How Guito Labs, Unipessoal Lda processes your personal data when you use guito.
This Privacy Policy explains how Guito Labs, Unipessoal Lda ("guito", "we" or "us") processes your personal data when you use the guito.pt and guito.app websites and the guito mobile apps (together, the "Service"), under Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and applicable Portuguese law.
Your name and email address are required to create an account; without them we cannot provide the Service. Any other data depends on the features you choose to use.
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Creating and managing your account and providing the Service, including connections to institutions, document import, calculations and the AI assistant | Performance of a contract (point (b)) |
| Processing subscriptions and payments | Performance of a contract (point (b)) |
| Sending information about your account and the Service, including changes to these documents | Performance of a contract (point (b)) |
| Sending notifications to your phone about your account and your data, if you allow them | Performance of a contract (point (b)) |
| Making your data available to an external AI assistant you choose to connect (section 9.2) | Performance of a contract, at your request (point (b)) |
| Issuing invoices and complying with other legal obligations | Legal obligation (point (c)) |
| Protecting the Service and accounts, preventing fraud and abuse and diagnosing errors | Legitimate interest in keeping the Service secure and working (point (f)) |
| Analysing how the Service is used, linked to your account, to improve it | Legitimate interest in improving the Service (point (f)) |
| Responding to support requests | Legitimate interest in responding to those who contact us (point (f)) |
| Sending news and offers about guito by email to people who have or had a paid plan | Legitimate interest in making the Service known to those who bought it (point (f)) |
| Sending news and offers about guito by email to people who never had a paid plan, if they ask for them | Consent (point (a)) |
| Analysing usage with cookies or on-device identifiers, and recording sessions (section 7.2) | Consent (point (a)) |
| Measuring and optimising our advertising campaigns and showing guito ads to people who have visited the website (section 7.3) | Consent (point (a)) |
In the emails we send, except those for creating an account, signing in without a password, recovering your password and changing your email address, and the notices of changes to your sign-in details, links go through the address links.guito.pt, which lets us know, linked to your account, which link you opened and the type of device, so that we can measure how useful the emails are. We do not use pixels to find out whether an email was opened.
Notifications on your phone are only sent if you allow them on the phone itself. They never show amounts or the name of a bank or broker. You can turn them off in your phone's settings or, one by one, in Settings, Notifications, in the app.
We use processors that handle data on our behalf, only on our instructions and bound by contract to protect it, in the following categories:
We also disclose data:
We do not sell your personal data.
The Service's database is hosted in the European Union. Some processors handle data outside the European Economic Area, including in the United States. Those transfers rely on a European Commission adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified, or on the standard contractual clauses approved by the European Commission. You may request a copy of these safeguards at support@guito.app.
| Data | Period |
|---|---|
| Account and financial data | While the account exists. After a deletion request, deleted after 7 days, during which you may cancel the request |
| Documents uploaded for import | About 30 days after upload |
| Your data export file | 3 days after it is generated |
| Invoices and records relevant for tax purposes | 10 years, as required by law |
| Support requests | As long as needed to resolve them and to comply with legal obligations |
| Session recordings | 30 days (usage analytics tool) or 90 days (technical monitoring tool) |
| Device notification token | Until you sign out on that device, until the notification service reports the device no longer receives them (for example, after you uninstall the app), or 200 days after the app last renewed it |
| Usage analytics and advertising data | According to the respective providers' retention periods. Data that depends on consent stops being collected when you withdraw it |
After these periods, the data is deleted or anonymised.
We use strictly necessary cookies and local storage to sign you in and keep you signed in, protect your account, save your preferences and record your consent choices. They are exempt from consent (Article 5(2) of Portuguese Law No. 41/2004 of 18 August).
With your consent, we use usage analytics tools which, on the website, store cookies and local storage data on the guito.pt and guito.app domains and, in the mobile apps, an installation identifier. The data collected is linked to your account while you are signed in and is not used to follow you across other websites or apps.
With that consent, we may also record sessions, that is, reconstructions of the screen structure, clicks or taps and navigation, solely to diagnose errors and usability problems. Recordings are linked to your account. We apply measures to hide amounts, balances, names, transaction descriptions, IBANs and data entered in fields before collecting recordings. In the mobile apps, these measures cover all text and images. On the website, hiding may be incomplete: a name or an amount written in the middle of a text, or search terms and filters in a page address, may remain visible.
With your advertising consent, we use Google's (Google Ads) and Meta's (Meta Pixel) advertising technologies to measure and optimise our campaigns and to show guito ads to people who have visited the website. These technologies store cookies on your device. When you sign up or subscribe to a plan, Meta also receives your email address, name and account identifier in hashed (pseudonymised) form, your IP address and your browser type, to attribute that action to an ad. Google and Meta also process this data for their own purposes, as controllers, under their respective privacy policies.
| Category | Who has access | Maximum duration |
|---|---|---|
| Strictly necessary | guito | 400 days |
| Usage analytics | guito and the analytics provider, on our behalf | 1 year |
| Advertising | Google and Meta | 13 months |
You may give or withdraw consent at any time, without affecting how the Service works: on the website, under "Manage cookies" in the footer; in the mobile apps, under Profile, Settings, Privacy.
Under Articles 15 to 22 GDPR, you have the right to:
Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. You may object to receiving news and offers by email, or withdraw your consent to them, without giving any reason, through the link in every email or in your notification settings.
You can export your data and delete your account directly in the app (instructions at docs.guito.app/en/account/delete-account). For any other request, or if you cannot sign in, write to support@guito.app from your account's email address. We respond within one month, extendable by two further months for complex requests, in which case we will tell you.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place.
The assistant, transaction categorisation and document import use AI models from providers acting as our processors. These providers process the data only to generate the response and do not use it to train their models. Your conversation history with the assistant is stored in your account. You can review and correct the AI's suggestions at any time.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
You may connect an external AI assistant of your choice (for example, Claude or ChatGPT) to your account. While the connection is active:
You may revoke the connection at any time in your account settings, which ends the access immediately. Revoking it does not delete the data the provider has already received; to have it deleted, contact that provider.
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest and restricted access to data. The mobile app lock with Face ID, Touch ID or other biometrics is verified by the device's operating system: guito receives only the result and does not process biometric data.
The Service is intended for people aged 16 or over. We do not knowingly collect data from children under 16. If you learn that this has happened, contact us at support@guito.app and we will delete that data.
We may change this Policy. The version in force is always on this page, with the date of its last revision. We notify registered users by email of significant changes before they take effect.
Last revision: October 14, 2026