Privacy Policy

Introduction

Foral ("we", "us", "our") operates a civic engagement and fantasy sports platform focused on Portuguese municipalities. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and Portuguese data protection law.

By creating an account or using Foral, you acknowledge that you have read and understood this policy.

Data Controller

The data controller responsible for your personal data is:

[email protected]

Data We Collect

We collect and process the following categories of personal data:

• Account data: email address, username, and hashed password when you register
• Profile data: display name and preferences you choose to set
• Game activity: municipality selections, portfolio changes, league memberships, and scores
• Civic submissions: case reports, feedback, and attachments you submit through the civic module
• Petition data: petition content, signatures, and advocacy delivery records for public petitions
• Moderation data: review decisions, appeal records, and moderation history
• Technical data: IP address, browser user agent, and timestamps collected automatically in server logs
• Cookie data: authentication session tokens, language preference, and explorer preview state

Legal Bases for Processing

We process your data on the following legal bases under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)): account creation, game features, civic submissions, and petition management — necessary to provide the services you signed up for
• Legitimate interest (Art. 6(1)(f)): platform security, fraud prevention, content moderation, and service improvement
• Legal obligation (Art. 6(1)(c)): compliance with applicable law, including responding to lawful data access requests
• Consent (Art. 6(1)(a)): where specifically requested, such as for optional communications — you may withdraw consent at any time

Data Retention

We retain your data for as long as your account is active and for a reasonable period afterwards. Specific retention periods:

• Account data: retained while your account exists; deleted within 30 days of account deletion request
• Game activity: retained for the duration of your account for scoring history and leaderboards
• Civic submissions: retained indefinitely for public record and transparency purposes, unless you request deletion of specific submissions
• Petition signatures: retained for the lifetime of the petition for verification; anonymised after petition closure
• Server logs (IP, user agent): retained for 90 days for security and debugging
• Moderation records: retained for 2 years for accountability and appeals

Data Sharing and Processors

We do not sell your personal data. We may share data with the following categories of processors:

• Cloud infrastructure provider: for hosting the platform and storing data
• Email service provider: for transactional emails (account verification, notifications)
• AI/LLM providers (Anthropic, OpenAI): for processing civic content and news classification — data sent is limited to the minimum necessary and governed by data processing agreements

All processors are bound by data processing agreements that require them to handle your data in accordance with the GDPR.

International Transfers

Some of our processors may be located outside the European Economic Area (EEA). Where this is the case, transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, or by the processor's participation in an adequate data protection framework.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your data (subject to legal obligations and legitimate interests)
• Right to restriction: request that we limit processing of your data in certain circumstances
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to withdraw consent: where processing is based on consent, you may withdraw at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Right to Complain

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD):

• Comissão Nacional de Proteção de Dados (CNPD)
• Website: www.cnpd.pt
• Address: Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, Portugal

Automated Decision-Making

Foral uses automated processing for scoring municipalities and ranking players. These scores are based on publicly available data indicators and do not involve profiling of individuals. Content moderation may involve AI-assisted review, but final decisions on content removal or account actions are made by human moderators.

Processing of Governance Meeting Data

Foral processes publicly available recordings and documents from Portuguese municipal assembly and chamber meetings to produce structured governance digests. This processing includes automatic video transcription using AI speech recognition and structured information extraction using large language models (LLMs).

Names of elected officials and institutional representatives (presidents, council members, municipal staff) are displayed in their public capacity as part of civic accountability. Names of private citizens who appear in meeting recordings are automatically anonymized and replaced with role-based descriptions (e.g., 'citizen participant', 'local association representative'). Full transcription text is retained internally for processing purposes and is not displayed publicly.

This processing is conducted under the legitimate interest basis (GDPR Article 6(1)(f)) for civic transparency and public accountability. While municipal assembly meetings are public by law, Foral applies data minimization and anonymization as a privacy-by-design measure.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-app notice. The "Last updated" date at the top of this page indicates when the policy was last revised.