Privacy policy

Last updated: 26 October 2026.

Who is the controller

The data controller is GOTT – Soluções Tecnológicas, Lda., tax number (NIPC) 513362061, with registered office at Avenida da Boavista, n.º 3521, Sala 508, 4100-139 Porto, Portugal (“Gott Solutions”). Sibyla is a brand of Gott Solutions.

For any privacy matter, including exercising your rights, write to geral@sibyla.pt.

What data we process on the website

• Messages you send us. If you write to us, we process your name, your email address and what you tell us, in order to reply and, where relevant, prepare a proposal. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in replying to people who contact us.
• Technical server logs. As on any website, our hosting provider logs the IP address, date and time, the page requested and the browser, to keep the website secure and running. Legal basis: legitimate interest in the security of the website.
• Visit statistics, only if you accept. With your consent, we use Google Analytics 4 to see which pages are visited and where visits come from. Legal basis: your consent, which you can withdraw at any time under “Cookie preferences” in the footer.

The website does not load fonts, libraries or any other third-party resources: everything is served from sibyla.pt. Without your consent, no data leaves our hosting.

See the cookie policy

What data we process in the App

The Sibyla App is contracted by businesses. It holds two kinds of data, with different roles:

• User account data: name, work email, company, and the log of use and decisions (who decided what, and when). We are the controller of this data and process it to provide the contracted service, maintain security and keep the audit log. Legal basis: performance of the contract and legitimate interest in security.
• Customer documents and data: invoices, bank statements, contracts and other documents the customer puts into the App, including any personal data they contain. Here the customer is the controller. Gott Solutions processes them on the customer’s behalf, as a processor, under Article 28 of the GDPR and the data processing agreement that forms part of the contract, and does not use them for any other purpose.

The App uses automated systems, including artificial intelligence, to read and classify documents and to propose decisions. It does not take decisions with legal effects on individuals: it proposes, and a user at the customer decides.

Who we share data with

Only with those who help us provide the service, and under the conditions of the GDPR: the website hosting provider, the App’s infrastructure providers and, if you accept statistics, Google Ireland Limited. The list of the App’s sub-processors is given to each customer with the contract and is available on request. We do not sell personal data.

Transfers outside the European Union

Google may process data in the United States. That transfer is covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, to which Google LLC has signed up. If any App provider processes data outside the European Economic Area, this is stated in the list of sub-processors, together with the applicable safeguard.

How long we keep data

• Messages and sales contacts: up to two years after the last contact, if you do not become a customer.
• App accounts and customer data: for as long as the contract lasts and, afterwards, for the time needed to return or delete the data under the contract and to meet legal obligations, including tax obligations.
• Google Analytics statistics: 14 months.
• Technical server logs: the period set by the hosting provider for security purposes.

Your rights

You can ask for access to your data, its rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. Where the basis is consent, you can withdraw it at any time, without affecting what was done before. We reply within one month.

If your data is in a document that one of our customers put into the App, we pass your request on to that customer, who is the controller of that data.

You can also lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados): www.cnpd.pt

Security

We use encrypted connections, per-user access control and logging of actions in the App. If a data breach requires it, we notify the CNPD and the people affected within the legal deadlines.

Changes

If this policy changes, the date at the top changes too. Significant changes for App customers are communicated directly.