Privacy Policy
Last updated: June 2026 · Version 2.2
This Privacy Policy describes how CDN Core Technologies (“we”, “us”) collects and processes personal data through the Lori-Talk website (lori-talk.eu) and related services. It is issued under Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC (ePrivacy), Portuguese Law 58/2019, and the Brazilian General Data Protection Law — Lei n.º 13.709/2018 (LGPD).
If you only want to know the essentials: we collect what you give us through the contact form, we keep server logs for security, we load the Meta Pixel only if you opt in via the cookie banner, and your content inside the Lori-Talk product is never used to train AI models.
1. Controller & contact
Data controller: CDN Core Technologies
Address: Parkurbis — Parque de Ciência e Tecnologia da Covilhã, 6200-865 Covilhã, Portugal
Email: [email protected]
Phone: +351 275 959 168
Data protection contact: [email protected] (subject: “GDPR / LGPD request”).
A formal DPO (Encarregado) will be appointed and named here once service scale triggers the legal requirement.
2. Categories of personal data we process
We only process the categories of personal data listed below. We do not collect special-category data (Art. 9 GDPR / Art. 11 LGPD) on this website. We do not knowingly collect data from children under 16.
| What | When | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| First name, last name, email, company (optional), subject, message | You submit the contact form | Reply to your enquiry; pre-contractual steps; customer support history | Consent (Art. 6(1)(a) GDPR / Art. 7, I LGPD) and pre-contractual measures (Art. 6(1)(b) / Art. 7, V) | 24 months after last interaction, then deleted; you can request earlier erasure |
| Email address, account identifier (account & service emails: verification, password reset, workspace invitations, onboarding and 1-to-1 support replies) | You hold a Lori-Talk account and an account or support event occurs | Operate the service: verify your identity, secure your account, deliver workspace invitations, and answer support requests | Performance of a contract (Art. 6(1)(b) GDPR / Art. 7, V LGPD) and legitimate interest in service security and continuity (Art. 6(1)(f) / Art. 7, IX). Sent to all account holders; these messages cannot be opted out of while the account exists | For the lifetime of your account, then deleted in line with account-deletion retention rules |
| Email address, account identifier, consent record (timestamp, IP address) for product news and feedback-request emails | You tick the optional marketing checkbox at signup, or enable it later in Settings | Send occasional product news and feedback requests; keep proof that consent was given | Consent (Art. 6(1)(a) GDPR / Art. 13 ePrivacy / Portuguese Law 41/2004, art. 13.º-A) in the EU; legitimate interest with opt-out (Art. 7, IX LGPD) read with Art. 10 in Brazil. You can withdraw consent at any time in Settings → General or via the opt-out link in each message; the consent record (timestamp, IP) is retained as proof | Until you withdraw consent or delete your account; the consent record is kept as proof for the duration of the processing plus the applicable limitation period |
| IP address, User-Agent, timestamp, requested URL, response status | Each HTTP request to the site | Network and information security, abuse detection, operational debugging | Legitimate interest (Art. 6(1)(f) GDPR — see Recital 49; Art. 7, IX LGPD) | 30 days, then deleted or pseudonymised |
Browser localStorage entries (loritalk-lang, loritalk-consent) | You change language or record a cookie preference | Remember your language choice and your granular cookie consent (necessary / marketing) | Strictly necessary (Art. 5(3) ePrivacy exemption — explicitly requested by user) | Until you clear your browser storage |
Browser and device identifiers via Meta Pixel (_fbp, _fbc, IP address, User-Agent, browser fingerprint signals, current URL, referrer) | You opt in to marketing cookies and then load a page | Measure Meta (Facebook / Instagram) advertising campaigns, attribute conversions, build look-alike and re-marketing audiences | Your prior, freely given, informed and granular consent (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy / Portuguese Law 41/2004; Art. 7, I LGPD) | Up to 90 days in your browser (_fbp / _fbc); retained by Meta according to its own policies. You can withdraw consent at any time — see the Cookie Policy. |
Information about the Lori-Talk product itself (account creation, content generation, billing) is governed by the in-product privacy notice at app.lori-talk.eu.
