Privacy Notice
Last updated: 8/11/2026
1. Data controller
André Filipe Marques Moreira is the data controller for personal data processed through FIRST ACT Pulse and determines the purposes and means of that processing. Contact: info@andremarquesmoreira.com.
2. Data we collect
Account data: username, display name, email and password (stored only in hashed form). Organisation and team role data. Aggregated box-office data you import (no end-customer data). Support messages. Technical and security data: IP address, device and browser identifiers, usage logs and sign-in attempt logs.
3. Purposes and legal bases
Creating and managing your account and providing the service (contract); security, fraud prevention and abuse limiting (legitimate interests); customer support (contract); product improvement (legitimate interests); tax and legal compliance (legal obligation); marketing communications only with your consent.
4. Data sharing
We share data only with: service providers and subprocessors (hosting, database, email delivery and AI models, which receive only anonymised facts); Paddle.com, Merchant of Record, for sale of the product, subscription management, payments, tax compliance and invoicing; professional advisers (legal and accounting); and authorities where required by law. We do not sell personal data.
5. International transfers
Some providers may process data outside the EEA. In those cases we rely on appropriate safeguards such as adequacy decisions or the European Commission's Standard Contractual Clauses.
6. Retention
We keep account data while the account is active and up to 30 days after closure; security logs up to 12 months; tax records for the legally required period. Afterwards data is deleted or anonymised.
7. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Contact info@andremarquesmoreira.com; we respond within one month. You may complain to the Portuguese supervisory authority (CNPD).
8. Security
We apply appropriate technical and organisational measures, including encryption in transit, hashed passwords, per-organisation data isolation and role-based access controls.
9. Cookies
We use only essential storage to keep you signed in and remember your language. We do not use analytics or marketing cookies. You can clear this storage in your browser settings, which signs you out.