Privacy policy

Last updated: September 2026

Nutsoft, Unipessoal Lda. (“Nutsoft”) processes personal data as controller in connection with the Womni service. This policy summarises what data we process, why, and your rights.

1. Controller

Nutsoft, Unipessoal Lda., with registered office in Portugal, insofar as it is the contracting entity and operator of the Womni website and platform. To exercise your rights or for privacy questions, contact us through the means indicated on the website.

2. Purposes and categories of data

We process personal data for, among other purposes:

• SaaS provision: account, user identification, settings, and technical logs needed for security and operation.
• Billing and collection: payment or billing data (name, tax ID, address, subscription history and billable usage).
• Onboarding and compliance: data and legal documentation you send us to enable activation of the system and to meet legal or contractual obligations (for example, identity verification or partner requirements).
• Communications: replies to contact requests, support and, where authorised, information about the service.
• Legitimate interests: product improvement, aggregated statistics and fraud prevention, balanced against your rights.

3. Legal documents and system operation

Womni may process legal documents and commercial or tax information that the Customer uploads or integrates into the platform in the ordinary course of business. That processing is for performance of the contract and, where applicable, compliance with legal obligations. Sending the documentation requested in the activation process is necessary so we can provide the service under secure conditions aligned with applicable requirements.

4. Cookies, Zaraz, Google Tag Manager and OpenAI Ads

Under Portuguese Law no. 41/2004 (privacy in electronic communications) and the GDPR, we only store or access information on your device without prior consent when that is strictly necessary for the service you requested (for example, security, language and remembering your cookie choice).

Measurement and marketing tools — including Cloudflare Zaraz, Google Tag Manager (GTM) (first-party paths such as /cdn-cgi/zaraz/ and /metrics/) and the OpenAI Ads measurement pixel (ads in ChatGPT, served from bzrcdn.openai.com / bzr.openai.com) — are not strictly necessary. We do not load them, and they do not set statistics or advertising cookies, until you click “Accept” or save preferences with those categories enabled. You may refuse in the banner, with the same number of clicks, or change this later in “Cookie preferences”.

• Essential (always on): consent preference, interface language, document session where applicable.
• Statistics (consent only, GDPR art. 6(1)(a)): usage measurement via Zaraz/GTM.
• Marketing (consent only): campaigns and relevant content via Zaraz/GTM, and conversion measurement for ChatGPT ads (OpenAI Ads pixel), including contact requests and account creation.

Google Consent Mode starts as “denied”. The OpenAI Ads pixel only initialises with the Marketing category on. Withdrawing consent stops loading Zaraz/GTM and the OpenAI pixel, updates Consent Mode and stops sending measurement events; optional categories are turned off.

5. Legal basis

Processing is based on performance of a contract, compliance with legal obligations, consent where required (optional cookies, marketing communications), or Nutsoft’s legitimate interest, as the case may be.

6. Retention

We keep data for as long as needed for the purposes above, including legal archiving periods (for example, tax), and delete or anonymise it when it is no longer needed.

7. Recipients and transfers

Service providers acting on Nutsoft’s behalf (hosting, payments, support, campaign measurement) may have access to the data, under contracts requiring adequate protection. With marketing consent, OpenAI receives conversion events from the ads pixel (ChatGPT Ads) to attribute contact requests and account creation to campaigns. If there is a transfer outside the EEA, GDPR safeguards will apply.

8. Your rights

Under Regulation (EU) 2016/679 (GDPR), you may request access, rectification, erasure, restriction, portability and objection to processing, and withdraw consents where applicable. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).

9. Security

We implement technical and organisational measures appropriate to the nature of the data and the risks, without this constituting an absolute guarantee of security.

10. Changes

We may update this policy; the “last updated” date will be revised. Material changes may be communicated by email or a notice in the service.

For the contractual framework of the service, see also the Terms of use .