How we process personal data

The Selfcare service is human resources and payroll software provided by Selfcare, Lda., legal person no. 510803890, with registered office at Av. Duque D'Ávila n.º 46, 3.º A, 1050-083 Lisboa ("Selfcare", "we").

For any question about privacy or to exercise a right, the contact is ola@selfcare.work.

Selfcare processes personal data in two different roles, depending on the origin of the data.

Data of our customers' employees

When a company uses the Selfcare service to manage its team, that company (the customer) is the controller of its employees' data: it decides what data it records, for what purposes and who has access to it. Selfcare acts as processor, under Article 28 of the GDPR, processing that data only on behalf of and according to the instructions of the customer, under a data processing agreement (DPA) that forms part of the contract. An employee who wishes to exercise their rights over this data should contact their employer first; if they contact us directly, we forward the request and help the customer respond.

Data of our customers, users and visitors

Selfcare is the controller of the data it processes to manage its own relationship with customers and visitors: user account data, subscription billing, demo requests, support requests and usage statistics for the site and the application.

• Account data: name, email, password (stored only as a bcrypt hash), role in each company, preferences (language, theme), trusted devices and sign-in logs. If you sign in with Google, we receive the name, email and profile photo of that account.
• HR and payroll data entered by the customer: identification (name, date of birth, NIF, NISS (social security number), identity document), contact details and address, IBAN, contract and compensation data (salary, allowances, working hours), tax and family situation for the purposes of IRS (personal income tax), teams and areas, absences and annual leave (including health-related absence types, such as sickness), expenses and ajudas de custo (per diem) with the respective supporting documents, payslips (recibos de vencimento) and employee documents.
• Usage and technical data: audit log of actions that change data (who, what and when), log of access to documents, IP address and browser user agent in technical logs, application errors and browsing statistics.
• Billing data: name or company name, NIF and billing address, billing email, subscription and payment history. Card data is processed directly by Stripe: Selfcare never receives the full card number.
• Demo requests: name, email, company, number of employees, telephone (optional, only on this form) and whatever you write to us.
• Support requests: received only by email, at suporte@selfcare.work: the address of the person writing and the content of the message.
• Integration data: when the company or the employee connects external services (for example Slack), the identifiers and tokens needed for that connection, described in section 9.

Health data (such as the type of a sickness absence) falls within the special categories under Article 9 of the GDPR. In the Selfcare service, health-related absence and document types are hidden from those who do not need to know them, and are never named in emails, notifications or messages sent to Slack.

The legal bases are those of Article 6(1) of the GDPR:

• Providing the contracted service (accounts, authentication, HR and payroll features, product emails and notifications, support): performance of the contract, point (b).
• Billing subscriptions and complying with tax and accounting obligations: compliance with a legal obligation, point (c), and performance of the contract, point (b).
• Security, prevention of abuse and fraud, audit logging and error monitoring: legitimate interest in keeping the service secure and available, point (f).
• Usage statistics to improve the product: legitimate interest, point (f), without creating profiles of anonymous visitors and without advertising.
• Responding to demo requests and commercial enquiries: pre-contractual steps at the request of the interested party, point (b), and legitimate interest, point (f).

For employee data, the purpose and legal basis are defined by the customer as employer, typically the performance of the employment contract and compliance with employment, tax and social security legal obligations (Article 6(1)(b) and (c), and Article 9(2)(b), of the GDPR).

We do not sell personal data or use it for advertising.

To provide the service we use the following suppliers, which process data on our behalf, under data processing agreements:

The customer may also connect the Selfcare service to other services on its own initiative (through the public API, the MCP server or webhooks, for example). In those cases, the data goes to the destination the customer has chosen and configured.

The data of the service is hosted in the European Union. Some suppliers belong to groups headquartered outside the European Economic Area, mainly in the United States, and may access data from there (for example, for technical support). When this happens, the transfer is protected by the standard contractual clauses approved by the European Commission and, where applicable, by the supplier's certification under the EU-US Data Privacy Framework.

