Legal
Privacy policy
This notice explains how personal data is handled when you visit DesignCheer, make an enquiry, book a call or become a client. It also explains which services are optional and how to exercise your rights.
Last updated: 5 November 2026
1. Who controls your data
Antonio Bortone, a self-employed designer established in Portugal and trading as DesignCheer, is the controller for the business contact, booking, client-administration and website data described in this notice. DesignCheer is a trading name, not a separate limited company.
Business contact address: AV DOUTOR TEOFILO CARVALHO DOS SANTOS, N 194, AMADORA, 2720-111 AMADORA, Portugal. Contact hello@designcheer.com for privacy questions or requests.
If a project requires us to handle personal data on a client's instructions, such as their own customer records, the parties must agree the appropriate data-processing terms before that data is shared. This notice does not replace those terms.
2. Data we may collect
- Enquiries and client contacts: your name, email, business or role, any phone number you provide, and the information in your message. You may provide your own details or contact us on behalf of an organisation.
- Quote form: the services, extras, timing and existing materials you select, the resulting estimate, your name and email, and any website link or message you add. A hidden anti-spam field and the request time are also checked when you send it.
- Project delivery: briefs, references, files, feedback and messages you choose to share, including through Slack after accepting an invitation. Please do not send sensitive personal data or other people's data unless it is necessary and we have first agreed how it will be handled.
- Bookings: the name, email, appointment time and answers you submit to Cal.com, together with related scheduling messages. Any connected calendar or meeting service may also receive the information needed for that booking.
- Payments and administration: customer name, email, billing address and applicable tax details; amounts, payment status, invoices, accepted quotes and any early-start choices. Where an earlier monthly subscription is still active, Stripe collects payment details on its hosted services. This website does not collect full card numbers or card security codes into DesignCheer's own application.
- Technical and security data: requests to the hosted website can include IP address, browser or device details, request times and security or error information. Hosting and service providers can process these details to operate and protect their services.
- Browser storage: your booking-calendar choice and the essential checkout-security and client-access identifiers described below and in the cookie policy.
3. Purposes and legal bases
Only provide information needed for your request. We may be unable to respond, arrange the service or meet invoicing obligations if essential contact, project or billing details are missing. Booking through the embedded calendar is optional; you can contact us by email instead.
An enquiry, booking or purchase is not permission for unrelated promotional messages. Service emails about an order or support are separate from marketing. Any future marketing activity needs its own appropriate legal basis and any consent required by law.
- Answer your request, prepare a quote, send you a copy of your request by email or arrange a call: steps you request before entering a contract where you are the prospective client. When you represent an organisation, our legitimate interest is communicating with its relevant contact to assess and deliver the requested service.
- Deliver agreed services, manage your project, send service messages and provide support: performance of the contract with an individual client. For an organisation's contacts, our legitimate interest is administering that business relationship and coordinating its work.
- Issue and retain required fiscal documents and respond to lawful requests: compliance with applicable accounting, tax and other legal obligations.
- Secure the website, verify client access, prevent misuse and establish or defend legal claims: our legitimate interests in protecting the service, clients and legal rights, subject to a balancing of those interests against your rights.
- Load the optional embedded booking calendar and its associated optional browser storage: your consent through Cookie settings. You can decline or withdraw that permission without losing access to the website or checkout.
4. Who receives data
DesignCheer keeps client files in its work systems and the project services described below. Only authorised members of the DesignCheer team and relevant service providers may access them as needed to provide the service or meet legal obligations.
The service uses Resend to deliver quote-form requests to DesignCheer and to send you a confirmation copy, and for other transactional service messages; Stripe for the billing portal of any earlier monthly subscription; Vercel for website hosting; Cal.com when you choose its booking service; and Slack for client collaboration after a manual invitation. Google Workspace provides the business email.
Figma is the planned design tool. Figma and planned AI services are not assumed to receive client material until their use is agreed and the relevant arrangements are checked. Before a new tool is used with personal or confidential client data, the purpose, permissions, account terms and appropriate safeguards must be checked and any necessary client agreement obtained. Turning off AI training alone does not establish those arrangements.
Providers receive data relevant to the function they perform. Payment, booking and communication providers may also process some information for their own legal, security or account purposes. Their privacy notices explain those separate uses; a link to a provider notice does not replace DesignCheer's responsibilities or prove that its processing agreement has been checked.
Relevant records may also need to be disclosed to tax authorities, other competent authorities or professional advisers where legally required or necessary for the relevant obligation or legal claim. Access should be limited to the data needed for that purpose.
5. Optional calendar and essential storage
The embedded Cal.com calendar is not loaded until you allow it. Once loaded, it can receive technical information before you book and may use provider-controlled storage and security or diagnostic services. An earlier browser check observed Cloudflare and Sentry connections after calendar permission; it was not an inventory of every session or provider feature.
Your local calendar preference lasts up to 180 days for both acceptance and rejection. The essential checkout-security cookie lasts up to 24 hours and is cleared after successful access setup. A signed client-access cookie lasts up to 365 days, but its presence does not guarantee access: the server also checks the client record and any recorded revocation.
Use Cookie settings to change the calendar choice. Withdrawal stops the embedded calendar by removing it and reloading the page; it does not cancel an existing booking or delete cookies on another provider's domain. Direct visits to Stripe, Cal.com or Slack are subject to those providers' own notices and settings.
6. International processing
Our providers may process personal data outside the European Economic Area, including in the United States. Their applicable terms describe transfer safeguards, including EU adequacy decisions where applicable and the European Commission's Standard Contractual Clauses. Contact hello@designcheer.com for information about the destinations and safeguards relevant to your data, or a copy where applicable.
7. Retention
Retention depends on the record's purpose, not simply on whether a project is active. Relevant criteria include whether an enquiry is still being pursued, the service and support obligations that remain, applicable fiscal record-keeping periods, any dispute or legal claim, and the need to investigate a security incident. Data that is no longer needed should be deleted or anonymised rather than retained indefinitely.
The browser-storage limits above are not deletion periods for invoices, email, project files, provider logs or backups. Required fiscal and contract evidence is kept for its applicable legal purpose and period. Provider-managed logs and backups also follow the relevant service's retention and deletion arrangements; removing a working file does not promise immediate removal of every backup or log. No automatic project-file deletion deadline is promised.
8. Your rights and complaints
Under the GDPR, you may request access, correction, erasure or restriction of your personal data where the relevant conditions apply. You may object to processing based on legitimate interests. Portability applies to eligible data you provided where processing is automated and based on consent or a contract.
You can withdraw consent at any time, without affecting processing that was lawful before withdrawal. Some records may still need to be kept to meet legal obligations or handle legal claims, so deletion is not an absolute right.
Send requests to hello@designcheer.com. We respond without undue delay and normally within one month of receiving a request. If its complexity or the number of requests requires an extension of up to two further months, we explain the reason within the first month. Any identity check must be proportionate. Requests are normally free, subject to the GDPR rules for manifestly unfounded or excessive requests.
You can complain to the Portuguese Comissão Nacional de Proteção de Dados (CNPD), or to a competent supervisory authority where you live, work or believe an infringement occurred. You do not have to contact DesignCheer first to exercise that right.
9. Security and notice changes
The application uses signed client-access cookies, server-side access checks, origin checks and rate limits on the quote form, and verification of Stripe webhook signatures. Those technical measures do not guarantee that every system is risk-free, and no website or communication service can promise absolute security. Please do not send passwords, full card details or unnecessary sensitive information in project messages.
This notice will be reviewed when relevant services, practices or legal requirements change. The date above shows when this notice was last updated.