Privacy Policy
Last updated: 24 October 2026
Problem reports and technical support
You can report a software problem without an account. We process the description and any steps, expected behaviour and impact you provide, a coarse device platform and browser language, and an email address only if you choose to provide one. We use these data to investigate and resolve the problem, contact you where requested and protect the reporting service from abuse. The legal basis is our legitimate interest in maintaining a reliable, secure service under Article 6(1)(f) GDPR; support required by your contract also relies on Article 6(1)(b).
Our own hosted bug service, n8n automation and Vikunja issue tracker store and organise reports. Report text may be sent to OpenAI through our Codex runner for a preliminary technical assessment; the optional contact-email field is excluded from that request. Personal data placed inside the description may nevertheless be included. The assessment is reviewed by a person and does not make decisions with legal or similarly significant effects. Please omit passwords, access tokens, payment details and other people’s personal data. Reports detected as containing sensitive information are held for private review before forwarding.
An internal Telegram alert contains the product, report reference, suggested urgency and a restricted ticket link. It does not contain your report text or contact email. The form uses rate limits, a hidden anti-spam field and a short browser computation, without an external CAPTCHA provider. IP addresses are used transiently for rate limiting and are not included in the stored report or AI request.
Reports, optional contact details and their assessments are removed six calendar months after the issue is marked completed. Reopening an issue restarts the period when it is completed again. Vikunja keeps deleted tickets in recovery storage for up to 30 additional days. Inaccessible or manually moved records are flagged for operational review and cleanup. Infrastructure backups rotate separately; delivered Telegram metadata is not automatically removed by deleting the ticket. You can request access or erasure by contacting responello@matikus.com and quoting your reference. Provider-side processing and international transfers remain subject to the applicable provider arrangements described below.
Contract and consumer-declaration records
When you create an account or accept updated Terms, we record the accepted Terms of Service and Data Processing Agreement versions, their complete texts and document fingerprints, the acceptance time, your name as representative, account identification and email address and, if you name one, your organisation. For an optional personalised DPA we also process the customer and representative details and the accepted text. We do not record IP addresses for these acceptances. We use these records to conclude and evidence agreements and retain them while the account exists and for three years after account deletion. Withdrawal and cancellation declarations submitted through our former online forms (available until 12 October 2026) include the name, confirmation email, contract identification, requested termination details, declaration and receipt timestamp; we retain them for three years after submission. We use these records for contract administration, compliance with legal obligations and establishment or defence of legal claims under Article 6(1)(b), (c) and, where applicable, (f) GDPR. Applicable individual rights remain available.
Contract copies use Brevo transactional delivery. Hostinger supplies our domain and customer-correspondence email services. This includes correspondence about contracts and consumer rights; our support mailbox is for account and contract correspondence and fully anonymised technical examples. Do not send visitor contact messages, recipient lists or screenshots containing other people’s personal data. Necessary investigation of a referenced record takes place within Responello without copying it into support email. Additional provider arrangements must be completed before extending that workflow. The applicable contracting entity, email product, processing locations and safeguards depend on our actual provider agreement. Contact us for information on these arrangements.
Queued email copies are deleted 30 days after successful sending. Failed deliveries remain queued for retry and operational resolution. Contract evidence is kept separately from account-linked operational data and is not automatically erased by deleting the account. These retention periods are operational policies, not a statement that every legal claim has the same limitation period.
1. Data controller
- Controller
- Matikus, Lda.
- Address
- Startup Madeira – EV 289, Campus da Penteada, 9020-105 Funchal, Madeira, Portugal
- NIPC
- 519 513 630
- responello@matikus.com
This policy explains how Matikus, Lda. processes personal data when people visit or use Responello, create an account, configure buttons and notification channels, interact with a Responello button, submit a contact request, or purchase a subscription.
2. Our role and the account holder’s role
Matikus, Lda. is the controller for account administration, service security, billing administration, and its own operational records. Where a business customer determines the purpose of collecting button interactions and contact messages, that customer is the controller and Matikus processes those data on its behalf to provide the configured service. The customer must provide its own identity, privacy notice, and legal basis to recipients and arrange an Article 28 GDPR data-processing agreement before using Responello to process personal data on its behalf. Contact responello@matikus.com about these arrangements.
