The fine print, in plain English.

WizardingCode (WizardingCode Labs - Desenvolvimento de Software e Consultadoria Digital, Unipessoal, Lda.), NIF PT516703048, registered in Cascais, Portugal, is the controller of the personal data described here.

Questions about privacy go to [email protected]. We answer within 30 days, usually much faster.

Contact details you give us: name, work email, phone number, company and website.

The answers you share when you book a call, and what you tell us in emails or on the call. The scheduler (Cal.com) receives the email and answers you typed at step 1 to prefill the booking, and keeps the campaign fields and the Meta click identifier of the link that brought you here as booking notes.

The campaign that first brought you to the site, if any: the utm parameters and click identifiers of the link you followed and the site that referred you, stored as received in your browser for 90 days and sent to us with a form you submit (and to Cal.com with a booking, as above). Each form you submit also carries a random identifier and the answers you chose from a list (company size, work areas, the campaign you came from); the answers go to Google Analytics as a cookieless event whatever your cookie choice, the identifier only if you accept analytics (and to Meta only if you accept marketing), never what you typed.

Applications: your CV, links and anything you send us when you apply for a role.

Usage data: until you choose in the cookie banner, and if you reject, the Tag Manager script sends Google cookieless pings (the page, your IP address and browser, the events above) with every signal denied and no identifier of you; if you accept analytics, Google Analytics measures your visit in aggregate with cookies. The cookie policy has the detail.

To reply and book calls: steps you ask for before a possible contract, and our legitimate interest in answering you.

To know which campaigns bring us the people we talk to: our legitimate interest in measuring our advertising, using the campaign origin stored with your form. You can object at any time (see 07).

To measure the site and our advertising with cookieless pings that carry no identifier of you, before you choose in the cookie banner and if you reject: our legitimate interest; for cookies and for the identifier of your form: your consent, which you can withdraw in the footer.

To deliver our services: performance of the contract we sign with you or your company.

To send the monthly note: your consent, which you can withdraw in one click.

To hire: steps before a contract; and, if you agree, to keep you in our talent pool.

Service providers that help us run the business, under data processing agreements: scheduling (Cal.com, which also keeps the campaign notes of a booking), email and calendar (Google Workspace), hosting (Cloudflare, Supabase), analytics and advertising measurement (Google Analytics and Google Ads through Tag Manager, Meta) with the chosen answers and, with your consent, the random identifier described in 02, never what you typed.

We do not sell or rent personal data. We do not use your data to train AI models.

Some providers process data outside the European Economic Area. When they do, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

Leads and contacts: 24 months after our last conversation.

Clients: for the length of the contract and the periods Portuguese law requires for accounting records.

Applicants: 12 months, or longer only with your consent.

Newsletter: until you unsubscribe.

You can ask to access, correct, delete, restrict or move your data, and object to how we use it. Where we rely on consent, you can withdraw it at any time.

If you think we got something wrong, you can complain to the Portuguese data protection authority, CNPD (cnpd.pt).

When we build or run an Agentic OS for you, you are the controller of your business data and we act as your processor, under a separate data processing agreement.