• Data of the customer and its employees: for as long as the contract lasts. The customer decides what it deletes during that period. After the contract ends, the data remains available for export for 30 days and is then deleted, except for what the law requires us to keep.
• Payroll and tax records: the legal obligation to keep them (for example, 10 years for accounting and tax documents) lies with the employer. We recommend that the customer exports payslips, mapas (payroll reports) and returns before the end of the contract.
• Subscription billing: 10 years, as required by Portuguese tax and accounting legislation.
• Audit log: for as long as the company's account exists, because it serves to show who did what.
• Database backups: replaced cyclically, within a maximum of 30 days.
• Demo requests without a contract: up to 2 years after the last contact.
• Technical and error logs: for the short periods set by each supplier.

• All traffic goes through HTTPS, and the connection to the database requires TLS.
• Integration tokens (such as Slack's) and other sensitive fields are encrypted in the database with AES-256-GCM. Passwords are never stored: we store only a bcrypt hash.
• Two-step verification by email is mandatory for all users, at every sign-in.
• Each role (owner, HR, manager, employee, accountant) sees only what that role allows. NIF, NISS, IBAN and salaries stay with those who manage the company and with the employee themselves.
• Payslips, documents and supporting documents are kept in private storage and open only through routes that confirm the session and the permission of the person requesting them.
• Actions that change data are kept in an audit log that cannot be edited. When the Selfcare team needs to enter an account to provide support, the access requires a reason, lasts at most four hours, is visible in the account and is recorded in the audit log.
• Error monitoring does not send the IP address and masks text and form fields in session recordings.

The Slack integration is optional. It exists only when a company installs it and, for personal functions, when each employee connects their own Slack.

When the company installs the app

An owner or a person responsible for HR installs the Selfcare app in the company's Slack workspace. The app requests these bot permissions:

• chat:write: send Selfcare notifications by direct message (requests to approve, decisions, reminders).
• users:read and users:read.email: match each Slack user to the Selfcare employee with the same email.
• im:write, im:read and im:history: open direct conversations with the bot and read the messages sent directly to it.
• app_mentions:read: read the messages in which the bot is mentioned.
• commands: respond to the /selfcare command.

When the employee connects their Slack

• users.profile:read and users.profile:write: read and set the Slack status during an approved absence (for example, "On holiday" or "Away"). The status never shows the type of absence, only whether it is annual leave or another absence.
• dnd:write: pause Slack notifications during the absence.

What the app does not do

The Selfcare service does not read channel messages. It reads only direct messages sent to the bot and messages that mention the bot, and only when those functions are active.

How we store it and how to remove it

• We store the workspace identifier, the identifiers of the Slack users associated with each employee and the access tokens. The tokens are encrypted with AES-256-GCM.
• Each employee can disconnect their Slack in Settings → Integrations → Slack. The token is revoked with Slack and deleted.
• The company can remove the app from the workspace in Slack (Slack administration → Apps). When the app is uninstalled or the tokens are revoked, Slack invalidates them immediately and the Selfcare service can no longer access the workspace. The stored tokens, no longer in use, are deleted on request to ola@selfcare.work.
• Slack identifiers are kept for as long as the integration is active and deleted when the employee disconnects their account or at the company's request. The audit log records that the connection existed, never the tokens.

Under Articles 15 to 22 of the GDPR, you have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw any consent you have given, without prejudice to processing already carried out.

For data we process as controller, write to ola@selfcare.work. We reply within one month, which may be extended in the cases provided for in Article 12 of the GDPR. For employee data, the request should be addressed to the employer; if it reaches us, we forward it.

You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, at www.cnpd.pt.

The application uses cookies essential to its operation, which do not require consent:

• Session and security (authjs.*): keep you signed in and protect forms.
• Trusted device (selfcare_td): waives the email code for 30 days on the device you choose.
• Active company (selfcare_tenant): remembers the company you are working in, for those who have several.
• Preferences (selfcare_theme, selfcare_locale and view cookies, such as the state of the sidebar): remember the theme, the language and how you prefer to see lists.

In production, the site and the application also use PostHog, hosted in the EU, for usage statistics. PostHog stores an identifier in the browser and does not create profiles of anonymous visitors. We do not use advertising cookies or pixels.

We may update this policy when the service or the law changes. The date of the last update is at the top of the page. Relevant changes are communicated to customers in advance, by email or within the application.

See also the Terms and Conditions and the Security and GDPR page.