Privacy Policy — Achadinho

Last updated: 11 September 2026

1. Who we are

Achadinho ("we", "the Site") is the controller for the personal data collected through this website, under the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and Portuguese Law no. 58/2019.

Controller: Carsten Herziger (sole trader), operating under the name "Achadinho"
Tax number (NIF): 297662414
Address: Areias de Pera 700A, 8365-201 Pêra, Portugal
Contact: plisken122@gmx.com
Data Protection Officer: not required — please contact the controller directly.

2. What data we collect

Category	Examples	When
Account data	Email address, name. We do not store a password — you sign in through a one-time link sent by email	When you sign in
Ad data	Title, description, price, location, category and the fields specific to each category (condition, floor area, energy rating, company)	When you post an ad
Photos	The images you upload, plus a fingerprint calculated from them	When you post an ad
Contact details in the ad	Name and phone number — these are publicly visible, see section 6	When you post an ad
Translations	Your ad text in four languages	Automatically, on publication
Review record	The result of the automated check and the reason, if the ad is refused	On publication
Reports	Reason, free text and the email address of the person reporting	When someone reports an ad
Technical data	IP address, browser type, time of access	Automatically, while browsing

We do not collect special categories of personal data (health, ethnic origin, political opinions) and no data from minors — the service is for people aged 18 and over only.

3. What we use the data for

To create and manage your account;
To publish and display your ads;
To translate your ad automatically into the four languages of the site;
To check ads for prohibited content and fraud patterns before publication;
To let interested people contact you about an ad;
To prevent abuse and handle reports;
To meet legal obligations and respond to authorities;
To send you service messages (sign-in link, expiry of your ad).

4. Legal bases

Performance of a contract (Art. 6(1)(b)): account, publication and translation of your ads, service messages;
Legal obligation (Art. 6(1)(c)): checking and handling reports under the Digital Services Act, retention for tax purposes;
Legitimate interest (Art. 6(1)(f)): platform security, fraud detection including the comparison of image fingerprints, improvement of the service.

5. Automated checking of ads

This is where Achadinho differs from many other classifieds sites, so it is set out explicitly:

Every ad is checked automatically before it is published. For this purpose the title, description, category and price of your ad are sent to an AI service (see section 7), which checks the ad against our posting rules and translates it into the remaining languages. If you use the drafting help, the photo you uploaded is sent as well, so that a suggested title, description and price can be generated from it.

If an ad breaks the rules it is not published, and you are told why. That decision is made automatically in the first instance.

You have the right to have that decision reviewed by a person. Write to plisken122@gmx.com; we will look at the ad and reply within 14 days. The result of every automated check and its reason are recorded, so that such an appeal can be handled on a documented basis.

6. What is publicly visible in your ad

The name and phone number you give in an ad are visible to every visitor. The number is only shown after a click and does not appear in the page source, which makes automated harvesting harder — but not impossible. Do not give a number you do not want to be public.

Also public: your ad text in all four languages, your photos, the location and the approximate time of publication.

Avoid additional personal details in the text and in photos — number plates, documents, house numbers or other people's faces.

7. Sharing with third parties

Your data may be shared with service providers that enable us to run the site, in each case under a data processing agreement (Art. 28 GDPR):

Hosting and database: Render Services, Inc.
Image storage: Cloudflare, Inc. (Cloudflare R2)
Automated checking and translation: Anthropic PBC. The ad text is transmitted and, if you use the drafting help, the uploaded photo. Under the commercial terms of the Anthropic API, this content may not be used to train models and is deleted there within 30 days.
Email delivery: Resend, Inc., delivered via Amazon SES.

We do not sell your data and do not pass it on for third-party advertising.

8. International transfers

Some of the providers named above are based in the United States. Transfers take place under appropriate safeguards, in particular the European Commission's Standard Contractual Clauses or certification under the EU-US Data Privacy Framework.

9. Retention periods

Ads: an ad expires 30 days after publication. We send a reminder by e-mail three days before; it can be renewed at any time from your account. After it expires it is no longer findable, but stays in your account for another 14 days. If it is not renewed within that time, text and photos are deleted.
Account data: for as long as the account exists, and up to one year afterwards for evidentiary purposes.
Sign-in links: 30 minutes, then deleted. In any case we store only a checksum, not the link itself.
Review records and reports: 12 months, so that repeated breaches remain identifiable and appeals can be handled.
Image fingerprints: for as long as the corresponding ad exists, to detect reused photos.
Invoicing data: ten years under Portuguese tax law, from phase 2 onwards once paid services are offered.

10. Your rights

Under the GDPR you may, at any time and free of charge:

Access your personal data;
Rectify inaccurate data;
Erase your data, unless a legal retention obligation applies;
Restrict processing;
Port your data in a structured format;
Object to processing based on legitimate interests;
Request human review of an automated refusal (see section 5).

To exercise these rights, contact us at plisken122@gmx.com. You also have the right to lodge a complaint with the Portuguese data protection authority CNPD — www.cnpd.pt.

11. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), password-free sign-in through one-time links of which we store only the checksum, and limits against automated access. No system is entirely free of risk — in the event of a data breach posing a risk to your rights, we will notify you as required by law.

12. Cookies

This site uses only cookies that are strictly necessary for it to work:

a cookie holding the language you chose;
a cookie that keeps you signed in.

Both are necessary for operation and require no consent under Portuguese Law no. 41/2004. We use no advertising or analytics cookies, which is why this site has no consent banner. Should advertising or audience measurement be added later, this section must be extended and a banner will be required.

13. Changes to this policy

We may update this policy. The date of the last change is shown at the top. We will announce substantial changes on the site or by email.

14. Contact

For questions about privacy and data protection: plisken122@gmx.com