Privacy Policy

The data controller responsible for your personal data is Jaime Serro Lopes Ferreira, established in Portugal. You can contact us at tejo@tejo-ai.com for any privacy-related question.

TEJO is operated by Jaime Serro Lopes Ferreira as an individual sole trader (empresário em nome individual), NIF 258628022, established in Portugal — it is not a company.

Depending on how you use TEJO, we may collect:

• Account data — your name, email address, and the authentication method you use (email/password or Google sign-in).
• Property and valuation inputs — the details and photos you submit to obtain a Kimo valuation or that you save in your prediction history.
• Payment data — when you buy a paid product, payment is processed by Stripe. We receive confirmation of payment and limited billing metadata; we do not store full card numbers.
• Usage and device data — IP address, browser type, pages visited, and similar technical information, collected via cookies and server logs.
• Communications — the content of messages you send us, for example through the contact form or by email.

We process your personal data for the following purposes, each with a legal basis under the GDPR:

• To provide our products and your account — legal basis: performance of a contract.
• To process payments and manage subscriptions — legal basis: performance of a contract.
• To send service-related communications (e.g. confirmations, account notices) — legal basis: performance of a contract.
• To send optional marketing or product emails — legal basis: your consent, which you can withdraw at any time.
• To operate, secure, debug, and improve the website and products — legal basis: our legitimate interest in running a reliable service.
• To comply with legal obligations, such as tax and accounting rules — legal basis: legal obligation.

We do not sell your personal data. We share it only with service providers (processors) who help us run TEJO, and only as needed to deliver the service:

• Supabase — authentication and database hosting.
• Amazon Web Services (AWS) — server infrastructure for our prediction and data services.
• Vercel — hosting and delivery of the website.
• Stripe — payment processing.
• Google — Google sign-in (OAuth) and the Gemini AI service used to analyse property photos.
• Mapbox — maps and address look-up.
• Resend — delivery of transactional and notification emails.

Each provider processes data on our instructions under a data-processing agreement. We may also disclose data where required by law or to protect our rights.

Some of our providers may process data outside the European Economic Area (for example, in the United States). Where this happens, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We keep personal data only as long as necessary for the purposes described above. Account data is kept while your account is active and for a reasonable period afterwards. Payment and invoicing records are kept for as long as tax and accounting law requires. When data is no longer needed, we delete or anonymise it.

Under the GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — ask us to delete your data, including by deleting your account.
• Restriction and objection — limit or object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at tejo@tejo-ai.com. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) (https://www.cnpd.pt).

We use cookies and similar technologies. Strictly necessary cookies are used to run the site; other categories are used only with your consent. See our Cookie Policy for the full details and to manage your preferences.

We apply appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access. No system is perfectly secure, but we work to reduce risk and to respond promptly to any incident.

TEJO is not directed at children and is intended for users aged 18 or over. We do not knowingly collect data from children.

We may update this Privacy Policy from time to time. The 'Last updated' date above reflects the latest version. Material changes will be communicated through the website or by email.

For any question about this policy or about how we handle your data, contact us at tejo@tejo-ai.com.