Política de Privacidade

The protection of your privacy is fundamental to us. This Privacy Policy explains how we collect, use and protect your personal data in accordance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and the applicable Portuguese legislation.

1. Identification of the Data Controller

guito is operated by:

Luar Quieto — Unipessoal Lda NIPC: 518 823 830 Email: support@guito.pt Website: guito.pt

Contact for Proteção de Dados Matters: Email: support@guito.pt (Subject: "Proteção de Dados")

2. Data We Collect

We may collect the following categories of personal data:

2.1. Registration and Identification Data

• Full name;
• Email address;
• Password (stored in encrypted form);
• Account creation date.

2.2. Financial Data (provided voluntarily)

• Information about financial assets (shares, funds, certificates, etc.);
• Information about bank accounts (via Open Banking — read-only);
• Financial transactions and movements;
• Investment portfolio data;
• Asset information (property, vehicles, etc.);
• Information about liabilities (credit facilities, loans).

Important note: guito does not store banking credentials. The connection to bank accounts is made through certified PSD2-compliant providers, which use secure and encrypted connections.

2.3. Usage and Technical Data

• IP address;
• Browser and device type;
• Operating system;
• Pages visited and features used;
• Date and time of access;
• Performance data and technical errors.

2.4. Communications Data

• Messages sent through customer support;
• Interactions with the artificial intelligence feature;
• Feedback and suggestions submitted.

2.5. User Preferences

• Interface and display preferences;
• Privacy preferences and consents;
• Notification settings.

3. Legal Basis for Data Processing

We process your personal data on the basis of the following legal grounds set out in the GDPR:

Purpose of Processing	Legal Basis (GDPR)	Article
Creation and management of a user account	Performance of a contract	Art. 6.º n.º 1 b)
Provision of guito's services	Performance of a contract	Art. 6.º n.º 1 b)
Payment processing (where applicable)	Performance of a contract	Art. 6.º n.º 1 b)
Web analytics and service improvement	Consent	Art. 6.º n.º 1 a)
Marketing communications (where applicable)	Consent	Art. 6.º n.º 1 a)
Fraud prevention and security	Legitimate interest	Art. 6.º n.º 1 f)
Responding to support requests	Legitimate interest	Art. 6.º n.º 1 f)
Compliance with legal obligations	Compliance with a legal obligation	Art. 6.º n.º 1 c)

4. How We Use the Data

We use the data collected to:

4.1. Provision of the Services

• Enable the creation and management of your account;
• Provide financial and investment tracking features;
• Process connections to bank accounts (Open Banking);
• Calculate tax and financial simulations;
• Provide artificial intelligence assistance;
• Synchronise data across devices.

4.2. Communication with Users

• Respond to support requests;
• Send important notifications about the account or the service;
• Inform you of changes to the Terms or Privacy Policy;
• Send marketing communications (only with prior consent).

4.3. Improvement and Development

• Analyse usage patterns to improve the service;
• Develop new features;
• Identify and correct technical errors;
• Carry out testing and optimisation.

4.4. Security and Compliance

• Prevent fraud and abuse;
• Protect the security of users and the service;
• Comply with legal and regulatory obligations;
• Respond to requests from competent authorities.

5. Sharing Data with Third Parties

We do not sell, rent or share your personal data with third parties for marketing purposes without your explicit consent.

We may share data with service providers acting on our behalf (processors), described by category in section 5.1, and, where legally required, with competent public authorities.

Our service providers only process the data strictly necessary to provide their respective services and are contractually prohibited from:

• Using your data for their own purposes;
• Sharing your data with third parties;
• Retaining your data beyond the period necessary for the service.

5.1. Service Providers (GDPR Processors)

We rely on providers that process data on our behalf, subject to contractual data protection obligations, in the following categories:

• Infrastructure, hosting and data storage;
• Artificial intelligence features (assistant, transaction categorisation and document extraction);
• Connection to bank accounts (Open Banking / PSD2);
• Payment processing;
• Email communications and technical service monitoring;
• Invoicing and compliance with tax obligations;
• Usage analytics and advertising (only with your consent).

