This policy explains what personal data Ricardo Miguel Andorinha Rodrigues ("Event Horizon", "we") collects as a Controller — that is, data about you as our customer, user or website visitor — and what we do with it.
It does not cover the data you put into the platform. For the records your pipelines ingest and the analytics built on them we are a Processor acting on your instructions, you are the Controller, and the Data Processing Agreement governs that relationship. If you are an individual whose data one of our customers has loaded into Event Horizon, we are not the right people to ask: contact that organisation, and see section 9 below.
1. Who we are
Ricardo Miguel Andorinha Rodrigues, sole trader (empresário em nome individual), tax number 220585571.
Contact for data protection matters: privacy@eventhorizondata.com.
We have not appointed a Data Protection Officer. Our core activity does not consist of large-scale processing of special categories of data, nor of regular and systematic monitoring of data subjects on a large scale, so Article 37 GDPR does not require one. If that changes we will appoint one and say so here.
2. What we collect, why, and on what legal basis
| Data | Where it comes from | Why | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Name, email address, organisation name | You, at registration or when you are invited | To create and operate your account, authenticate you, and contact you about the Service | Contract, 6(1)(b) |
| Password (stored only as a scrypt hash), two-factor secret and recovery codes | You | To authenticate you and to protect the account | Contract, 6(1)(b) |
| Federated identity (Google, GitHub, Facebook or X account identifier and the email on it) | The provider, if you choose to sign in that way | To authenticate you without a separate password | Contract, 6(1)(b) |
| Billing details: billing address, tax number, payment status, invoice history | You, and our payment provider once one is in use | To charge you and to issue legally required invoices | Contract, 6(1)(b); legal obligation, 6(1)(c) for invoicing and retention |
| Sign-in records, IP address, user agent, session activity times | Automatically, when you use the Service | To keep the account secure, detect abuse, and enforce rate limits | Legitimate interests, 6(1)(f) — securing our service |
| Acceptance record: which versions of the Terms, this policy and the DPA you accepted, when, from which IP address and with which browser | Automatically, at registration | To be able to prove which contract terms apply to your account | Legal obligation, 6(1)(c) and Art. 28(9) GDPR; legitimate interests, 6(1)(f) — establishing and defending legal claims |
| Usage telemetry: request counts, query timings, error records, ingestion volume counters | Automatically | To operate the Service, apply plan limits, bill accurately, and find faults | Contract, 6(1)(b); legitimate interests, 6(1)(f) |
| Support correspondence | You | To answer you and to keep a record of what was agreed | Contract, 6(1)(b); legitimate interests, 6(1)(f) |
| Marketing emails, if you opt in | You | To tell you about the product | Consent, 6(1)(a) — withdrawable at any time |
We do not use advertising trackers, analytics pixels, session recording, or any third-party script that profiles visitors. The public site loads no third-party analytics.
3. Cookies
We set the minimum a logged-in application needs:
| Cookie | Purpose | Lifetime |
|---|---|---|
adonis-session |
Holds your session identifier. Strictly necessary: without it you cannot stay signed in | Session, with a two-hour inactivity limit and a twelve-hour absolute limit |
| CSRF token cookie | Strictly necessary: protects against cross-site request forgery | Session |
Both are strictly necessary for a service you have asked for, so no consent banner is shown for them. We set no others.
4. Who we share it with
We do not sell personal data and do not share it for anyone else's marketing.
We use the service providers listed in Annex III of the DPA. That list is the single place we maintain it, and it covers both roles: the providers that host and support the platform also process the account data described in this policy. In summary, they are our hosting provider, our off-site backup storage provider and our transactional email provider.
We also disclose personal data:
- to professional advisers (accountants, lawyers) bound by confidentiality;
- where a law, a court or a competent authority requires it — and we will tell you unless we are legally prohibited from doing so;
- to a buyer or successor if the business is transferred, on notice to you.
5. Where your data is
The platform runs on servers in the United States. For customers in the European Economic Area that means a transfer of personal data outside the EEA.
The transfer mechanism is set out in clause 7.8 and Annex III of the DPA, and applies to the account data in this policy on the same terms: [TRANSFER MECHANISM: EU Standard Contractual Clauses with a transfer impact assessment, and/or the EU–US Data Privacy Framework where the provider is certified — to be confirmed per provider before publication].
6. How long we keep it
| Data | Retention |
|---|---|
| Account and user records | For as long as the account is open, then [90 days] after closure |
| The acceptance record | [10 years] from the end of the contract — it exists to prove which terms applied, which is exactly the question that arises after a relationship ends |
| Invoices and accounting records | As required by tax law, [10 years under Portuguese law — confirm] |
| Sign-in and security records | [12 months] |
| Support correspondence | [3 years] from the last message |
| Usage telemetry and billing counters | [24 months]; ingestion counters are kept for the life of the account because they are the billing record |
| Backups | Backups expire on rotation: 14 days on the primary host and 7 days off-site. Data deleted from the live systems disappears from backups as those rotate, not by editing a backup |
7. Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or provide it in a portable format; and where processing is based on consent you may withdraw that consent at any time, without affecting what was done before.
Write to privacy@eventhorizondata.com. We answer within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We do not charge, unless a request is manifestly unfounded or excessive.
You may complain to a supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. If you are in another EEA country you may complain to your own authority.
8. Security
The technical and organisational measures we apply are described in full in Annex II of the DPA, and they protect the data in this policy as well. Briefly: encrypted transport, hashed passwords, encrypted storage of the credentials you register, per-tenant isolation enforced at a single point that fails closed, least-privilege database identities, two-factor authentication, session and re-authentication limits, rate limiting, daily backups with a tested restore procedure, and a recurring adversarial review of the codebase.
No measure makes a service unbreakable. If a breach affects your personal data and is likely to result in a high risk to you, we will tell you, and we will notify the supervisory authority within 72 hours of becoming aware where Article 33 requires it.
9. If you are not our customer
If your personal data is in Event Horizon because one of our customers put it there, that customer is the Controller and decides what happens to it. We hold it only on their instructions and are not permitted to disclose, correct or delete it on our own initiative.
Send your request to that organisation. If you cannot identify them, write to privacy@eventhorizondata.com and we will pass the request on to the customer we believe is responsible — that is the assistance Article 28(3)(e) obliges us to give — but the answer has to come from them.
10. Changes to this policy
Every version is published with its version identifier and effective date, and earlier versions remain available. For a material change we give the account's administrators at least 30 days' notice before it takes effect.
11. Contact
Ricardo Miguel Andorinha Rodrigues · tax number 220585571 · privacy@eventhorizondata.com