Recipients can contact the sender who supplied the button about that sender’s processing. Matikus can help identify and route a request concerning data held in Responello. This policy does not replace the customer’s privacy notice or the terms and privacy information of its selected notification destinations.
3. Account and authentication data
- Name and email address.
- Password hash and authentication records; Responello does not store the plain-text password.
- Session identifiers, session expiry, and browser user-agent information used to secure signed-in sessions. IP-address storage in authentication sessions is disabled.
- Account creation and update timestamps.
- Subscription plan, status, billing period, trial start and end dates, reminder delivery status, existing Free-plan eligibility, and identifiers returned by Creem.
- If your account started a free trial: a keyed hash (a pseudonymised check value) of your email address, kept separately from the account so that it remains after the account is deleted. The email address itself cannot be read from it.
4. Workspace and channel data
- Button labels, descriptions, appearance, language, active dates, and public messages configured by the account holder.
- Notification-channel names, status, delivery history, and failure information.
- Credentials and destination details for email, Telegram, Slack, Discord, Pocket Alert, or customer-defined webhooks. Sensitive channel configuration is encrypted at rest and is not returned in plain text through the product interface.
5. Button interactions and contact requests
- The button tracking identifier, view time, confirmation time, status, and a shortened browser user-agent string.
- A salted, keyed hash of the visitor’s IP address for abuse prevention. The plain IP address is not stored in the click-event record.
- If a contact form is enabled: email address and message, plus optional name, subject, and urgency.
- Delivery jobs and daily aggregate counts for views, confirmations, quota blocks, and contact-form submissions.
Responello does not place a tracking pixel in email signatures and does not use button activity to build cross-customer advertising profiles. Opening a Responello URL and explicitly confirming an action are recorded as separate events; a notification is triggered only after confirmation.
Individual interaction records remain personal or pseudonymous data where they can be related to a person; hashing an IP address does not make it anonymous. Contact details and message text are included in alerts delivered to the destinations selected by the account holder. People with access to those destinations may be able to read them. Your IP address is also processed transiently to deliver web requests and enforce rate limits.
6. Purposes and legal bases
- Account and subscription administration
- Performance of a contract with you or steps you request before entering into a contract — Article 6(1)(b) GDPR. For representatives of business customers, our legitimate interest in administering that business relationship — Article 6(1)(f) GDPR.
- Customer-controlled button interactions and contact requests
- We process these data on the customer’s instructions. The customer determines and explains its legal basis, such as responding to a requested enquiry or its legitimate interest in business communication. Opening a link is not treated as blanket consent.
- Security, abuse prevention, rate limits, and reliable delivery
- Our legitimate interest in protecting Responello, its users, and visitors — Article 6(1)(f) GDPR.
- Accounting, tax, and regulatory records
- Compliance with applicable Portuguese accounting and tax obligations — Article 6(1)(c) GDPR. Fraud prevention and the establishment, exercise, or defence of legal claims rely on our legitimate interests — Article 6(1)(f) GDPR, unless a specific legal obligation applies.
- Preventing repeated free trials
- Our legitimate interest in preventing abuse of the free trial by repeatedly deleting and re-creating accounts — Article 6(1)(f) GDPR.
- Aggregate website and product measurement
- Our legitimate interest in understanding service use and improving the website — Article 6(1)(f) GDPR for processing before aggregation. The stored event totals do not identify individual visitors.
8. Recipients and service providers
- Hetzner Online GmbH
- EU-based infrastructure hosting for the Responello application and database.
- Brevo / Sendinblue SAS
- Transactional email delivery. Recipient address and notification content are sent to Brevo when an email channel or system email is used.
- Creem / Armitage Labs OÜ
- Merchant of record for paid subscriptions. Creem hosts checkout, processes payment and billing details, handles applicable taxes and invoices, and returns subscription identifiers and status to Responello.
- Meta Platforms Ireland Limited
- Optional advertising measurement after consent. For collection and transmission through Meta Business Tools, the Meta Controller Addendum defines the relevant joint-controller responsibilities; Meta processes subsequent data under its own policy. You may exercise your rights with either controller. Meta may process data outside the EEA; its privacy policy and Business Tools terms describe its applicable transfer arrangements and safeguards.
