Legal — Privacy policy
Last updated — 9 October 2026
This policy explains what personal data this website collects, why it is processed, how long it is kept and what rights you have over it. It is written to meet the information duty in Article 13 of the General Data Protection Regulation.
01
Who controls your data
Specus is operated by an individual. The person identified below is responsible for deciding how and why this website processes your personal data.
- Data controller
- Teresa Maria Santos Silva
- Trading name
- Specus
- Address
- 1º Impasse da Rua Frei Pedro da Guarda, n.º 45, 9300-066 Câmara de Lobos, Madeira, Portugal
- hello@specus.ai
For any question about this policy or about your data, write to hello@specus.ai.
02
What data is collected
This policy covers visits to this website, enquiries sent through its contact form and email sent to hello@specus.ai. A separate notice will describe any additional processing needed for a client engagement.
(a) Data you submit through the contact form
- Your name
- Your email address
- The engagement type you select
- The message you write
If you email us directly, we receive your email address, any name you provide, the message, its delivery metadata and any attachments you choose to send. Please send only information needed to explain your enquiry, and do not include passwords, identity documents or sensitive personal information.
(b) Technical data processed to deliver and protect the service
- IP address, requested URL and request time
- Browser and device information sent in HTTP headers, including preferred languages
- Connection, security and email-delivery information, such as delivery status, sender, recipient, subject and message identifier
Cloudflare processes connection and security data when serving the site and generates operational traffic statistics. The application does not keep a routine log of every page visit, install visitor analytics or record sessions. It does not write the contents of contact submissions to its operational logs or a contact database.
Using the contact form loads Cloudflare Turnstile. It processes IP address, TLS fingerprint, User-Agent, sitekey and origin signals to distinguish people from bots.
Language negotiation uses the browser’s preferred languages, without IP geolocation. A manual language choice stores only the selected language code in the session cookie described in the cookie policy. This serves the language you request and does not identify or profile you.
To limit abuse of the contact form, the server stores a SHA-256 hash of the client IP address and a request count for up to ten minutes. This is pseudonymous personal data, not anonymous data. The counter contains no name, email address or message text and is shared only between the site’s application instances.
03
Why it is processed, and on what legal basis
Data Purpose Legal basis Enquiries from prospective individual clients To answer a request for services and take steps you request before entering a contract. Pre-contractual steps — Art. 6(1)(b). Other enquiries and business representatives’ contact details To answer your message and communicate with the organisation you represent. Legitimate interest — Art. 6(1)(f). Handling incoming correspondence and business enquiries. Enquiries that become client work To establish and administer the engagement. Contract — Art. 6(1)(b), where you are the contracting person; legitimate interest — Art. 6(1)(f), for an organisation’s representatives. Technical data, Turnstile verification and abuse counter To deliver pages and email, keep the service available and investigate errors or abuse. Legitimate interest — Art. 6(1)(f). Reliable communications and protection against spam and attacks. Records required by law or a specific dispute To meet applicable record-keeping duties or establish, exercise or defend legal claims. Legal obligation — Art. 6(1)(c), including applicable Portuguese tax record-keeping rules; legitimate interest — Art. 6(1)(f), for legal claims. Sending an enquiry is voluntary and is not a statutory requirement. The form requires a name, a valid email address and a message so that we can understand and answer it; selecting an engagement type is optional. Without the required information, the form cannot send your request. Ordinary browsing still involves the technical processing described above.
04
How long it is kept
- Enquiries that do not become client work
- Messages and related contact details are deleted from the correspondence mailbox 12 months after the last interaction. The operator reviews and deletes expired correspondence; this is a mailbox procedure, not an automatic timer in the contact form.
- Enquiries that become client work
- Correspondence needed to establish or administer the engagement becomes part of the client record and is kept during the engagement. Afterwards, only documents required by an applicable record-keeping duty or a specific legal claim are retained. Unneeded enquiry copies follow the 12-month rule. The engagement notice identifies any additional records and retention periods.
- Tax records and disputes
- Where Portuguese tax rules require retention, the relevant invoices, registers and supporting documents are kept for the 10 subsequent calendar years under Article 52 of the VAT Code, with any special statutory starting dates that apply. An ordinary enquiry is not kept for ten years merely because it was sent. Documents subject to a specific dispute, investigation or preservation duty are restricted to that purpose and retained until the duty ends or the matter and any enforcement are finally resolved.
- Contact abuse counter
- Automatically expires no later than ten minutes after the first counted request. Further attempts do not restart that period. Redis persistence is disabled for this counter.
- Turnstile verification
- Tokens expire after 5 minutes and are single-use. The application keeps them only in memory for verification and does not store or log them.
- Origin operational logs
- Routine page-access logging is disabled. Technical application and proxy logs rotate by size: up to three files of 10 MB per container, with the oldest file removed on rotation. This is a size-based limit, not a promise of deletion after a fixed number of days. Contact names, email addresses and message bodies are excluded from application log messages.
- Cloudflare email event records
- Cloudflare retains email sending and routing event metadata for 31 days. These records can include the sender, recipient, subject, message identifier and delivery result. This period is separate from the correspondence retained in the receiving mailbox.