Some of these providers are located outside the European Economic Area; in those cases, transfers are carried out under the safeguards described in section 6.

5.2. Legal Obligations

We may disclose personal data where:

• Required by law or regulation;
• Requested by competent judicial or administrative authorities;
• Necessary to protect our legal rights;
• Essential to prevent serious harm to the safety of individuals.

5.3. Transfer in the Event of a Commercial Transaction

In the event of a merger, acquisition, sale of assets or restructuring, personal data may be transferred, and the acquirer will be required to comply with this Privacy Policy.

6. International Data Transfers

Our database is hosted on servers located in the European Union (Paris, France).

Some of our processors are established outside the European Economic Area, including in the United States of America. In those cases, transfers are covered by the safeguards set out in those providers' data processing agreements, namely the Standard Contractual Clauses approved by the European Commission (Decisão de Execução (UE) 2021/914) and, where the provider is certified, the adequacy decision under the EU-US Data Privacy Framework.

You may request further information about these safeguards by contacting support@guito.pt.

7. Cookies and Local Storage

7.1. Strictly Necessary Cookies

We use strictly necessary cookies for essential application features, including:

• User authentication and session management (session cookies);
• Security preferences and fraud protection;
• Technical features required for the application to function.

Legal basis: Legitimate interest (provision of the contracted service) These cookies are essential and do not require prior consent.

7.2. Local Storage

We use Local Storage to temporarily store information on the user's device:

• Interface and display preferences;
• Temporary application states;
• Privacy and consent preferences;
• Cached data for better performance.

7.3. Cookies and Web Analytics (Optional — Require Consent)

With your explicit consent, we use usage analytics tools to understand how to improve our service:

• They may use first-party cookies and local storage on the guito.pt domain;
• They collect usage data that may be associated with your account while you remain authenticated;
• They are not used for tracking across distinct websites.

You may choose to disable these analytics at any time through the "Manage cookies" option, available in the site footer, without affecting the operation of the service.

Legal basis: Consent (GDPR Art. 6.º n.º 1 a)

7.4. Advertising and Conversion Tracking

With your explicit consent, we may use advertising conversion tracking technologies (Google Ads and Meta Pixel) to measure the effectiveness of our campaigns. This data is collected only with your prior consent and can be disabled at any time in the privacy settings.

When consent is granted, pseudonymised identifiers (such as the email address in encrypted/hashed form) may be shared with these advertising platforms for conversion attribution and the creation of lookalike audiences. This data is transmitted in encrypted form (SHA-256) and does not allow direct reading of the original information.

With your marketing consent, these technologies may use cookies and identifiers to measure conversions. Without that consent, they are not activated.

8. Data Retention

We retain your personal data only for the period necessary for the purposes for which it was collected, in accordance with the applicable legal obligations:

Data Category	Retention Period	Basis
Active account data	While the account is active	Performance of a contract
Data following an account deletion request	Deleted after a short grace period to allow the request to be reversed	Reversibility of the request
Documents and records with tax relevance	Period required by law (generally 10 years)	Compliance with tax obligations
Documents uploaded for import (statements, invoices, brokerage files)	Automatically deleted approximately 30 days after upload	Data minimisation
Data subject to consent (analytics, advertising)	Until consent is withdrawn or in accordance with the respective providers' periods	Consent
Support communications	While necessary to resolve the request and comply with legal obligations	Legitimate interest
Privacy preferences	Kept locally on the device	N/A

After the periods indicated, the data is deleted securely and irreversibly, or anonymised for statistical analysis.

9. Rights of Data Subjects

In accordance with the GDPR, you have the following rights in relation to your personal data:

9.1. Right of Access (Art. 15.º)

You may request confirmation as to whether we process your data and obtain a copy of it.

