What we collect, why, and how to control it. Last updated: 3 August 2026.
Reggatu is provided by CTMC Unipessoal, Lda, a company registered in Portugal. For any privacy question or request, contact info@reggatu.com.
For the Cloud subscription, we collect:
We do not collect browsing data, do not use third-party advertising cookies, and do not share your data with advertisers.
Local Edition doesn't send your tasks, projects, or journal entries to our servers at all — everything stays in your browser's local storage, on your own device. The only data we ever see is what's needed to process your purchase (your email, via Stripe) and to activate your license key on first use (a device identifier, so each license can only be active on one device at a time).
We process your data under two legal bases (GDPR Article 6):
Under GDPR, you have the right to access, rectify, erase ("right to be forgotten"), port, and restrict the processing of your data. To exercise any of these rights, email info@reggatu.com.
Deleting your account removes all associated data immediately — this isn't a soft-delete or a grace period, it's immediate.
We use the following services to operate Reggatu. None of them are permitted to use your data for their own purposes.
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database | US — covered by the EU-US Data Privacy Framework |
| Render | API hosting | US |
| Netlify | Frontend hosting | US |
| Resend | Transactional email | US |
| Stripe | Payment processing | US |
Your data is kept for as long as your account remains active. After you delete your account, all data is erased within 30 days, and backups containing it are purged within 90 days.
If you believe your data protection rights haven't been respected, you can lodge a complaint with CNPD — Comissão Nacional de Proteção de Dados, Portugal's supervisory authority.