- Mailbox deletion and provider records
- Outlook.com may retain messages for up to 30 days after removal from Deleted Items, unless a legal retention duty applies. Cloudflare and Microsoft also determine retention for their own security and legal records using the service purpose, security risks and applicable legal duties described in their published privacy notices. We do not export an additional archive of website traffic logs.
05
Who else sees it
Specus does not sell your data or use your enquiry for marketing. Access is limited to the operator, people authorised to administer the site or answer enquiries, and the providers involved in hosting and email delivery:
- Hetzner Online GmbH — Germany
- Hosts the website application and its short-lived abuse counter on a server in Falkenstein, Germany. The application handles the contact form on this server; there is no separate hosted form platform.
- Cloudflare, Inc. — United States
- Provides DNS, the website’s delivery and security proxy, and Email Service for sending form messages and forwarding mail addressed to hello@specus.ai. It processes website request data and the message content and metadata needed for email delivery. Its Data Processing Addendum is incorporated into its Self-Serve Subscription Agreement for processing customer content.
- Microsoft — Outlook.com
- The receiving mailbox uses Microsoft’s consumer Outlook.com service to receive, store and manage correspondence. Microsoft Corporation and Microsoft Ireland Operations Limited are identified in its Privacy Statement for controller processing in the EEA. This mailbox is governed by that statement; it is not described here as an enterprise Microsoft 365 mailbox with an enterprise data processing agreement.
Providers may use authorised subcontractors and may also process information for their own service security and legal obligations, as described in their published notices. Data may be disclosed to a competent authority where required by law, or to legal advisers where necessary for a specific claim.
Cloudflare acts as a processor when protecting this site, and as a controller when improving Turnstile’s bot detection, as explained in its Turnstile Privacy Addendum.
06
Whether data leaves the EU
The origin server is in Germany. Hetzner states that data on its EU servers is processed within the EU and that support is provided within the EU. That hosting location does not mean that all website and email processing stays in the EU or the European Economic Area (EEA).
Cloudflare runs a global network and may process website traffic, security data and email outside the EEA, including in the United States. Its published Data Processing Addendum provides for EU–US Data Privacy Framework transfers to Cloudflare and for the European Commission’s Standard Contractual Clauses, with additional safeguards, for restricted transfers. The applicable countries and service-specific subcontractors are described in Cloudflare’s current subcontractor list.
Microsoft may process mailbox data in the EEA, the United States and other countries where it operates facilities. Its published list includes Australia, Brazil, Canada, Hong Kong, India, Japan, Korea, Malaysia, Singapore, South Africa and the United Kingdom. Its Privacy Statement describes EU–US Data Privacy Framework transfers to Microsoft Corporation and Standard Contractual Clauses or an applicable adequacy decision for other relevant transfers.
These safeguards concern transfers under Articles 45 and 46 of the GDPR. You can consult the providers’ published safeguards through the links below, or ask hello@specus.ai for information or a copy of the applicable safeguards, subject to necessary protection of confidential information.
07
Your rights over your data
The following rights apply subject to the conditions and exceptions in the GDPR. You do not need to be a client to make a request.
- Access — Art. 15
- Ask what data is held about you and receive a copy of it.
- Rectification — Art. 16
- Have inaccurate data corrected and incomplete data completed.
- Erasure — Art. 17
- Have your data deleted where there is no overriding reason to keep it.
- Restriction — Art. 18
- Ask for processing to be limited, for example while accuracy or an objection is assessed, where the Article 18 conditions apply.
- Portability — Art. 20
- Receive data you provided in a structured, commonly used, machine-readable format where processing is automated and based on your consent or a contract; request direct transfer where technically feasible.
- Objection — Art. 21
- Object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. We must stop unless we demonstrate compelling overriding grounds or need the data for legal claims. Objection to direct marketing is unconditional; Specus does not use enquiry data for that purpose.
Write to hello@specus.ai to exercise your rights. We respond without undue delay and within one month of receiving the request. If complexity or the number of requests requires up to two additional months, we explain the extension within the first month. We may request proportionate information to confirm your identity where there are reasonable doubts.
Requests are normally free. Only manifestly unfounded or excessive requests may be refused or charged a reasonable administrative fee under Article 12(5); we must justify that decision. If a request is refused, we explain the reason and your right to complain to a supervisory authority or seek a judicial remedy.
08
Complaining to a supervisory authority
You may lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you habitually live or work, or where the alleged infringement occurred. You do not have to contact us first.
The Portuguese supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD). You can contact it at geral@cnpd.pt, by telephone on +351 213 928 400, or at Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal. Information about making a complaint is available at https://www.cnpd.pt/.
09
No automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you within the meaning of Article 22. A person assesses enquiries. Automated security checks and the contact rate limit may challenge or block suspected abusive requests; they do not decide whether to accept you as a client.
10
How changes are notified
When this policy changes, the date at the top is updated and the previous version is retained for reference. Before using your data for a new purpose, we provide the information required by Article 13(3). Where a change affects an open enquiry or engagement, we provide the relevant notice directly using the contact details already held.
Questions about this policy go to hello@specus.ai. See also the terms of service and the cookie policy.