Legal Document
Privacy Policy
Last updated: October 2026 — KGEP, Lda — Registered in Portugal
This policy explains how KGEP collects, uses, and protects your personal data in compliance with the General Data Protection Regulation (GDPR / RGPD).
Data we collect
Email address, encrypted password (via Supabase Auth), and project details you submit. When signing in with Google, we receive your name and email from Google. We also store a consent timestamp at account creation. If you contact us through a form on this site, we store the details you enter. If you are a business prospect, see section 04.
How we use it
To create and manage your account, deliver CFD simulation services you request, reply to enquiries, and send transactional emails (account confirmation, project updates). Account and project data are processed to perform our contract with you (GDPR Art. 6(1)(b)). We do not sell your data or use it for advertising.
Analytics & engagement
We record how pages and shared project deliverables are used: page views, tabs opened, files downloaded, scroll depth, and time spent. IP addresses are stored only as a salted one-way hash. For signed-in users and for prospects who open a personal tracked link (section 04), these events are linked to that person. We use them to understand interest in our work and to improve the site, based on our legitimate interest (GDPR Art. 6(1)(f)). Access is restricted to our team.
Prospects & outbound outreach
We may contact businesses that could benefit from our services, using business contact details from publicly available sources. Links we share may include usage measurement (section 03). This is based on our legitimate interest in B2B outreach (GDPR Art. 6(1)(f)). You can object at any time by replying to the email or writing to privacy@zephyrcfd.com, and we will stop contacting you and delete your data. Prospect data is kept only as long as needed for outreach.
Data storage & processors
Account and prospect data are stored in Supabase (EU region). Project deliverable files are stored in Cloudflare R2. Engagement events are stored in PostHog (EU region). The site is hosted on Vercel and emails are sent through Resend; both are US providers and may process data outside the EU under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Account data is retained while your account is active and deleted within 30 days of an account deletion request.
Your rights (GDPR)
- —Access a copy of your personal data
- —Correct inaccurate information
- —Request deletion of your data
- —Object to processing based on legitimate interest, including outreach and engagement tracking
- —Withdraw consent at any time
- —Lodge a complaint with your national data protection authority (in Portugal, the CNPD)
To exercise any right, contact us at privacy@zephyrcfd.com. We respond within 30 days.
Cookies
We use a single session cookie required for authentication. No tracking, analytics, or advertising cookies are set; engagement events (section 03) are sent to our own server without cookies.