Privacy Notice

1. Who we are

Hold the Light is operated by Diogo Horta, based in Portugal. We are the data controller for the personal data described in this notice. Contact: privacy@holdthelight.app.

2. Data we collect and why

• Account data (name, email, login credentials, authentication provider) — to create and secure your account. Legal basis: performance of a contract.
• Subscription and entitlement data (plan tier, subscription status) — to give you the access you paid for. Legal basis: performance of a contract.
• Service content (vehicle descriptions, fault codes, symptoms, investigation steps and notes you enter) — to provide the diagnostic features and your history. Legal basis: performance of a contract.
• Usage and device data (session identifiers, daily usage counters, IP address, browser/device information, error logs) — to run the service, enforce plan limits and single-device sign-in, and prevent fraud and abuse. Legal basis: legitimate interests.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Marketing emails — only where you opt in. Legal basis: consent, which you may withdraw at any time.

3. Automated content generation

Text you enter into an investigation may be sent to our AI processing provider to generate diagnostic suggestions. Do not enter personal data about customers (names, phone numbers, addresses) in those fields — only vehicle and fault information is needed.

4. Who we share data with

• Service providers / subprocessors — hosting, database, authentication, AI processing, error monitoring and email delivery providers.
• Merchant of Record — Paddle.com, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell personal data.

5. International transfers

Some providers process data outside the EEA/UK. Where that happens we rely on adequacy decisions or EU Standard Contractual Clauses with appropriate additional safeguards.

6. Retention

Account and investigation data is kept while your account is active and for up to 12 months after closure, after which it is deleted or anonymised. Billing records are kept for the period required by tax law. Logs are kept for up to 12 months.

7. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests, and withdraw consent at any time. Write to privacy@holdthelight.app and we will respond within one month. You may also complain to your supervisory authority — in Portugal, the CNPD.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls on the database, and restricted administrative access.

9. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in, remember your device session for single-device enforcement, and secure the checkout. We do not use advertising cookies. Analytics, if enabled, is limited to aggregate usage measurement, and you can block cookies through your browser settings.

10. Changes

We will post any updates to this notice on this page with a revised date.