9.2. Right to Rectification (Art. 16.º)

You may request the correction of inaccurate or incomplete data.

9.3. Right to Erasure — "Right to Be Forgotten" (Art. 17.º)

You may request the deletion of your data where:

• It is no longer necessary for the original purposes;
• You withdraw consent and there is no other legal basis;
• You object to the processing and there are no overriding legitimate interests;
• The data has been processed unlawfully.

9.4. Right to Restriction of Processing (Art. 18.º)

You may request the temporary restriction of processing in certain circumstances.

9.5. Right to Data Portability (Art. 20.º)

You may request to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller, by contacting us at support@guito.pt.

9.6. Right to Object (Art. 21.º)

You may object to the processing of your data based on legitimate interest, including for direct marketing purposes.

9.7. Right to Withdraw Consent

Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out previously.

9.8. Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority.

9.9. How to Exercise Your Rights

To exercise any of the rights above, you may:

• Email: support@guito.pt (Subject: "Direitos RGPD")
• Application Settings: Some features (account deletion) are available directly within the application

We will respond to your request within 1 month (extendable up to 3 months in complex cases).

10. Managing Your Privacy Preferences

10.1. Web Analytics Preferences

You may manage your analytics preferences at any time:

• Through the "Manage cookies" option, available in the site footer;
• By refusing or adjusting consent in the cookie banner;
• By contacting us at support@guito.pt.

The withdrawal of consent does not affect the lawfulness of the processing carried out previously and does not impair the operation of the service.

10.2. Clearing Local Data

To completely remove the data stored locally on your device:

Cookies:

• Clear the site's cookies in your browser settings (Chrome, Firefox, Safari, etc.).

Local Storage:

• Clear the site's data in your browser settings;
• Or use private/incognito browsing mode.

10.3. Notifications and Communications

You may manage your notification preferences in the application settings or through the unsubscribe links included in emails.

11. Data Security

We adopt appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including:

11.1. Technical Measures

• Data encryption in transit (HTTPS/TLS) and at rest;
• Passwords stored securely through strong hashing algorithms;
• Automatic backups managed by our infrastructure provider;
• Database-level access control (Row Level Security), ensuring each user can only access their own data;
• Automated vulnerability scanning of software dependencies, with regular updates to remediate known vulnerabilities.

11.2. Organisational Measures

• Restricted data access — access is limited to what is strictly necessary to operate the service (resolving reported issues, investigating incidents or maintaining the systems) and is logged;
• Processors bound by data processing agreements that include confidentiality obligations;
• Data minimisation — we collect and retain only the data necessary for the purposes described in this Policy.

11.3. Certified Providers

Our main service providers maintain security certifications relevant to the respective services provided, including international information security management standards and security controls.

11.4. Protection of Financial Data

Your financial data benefits from various protection measures:

Encryption: Data is transmitted through encrypted connections (HTTPS/TLS) and stored on infrastructure with disk-level encryption. Access credentials for banks and brokerages are additionally encrypted in the database.

Data separation: Your identification information (name and email) is stored separately from your financial data. Financial data is linked only through internal identifiers, limiting exposure in the event of an incident.

Access controls: We implement database-level security controls that ensure each user can only access their own data through the application. All access to the systems is controlled and logged.

Sensitive data: Information such as IBANs is not stored in full — we keep only the first four and last four characters for identification.

11.5. Data Breach Notification

In the event of a personal data breach:

• We will notify the National Data Protection Commission (CNPD) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to your rights and freedoms;
• Where the breach is likely to result in a high risk to your rights and freedoms, we will notify the affected users, without undue delay, by email to the registered address.

12. Protection of Minors

guito is intended for users aged 16 years or older and does not intentionally collect personal data from minors under 16 years of age.

If you use guito, you are at least 16 years of age, or you have authorisation from a holder of parental responsibility.