3. Cookies and similar technologies
By default this website only sets the strictly necessary local-storage entries described above. The Meta Pixel — an advertising-measurement tracker that sets the _fbp and _fbc cookies and transmits page-view data to Meta — is only loaded after you give prior, freely given, granular, opt-in consent through the cookie banner. You can withdraw that consent at any time without affecting the lawfulness of processing already performed. Full details, including how to refuse or withdraw consent, are in the Cookie Policy.
4. Recipients and sub-processors
Your personal data may be shared, under contractual safeguards, with the following categories of recipients:
- Hosting and infrastructure providers located in the European Union, which run the servers that deliver this website and store contact-form submissions.
- Transactional email provider used to relay contact-form messages to our team mailbox.
- Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) and its US affiliate Meta Platforms, Inc. — acting as independent controller for advertising-measurement data collected through the Meta Pixel. Only triggered if you opt in to marketing cookies.
- Professional advisers (lawyers, accountants) when strictly necessary to defend a legal claim or comply with a legal obligation.
- Competent public authorities when legally compelled (court order, formal request from a supervisory authority).
We do not sell, rent, or otherwise commercially share your personal data with third parties beyond the recipients listed above. We do not use your contact-form data for advertising or for AI training.
An up-to-date list of sub-processors is available on request via [email protected].
5. International transfers
Personal data collected through this website is stored on servers located in the European Union. If, in the future, any sub-processor is located outside the European Economic Area, transfers will be carried out under one of the safeguards permitted by Chapter V GDPR — typically Standard Contractual Clauses (Commission Decision (EU) 2021/914) supplemented by appropriate technical and organisational measures. For LGPD purposes, transfers will rely on the mechanisms set out in Articles 33–35 LGPD.
Meta Pixel data: when you opt in to marketing cookies, Meta Platforms Ireland transfers the data it receives to Meta Platforms, Inc. in the United States. These transfers rely on (i) the EU-US Data Privacy Framework adequacy decision of 10 July 2023 (Meta Platforms, Inc. is a certified participant) and (ii) the Standard Contractual Clauses of Commission Decision (EU) 2021/914 as a fallback safeguard. For LGPD-covered transfers, Meta relies on the mechanisms set out in Articles 33–35 LGPD. You can review Meta's data policy at facebook.com/privacy/policy.
6. Your rights as a data subject
Under GDPR (Articles 15–22) and LGPD (Article 18) you can exercise the following rights free of charge:
- Access — obtain confirmation that we process your data and a copy of it.
- Rectification — correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”) — have your data deleted, subject to legal retention obligations.
- Restriction of processing — ask us to limit how we use your data in specific situations.
- Data portability — receive your data in a structured, commonly used, machine-readable format.
- Objection — object to processing based on legitimate interest, including profiling.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Anonymisation, blocking or deletion of unnecessary, excessive, or unlawfully processed data (LGPD Art. 18, IV).
- Information about public and private entities with which we have shared your data (LGPD Art. 18, VII).
- Information about the possibility of refusing consent and the consequences of that refusal (LGPD Art. 18, VIII).
- Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (GDPR Art. 22; LGPD Art. 20). The Lori-Talk landing page does not perform such automated decision-making.
To exercise any right, email [email protected] with the subject line “GDPR / LGPD request”. We answer within 30 days (extendable by a further 60 days where strictly necessary, with notice).
You also have the right to lodge a complaint with a supervisory authority — full contact details are in the Legal Notice.
7. Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (Art. 32 GDPR / Art. 46 LGPD). Measures include: encryption in transit (TLS), encryption at rest where the storage layer supports it, least-privilege access, segregation of duties, audit logging, periodic backups, vulnerability scanning, and incident response procedures. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, inform you directly.
8. Children
This site is not directed to children under 16 years of age. We do not knowingly collect personal data from children. If you believe we may have collected data from a child, please contact [email protected] and we will delete it.
9. Changes to this policy
We update this policy when our processing changes — for example, when we introduce a new feature or a new sub-processor. Material changes will be announced via the website and, where appropriate, by email. The version and last-updated date at the top of this page always reflect the current version.
10. Contact
For any privacy-related question or to exercise your rights:
Email: [email protected] (subject: “GDPR / LGPD request”)
Postal: CDN Core Technologies, Parkurbis, 6200-865 Covilhã, Portugal