art 28(3)(g)): the erasure destroys the means to decrypt it, so what remains is unreadable. We do this in good faith and hand you a signed receipt of it — an honest attestation that the destruction was carried out, not a claim of mathematically provable erasure.
• The notes we produced for you — held with your working copies, on the same terms. You are free to save your own copies.
• The sealed receipt of the review — the attestation that a review was done, on this date, for this scope. This survives erasure. It contains no content.
• The invoicing record — retained for the ten-year period Portuguese tax law obliges. It carries the entity, invoice number, date, amount, and description, and no more.
• Access log lines — discarded on erasure.

5 Where it lives · sovereign, no cloud

The service is sovereign-local. Your project is held and worked on our own equipment in Portugal — it is not uploaded to any cloud, platform, marketplace, or generative-AI service. Public routes for this website are carried over a content-delivery network for transit only, which retains none of your review content. Zero-retention clients' content is held under encryption and is cryptographically erased when the review closes, in good faith.

6 Who else sees it

Nobody, as a rule. We do not sell, rent, syndicate, or trade personal information. We use no sub-processor that stores your content or works on it for us; the only third-party infrastructure is the content-delivery network described above, which carries transit and retains nothing of it. The exception is the narrow set of statutory disclosures that no business can decline — a court order, a lawful production notice from a regulator, a tax audit — and even then, we would supply only the minimum the order names. If we ever change how information is handled in a way that materially affects you, we would say so before the change takes effect.

7 Your rights

You have the standard rights over your own personal information under POPIA and GDPR:

• Access — ask for a copy of what we hold about you.
• Correction — ask us to correct anything wrong or incomplete.
• Deletion / restriction — ask us to delete or limit our use of your information — your right to erasure (GDPR Art 17 · POPIA §24). We keep working copies only as long as the engagement needs them, and honour an erasure request at any time; where you engage zero-retention, erasure is largely automatic once your review closes (§4).
• Objection — object to processing on a legitimate-interest basis. We do not process on that basis in the ordinary course; if we ever did, you could object.
• Withdraw consent — where processing rests on your consent (Group 3 of the intake), you can withdraw it at any time; that ends future processing, without affecting what was already lawful.
• Portability — receive your information in a usable form.

To exercise any of these, write to us at the address below. We will respond within a reasonable time — in any case, no later than the statutory maximum (POPIA: one month; GDPR: one month, extendable by a further two if the request is complex, with reasons).

8 Cookies · children

We do not set advertising or analytics cookies. The only browser storage this site uses is a small local record on your side of the client door (so it remembers whether you have seen the newest review). We do not knowingly collect personal information from children (under 18 under POPIA · under 16 under the GDPR); this is a business tool and is not directed at them.

9 How to reach us · how to complain

For any privacy question, correction, or request under this page, use our contact page — write from the email address on your engagement, so we can verify who is asking. If you are already engaged with us, you can also reply on your private-link workspace and we will pick it up there. If you are not satisfied with our response, you have the right to complain to a supervisory authority:

• South Africa — the Information Regulator, inforegulator.org.za.
• Portugal — the Comissão Nacional de Protecção de Dados (CNPD), cnpd.pt.
• Elsewhere in the EU / EEA — your local supervisory authority.

10 Changes to this page

If we materially change how information is handled, we will update this page and change the “last updated” date at the top. For a change that materially affects an open engagement, we would tell you directly on your link before the change took effect.