If you become aware or suspect that we have collected data from a minor under 16 years of age without appropriate consent, please contact us at support@guito.pt. We will proceed to delete that data, except where the law requires its retention.

13. Automated Decision-Making and Profiling

guito does not make automated decisions that produce legal effects or significantly affect the user, based solely on the automated processing of data (GDPR Art. 22.º).

The artificial intelligence feature may:

• Suggest transaction categorisations;
• Provide insights into financial habits;
• Assist with data entry.

The user may review, correct or replace these suggestions at any time. We do not make automated decisions regarding:

• The granting or refusal of services;
• Contractual terms;
• Credit or financial risk assessment.

14. Artificial Intelligence Feature

guito provides an artificial intelligence (AI) feature to support and interact with users. This feature is provided through a third-party artificial intelligence provider, subject to contractual data protection obligations.

14.1. Data Sent for AI Processing

The messages and commands sent by the user to the AI may, voluntarily, contain:

• Information about financial transactions;
• Questions about financial management;
• Personal data provided by the user.

14.2. Intelligent Transaction Import

guito offers an automatic transaction import feature powered by artificial intelligence, which allows:

• Uploading financial documents (bank statements, invoices);
• Automatic extraction of transaction information;
• Intelligent categorisation of movements.

During this process:

• The documents are temporarily processed by the AI;
• The extracted data remains under the user's control;
• The original documents are not stored permanently (unless the user chooses to save them);
• The accuracy of the extraction must always be verified by the user.

14.3. Processing and Retention

This data is processed in accordance with this Privacy Policy and the terms of service of our artificial intelligence provider.

The processing of data by the AI feature is subject to strict contractual agreements with our providers, which include:

• Standard Contractual Clauses approved by the European Commission for international transfers;
• Commitments not to use the data for training AI models;
• Limited retention periods in accordance with our data processing agreements.

When using the AI feature, the user may choose to:

• Avoid including personally identifiable information in their interactions;
• Use generic descriptions instead of specific values.

14.4. Recommendations

We recommend that the user:

• Avoid sending sensitive data or unnecessary personally identifiable information;
• Be generic in questions where possible;
• Carefully review the information before sending it to the AI.

The history of your conversations with the assistant is stored by us, at guito, so that you can consult it later. The artificial intelligence provider processes the messages only to generate the response and does not use them to train its models.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, data processing practices or legal obligations.

Changes are published on this page, with the revision date updated at the end. We encourage you to review it periodically.

For material changes that affect your rights or how we process your data, we will notify registered users by email, with reasonable advance notice, before the change takes effect. Where the law requires it, we will ask for your consent.

Continued use of guito after the changes take effect implies acceptance of the revised Policy.

16. Supervisory Authority — Right to Complain

You have the right to lodge a complaint with the supervisory authority competent in matters of personal data protection:

Comissão Nacional de Proteção de Dados (CNPD) Website: www.cnpd.pt Email: geral@cnpd.pt Telephone: +351 213 928 400 Address: Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal Opening Hours: Monday to Friday, 09h30 — 12h30 | 14h00 — 17h00

You may also lodge a complaint with the supervisory authority of the EU country where you habitually reside or work, or where the alleged infringement occurred.

17. Contact and Privacy Questions

For any questions relating to this Privacy Policy, data protection or the exercise of your rights, please contact us at:

Email: support@guito.pt Suggested subject: "Privacidade e Proteção de Dados"

We will respond within a maximum of 1 month from receipt of the request.

18. Applicable Legislation

This Privacy Policy is governed by:

• Regulamento (UE) 2016/679 (General Data Protection Regulation — GDPR);
• Lei n.º 58/2019, de 8 de agosto (Personal Data Protection Law);
• Lei n.º 41/2004, de 18 de agosto (Privacy in Electronic Communications);
• Other applicable Portuguese and European legislation on data protection.