Privacy Policy

Last updated: April 2026 · Applies to sayko.pt

1. Data Controller

The data controller for sayko.pt is Alexandre Taborda, trading as Sayko, NIF 266245722, Lisbon, Portugal. Contact: alex@sayko.pt.

This policy explains what personal data we collect, why, and your rights under the General Data Protection Regulation (GDPR) and Portuguese data protection law.

2. Data We Collect

Data	Purpose	Legal Basis
Name, email address	Order processing, client account creation, project communication	Contract performance
Payment data	Processing transactions	Contract performance (processed by Stripe — we do not store card details)
Project files (audio stems, references)	Delivering the ordered service	Contract performance
Project brief notes	Understanding project requirements	Contract performance
Email (overflow waitlist)	Notifying you when capacity opens	Consent (you voluntarily provide this)

We do not use analytics, tracking pixels, or third-party advertising scripts on this website.

3. Cookies and Local Storage

sayko.pt does not use tracking cookies. The client portal uses browser localStorage to store your authentication token — this is strictly necessary for the portal to function and does not track you across sites.

4. How We Use Your Data

To process your order and deliver the agreed service
To create and manage your client portal account
To send order confirmation and project status updates
To contact you about your project
To comply with our legal and tax obligations (invoicing, NIF records)

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-Party Processors

We use the following sub-processors to deliver our service:

Provider	Purpose	Location
Stripe	Payment processing	EU / US (SCCs in place)
Cloudflare	File storage (R2) and DNS	EU
Hostinger	Server hosting and email	EU

6. Data Retention

Order and client data: retained for 7 years to comply with Portuguese tax law
Project files: retained for 90 days after delivery, then deleted unless you request otherwise
Waitlist emails: deleted within 30 days of slot opening or upon your request

7. Your Rights

Under GDPR you have the right to:

Access — request a copy of all personal data we hold about you
Rectification — request correction of inaccurate data
Erasure — request deletion of your data (subject to legal retention requirements)
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email alex@sayko.pt. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority: CNPD — Comissão Nacional de Proteção de Dados.

8. Data Security

We use HTTPS on all pages, encrypted database storage, and access controls to protect your data. Passwords in the client portal are hashed using bcrypt and are never stored in plain text.

9. Changes to This Policy

We may update this policy from time to time. The date at the top reflects the most recent revision. Continued use of our services after changes constitutes acknowledgement of the updated policy.

Data requests: alex@sayko.pt