1. Who we are
In All Web Lda. — NIPC 516 432 100
Sede: Porto, Portugal
Email: [email protected]
finances.inallweb.com is a financial literacy educational platform operated by In All Web Lda. The company acts as data controller under the GDPR (Regulation (EU) 2016/679) and Law no. 58/2019.
2. Data collected
We only collect data strictly necessary to provide the educational service:
| Category | Data | Purpose |
|---|---|---|
| Account | Email, password (bcrypt hash), verification date | Authentication and session management |
| Profile | Locale, learning rank, score | Personalisation of the educational experience |
| Learning | Calculator state (goal, salary, etc.) — only if you save | Persist your progress across sessions |
| Technical | IP, user-agent, session (24h) | Security, abuse prevention |
3. Legal basis
Processing of your data is based on the following legal grounds under Art. 6 GDPR:
• Consent (lit. a) — newsletter, analytics, session recording.
• Contract performance (lit. b) — when you create an account, to provide the service.
• Legitimate interest (lit. f) — security and fraud prevention.
• Legal obligation (lit. c) — accounting and tax records.
4. Third parties
We use the third-party services listed below. Each has its own privacy policy which we recommend you read.
Zeptomail
Privacy policy- Purpose
- Transactional email
- Data
- Email + name
- Location
- EU
Sends verification and password reset emails.
Mautic
Privacy policy- Purpose
- Marketing automation
- Data
- Email + behaviour
- Location
- EU (self-hosted)
Self-hosted on IAW server. Tracker loads only after consent.
OpenReplay
Privacy policy- Purpose
- Session replay
- Data
- UI events + URLs
- Location
- EU (self-hosted)
Self-hosted. Financial inputs automatically masked. Loads only after consent.
Cloudflare
Privacy policy- Purpose
- CDN + DNS
- Data
- IP + HTTP headers
- Location
- Global (EU preferred)
Protects the site against DDoS attacks and speeds up loading.
6. Retention
• Leads without account: up to 24 months or until you unsubscribe.
• Active accounts: while active, +12 months after deletion.
• Tax data: 10 years (legal obligation).
• Session logs (OpenReplay): 30 days.
• Ephemeral tokens (verification, reset): expire in 24h / 1h respectively.
7. Your rights
You have the right to access, rectify, erase, restrict and object to processing, as well as data portability. To exercise any right, write to [email protected]. You may also lodge a complaint with the CNPD (www.cnpd.pt).
8. Contact
For any request related to your data:
In All Web Lda.
Email: [email protected]