- Customer-configured destinations
- Telegram, Slack, Discord, Pocket Alert, and customer-defined webhook endpoints receive notification content only when an account holder configures and activates the relevant channel.
Apart from the optional Meta advertising measurement described above, we do not use an external analytics, error-reporting, log aggregation, or uptime-monitoring provider at present. Operational request logs are produced within our own hosted environment and do not contain contact-form content.
9. International transfers
Our primary application infrastructure is located in the European Union. Some service providers or customer-selected notification destinations may process data outside the European Economic Area. Before Matikus, Lda. makes such a transfer, an applicable Chapter V GDPR transfer mechanism is required, such as an adequacy decision or appropriate safeguards including standard contractual clauses. Contact responello@matikus.com for information about the mechanism and a copy of applicable safeguards for a particular provider. Customer-selected destinations are also subject to the account holder’s configuration and responsibilities.
10. Retention
- Click events and associated contact requests
- Retained for six months from the view, then deleted. Daily aggregate counts without sender identifiers remain linked to the account for analytics until account deletion.
- Account, workspace, and channel data
- Retained while the account or relevant item exists. Once account deletion succeeds, account-linked operational data are removed immediately from the active database. The self-service flow asks you to resolve a renewing subscription or pending checkout first; you may still request erasure by email. Copies already delivered to notification destinations are not removed by deleting a Responello account. Backup copies and records required for a specific legal obligation or claim are handled separately.
- Free-trial check value
- If your account started a free trial, a keyed hash of your email address is kept for 24 months after it is recorded, even after the account is deleted, to prevent repeated free trials. It does not contain the email address and is deleted automatically after that period.
- Authentication sessions
- Sessions normally expire after seven days and can be renewed during use. Expiry prevents authentication; it does not itself guarantee immediate deletion of the database record. Account deletion removes linked session and credential records.
- Billing and transaction records
- Retained for the periods required by applicable accounting, tax, fraud-prevention, and legal obligations. Creem applies its own retention periods as merchant of record.
- Operational logs
- Retained only for as long as reasonably necessary for security, reliability, and incident investigation.
- First-party website and product event totals
- Retained as daily aggregate counts for product-performance trend analysis. They are not linked to visitors or account holders.
11. Your data-protection rights
- Access to your personal data — Article 15 GDPR.
- Correction of inaccurate data — Article 16 GDPR.
- Erasure — Article 17 GDPR.
- Restriction of processing — Article 18 GDPR.
- Data portability — Article 20 GDPR.
- Objection to processing based on legitimate interests — Article 21 GDPR.
- Withdrawal of consent at any time where processing relies on consent, without affecting earlier lawful processing.
Account holders can download a machine-readable account export and delete their account from the account area. The export covers core account and workspace records; it does not replace a full access request concerning correspondence, security records, or relevant provider records. Other requests, including requests from people who interacted with a button or submitted a contact form, may be sent to responello@matikus.com. We may need information that allows us to identify the relevant account or interaction.
We respond to rights requests without undue delay and normally within one month of receipt. If a lawful extension of up to two further months is necessary, we explain the reasons within the first month. We use proportionate identity checks; do not send passwords or payment-card details. We explain any lawful reason for retaining particular information or declining a request. You can exercise your rights without using the account export or deletion controls.
12. Complaints
You may lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), or with another competent supervisory authority in the EU or EEA.
13. Required data and automated decisions
An account requires a name, email address, and password. Without them we cannot create the account. Notification destinations and their credentials are required only for the channels you choose. On a contact form, email and message are required to send the enquiry; name, subject, and urgency are optional. You can instead contact the sender using another available channel. Please do not submit sensitive information such as health data, passwords, or payment-card details.
Responello does not make decisions based solely on automated processing that produce legal or similarly significant effects on you within Article 22 GDPR. Automated security checks and plan limits protect the service and control delivery. Creem’s own payment and fraud checks are described in its privacy notice.
14. Changes to this policy
We may update this policy when Responello, its providers, or legal requirements change. The current version and its update date are always published on this page. Material changes will be communicated through the service when appropriate.