1. Introduction and Scope

This Privacy Policy ("Policy") explains what personal data Skillful Sardine - Unipessoal Lda. ("we," "us," "our," or "Company") collects when you use the Ligaro website (the "Website"), why we collect it, how long we keep it, and the rights you have over it.

Governing Law: This Policy is governed by and construed in accordance with the laws of Portugal, without regard to its conflict of law provisions.

2. Data Controller

The data controller responsible for your personal data is:

Skillful Sardine - Unipessoal Lda.
Email: legal@skillfulsardine.com

3. Information We Collect

3.1 Email Subscription (Waitlist)

When you subscribe to our waitlist, we collect the following information:

  • Name
  • Email address

Purpose: This information is collected solely to notify you about Ligaro's launch and product updates.

Double opt-in. We send you a confirmation link and you are not subscribed until you click it. If you never confirm, nothing is sent to you.

3.2 Website Analytics

We use Umami, a privacy-focused, open-source analytics tool hosted on our own infrastructure. Umami collects:

  • Page views (which pages are visited)
  • Referrer information (where visitors come from)
  • Browser and device type
  • Country, region, and city (derived from the IP address; the IP address itself is not stored)

Umami does not use cookies and does not store IP addresses. We cannot identify individual visitors from this data.

3.3 Server Request Logs

Our servers keep a log of requests made to the Website. This log records:

  • IP address
  • Browser user agent
  • The page requested, the response status, and how long the request took
  • The referring page, if any
  • Standard request headers (never cookies, never authorisation headers)

Purpose: Security. These logs allow us to investigate abuse, automated scraping, and attacks against the Website.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in keeping the Website secure and available.

An IP address is personal data under the GDPR, and we treat these logs accordingly, even though we never link them to a name.

3.4 Information We DO NOT Collect

We do not collect, store, or process any of the following:

  • Payment information
  • Device identifiers or advertising IDs
  • Cross-site tracking data

4. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process data under the following legal bases:

  • Consent (Article 6(1)(a) GDPR): When you subscribe to our waitlist, you provide explicit consent for us to process your personal data to send you product updates. You confirm your subscription by clicking a link we email to you, and you may withdraw that consent at any time by unsubscribing.
  • Legitimate Interests (Article 6(1)(f) GDPR): Server request logs, including the IP address. We have a legitimate interest in keeping the Website secure, available, and free of automated abuse.

5. Purpose and Use of Data

We use collected data exclusively for the following purposes:

  • Sending product launch notifications
  • Communicating product updates and news about Ligaro
  • Investigating abuse, automated scraping, and attacks against the Website

We will never use data for:

  • Unsolicited marketing or advertising
  • Selling or sharing data with third parties
  • Profiling or behavioral targeting
  • Any purpose not explicitly stated above

6. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with any third parties for marketing purposes.

Third-party services used:

  • Umami Analytics: Self-hosted analytics platform. Data is stored on our own servers and is not accessible to external parties.
  • Lettermint: Delivers our emails. They receive your email address and the content of the message so that it can be delivered. They do not use it for anything else.
  • Infrastructure Providers: Our hosting infrastructure may process data as part of providing services, but they have no independent right to use your data.

All personal data described in this Policy is stored on servers within the European Union and is not transferred outside the EU/EEA.

Legal Disclosure: We may disclose information if required by law, court order, or governmental authority, or to protect our legal rights, safety, or property.

7. Data Retention

Email Subscriptions: we keep your subscription details while you are subscribed. You may unsubscribe at any time using the link provided in our emails or by contacting us directly. If you unsubscribe, your subscription record is deleted immediately. A subscription request you never confirm is deleted automatically after seven days.

Emails We Send You: a record of each email we send you, including your address and the message itself, is kept for thirty days so we can look into a delivery problem you report. It is then deleted automatically.

Server request logs (including IP addresses): retained for a maximum of seven months, then deleted automatically. Residual copies in our backups are deleted within a further 90 days. You can ask us to delete data relating to you at any time (see Section 8).

8. Your Rights

The following rights are granted by the GDPR. We extend them to all visitors, regardless of location.

  • Right to Access: You have the right to access the personal data we hold about you.
  • Right to Rectification: You may request correction of inaccurate data.
  • Right to Erasure: You may request deletion of your personal data ("right to be forgotten").
  • Right to Restrict Processing: You may request limitation of how we use your data.
  • Right to Data Portability: You may request a copy of your data in a structured format.
  • Right to Object: You may object to data processing.
  • Right to Withdraw Consent: Where processing is based on your consent (the waitlist subscription), you may withdraw it at any time. Withdrawal does not affect processing that happened before it.
  • Right to Lodge a Complaint: You may complain to a data protection authority. Our supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), and you may also complain to the authority in your own country.

Providing personal data on this Website is always voluntary. It is never a statutory or contractual requirement. The only consequence of not providing it is that the related feature (the waitlist) cannot be provided.

We make no automated decisions about you and do not profile you (Article 22 GDPR).

To exercise your rights or ask questions, contact us at legal@skillfulsardine.com. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures to protect data integrity and prevent unauthorized access:

  • HTTPS encryption for all Website traffic
  • Content Security Policy (CSP) to prevent XSS attacks
  • Regular security updates and server hardening
  • Secure credential management

Limitation of Liability: While we strive to protect data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Children's Privacy

This Website is not directed at individuals under the age of 16. We do not knowingly collect data from children. If we become aware that a child under 16 has provided personal information, we will take steps to delete such data immediately.

11. Changes to This Privacy Policy

We may update this Policy when our data practices change. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically.

12. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your data, contact us at:

Email: legal@skillfulsardine.com

We will respond to all inquiries within 30 days.

13. Severability

If any provision of this Policy is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.