1. Data controller
Controller: Arcadexit (also referred to as Arcadex IT)
App: Olá PT / Ola PT (com.arcadexit.olapt)
Website: https://olapt.app
Privacy contact: arcadexit.tech@gmail.com
Support: support@arcadexit.com
If you are in the European Economic Area (EEA), Switzerland, or the United Kingdom, you may also contact your local data protection authority. In Portugal, that is the Comissão Nacional de Proteção de Dados (CNPD).
2. Scope
This Policy applies to the Ola PT mobile application and the marketing website at olapt.app. By using the App or website, you acknowledge this Policy. If you do not agree, please do not use our services.
3. Personal data we collect
3.1 Account information
You can create an account using Sign in with Apple or Google Sign-In. Depending on the provider and your settings, we may receive a unique account identifier, email address (or Apple private relay email), and display name. We use this to authenticate you, manage scan quotas, and link subscription status. We do not offer email/password registration.
3.2 Documents and vault data (on your device)
Documents you add (images, PDFs, extracted fields, notes, and saved AI analysis) are stored locally on your device, encrypted at rest. This may include sensitive data such as identity documents (NIF, residence card, passport), names, dates of birth, addresses, and document numbers if you choose to store them.
We do not upload your vault documents to our servers for storage or backup. If you use share features, you choose what leaves your device. Biometric unlock (Face ID / fingerprint) is handled by your operating system; we do not receive biometric templates.
3.3 AI analysis data
When you use AI features, the App may process:
- Images you select for scanning
- Text extracted by OCR
- Text you paste (e.g. SMS or email content)
- Follow-up questions about an analysed document
OCR may run on-device or, if enabled, via Google Cloud Vision (image sent for text extraction). AI explanations use extracted or pasted text sent to our backend (Supabase Edge Functions), which calls OpenAI. Document images are not sent to OpenAI for standard analysis. We may log usage metrics (scan counts, approximate token usage) to enforce quotas.
3.4 Subscription and purchase information
Payments are processed by Apple (App Store) or Google (Play Store). We do not receive your full payment card details. We use RevenueCat to manage entitlements and store subscription tier, expiry, and related status needed to unlock paid features.
3.5 Device permissions
With your permission: Camera (scan), Photo library (import), Biometrics (unlock vault), Notifications (local expiry reminders). Reminder notifications are scheduled locally; we do not operate marketing push campaigns in the App.
3.6 Technical and website data
Our backend may store user ID, profile basics, usage counters, subscription status, and technical logs for authentication and errors. The marketing website may process standard technical data necessary to serve pages (e.g. IP address in server logs, browser type). We do not currently use third-party advertising or product analytics SDKs in the App.
4. How we use personal data
We use personal data to:
- Provide, secure, and improve the App and website
- Authenticate you and maintain your session
- Run OCR and AI explanations you request
- Enforce free/paid scan limits and process subscriptions
- Comply with law and respond to lawful requests
- Communicate about support or critical service issues
We do not sell your personal data.
5. Legal bases (GDPR / UK GDPR)
Where GDPR or similar laws apply, we process personal data on:
- Contract (Art. 6(1)(b)) — to provide the App and subscription features you request
- Consent (Art. 6(1)(a)) — for optional permissions and certain processing you initiate; you may withdraw consent at any time
- Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent abuse, and maintain quotas (balanced against your rights)
- Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information under law
Where we process special categories of data that you choose to include in documents you scan, processing is based on your explicit request to provide the service (and, where required, your consent).
7. International transfers
Some providers may process data in the United States or other countries outside the EEA/UK. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement / Addendum, or the provider’s certified transfer mechanisms (e.g. EU–US Data Privacy Framework where applicable).
8. Retention
- Local vault data: Remains on your device until you delete it or uninstall the App.
- Account data: Kept while your account is active; you may request deletion.
- AI / usage logs: Retained for a limited period for billing, abuse prevention, and service operation.
- Subscription records: Retained as needed for accounting, fraud prevention, and legal compliance.
9. Security
We use appropriate technical and organisational measures, including local encryption of vault payloads (AES-GCM) with keys protected by device secure storage / your PIN, optional biometric unlock via the OS, and HTTPS/TLS for network requests. No method of transmission or storage is 100% secure. Protect your device passcode/PIN and keep your OS updated.
10. Your rights (EEA / UK / similar)
You may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your account / personal data (“right to be forgotten”)
- Restrict or object to certain processing
- Data portability
- Withdraw consent where processing is based on consent
- Lodge a complaint with a supervisory authority (Portugal: CNPD)
To exercise these rights, email arcadexit.tech@gmail.com. We will respond within the timeframes required by law (typically one month under GDPR). Because vault documents are stored only on your device, we generally cannot retrieve them from our servers—delete them in the App or uninstall to remove local vault data.
11. Children’s privacy
The App is not directed to children under 16 in the EEA (or the minimum digital consent age in your country; elsewhere, not under 13). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps.
13. Not legal, government, or medical advice
AI explanations are informational only. Ola PT is not a law firm, government authority, or medical device, and does not provide legal, immigration, tax, or medical advice. Always verify important matters with official sources or qualified professionals.
14. Changes
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date. Where required by law, we will provide additional notice or seek consent.
15. Contact
Arcadexit
App: Olá PT (Ola PT)
Email: arcadexit.tech@gmail.com
Web: www.arcadexit.com