PRIVACY POLICY AND PERSONAL DATA PROTECTION
1. Controller and contact details
The controller responsible for personal data processed through BACK TO FUTURE is [FULL LEGAL NAME / COMPANY], with registered or professional address at [POSTAL ADDRESS], tax/company identification [NIF / REGISTRATION DETAILS]. Privacy enquiries and requests concerning personal data may be sent to [PRIVACY EMAIL]. If a Data Protection Officer is formally appointed, the DPO may be contacted at [DPO CONTACT — IF APPLICABLE].
2. Scope of this Policy
This Policy explains how personal data are collected and used when a user visits the website, completes the questionnaire, requests or purchases a report, contacts support, or uses related payment and security functions. It should be read together with the Terms & Conditions and any cookie/consent notice shown on the website.
3. Data we collect and where it comes from
Most personal data are collected directly from the user. Depending on the information voluntarily provided, this may include name, age/date of birth, city and country, education, occupation and professional context, marital status, stated work/financial stability, goals, interests, concerns, preferences, decision style, routines, available time, support network, planned or recent changes and other information entered in the questionnaire.
We may also process technical and security information generated by use of the service, such as IP address, browser/device information, timestamps, session/security identifiers and error logs. Payment providers may return transaction status, payment identifiers, country and limited billing information necessary to confirm payment and prevent fraud. BACK TO FUTURE should not receive or store complete payment-card numbers.
Providing the minimum information identified as required in the questionnaire is necessary to generate the requested personalised analysis. Optional fields may be left blank. If insufficient information is supplied, the service may be unable to generate a meaningful report.
4. Sensitive and special-category data
Do not submit special-category or highly sensitive personal data in free-text fields, including health or medical information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data used for identification, or information about sex life or sexual orientation. Do not submit sensitive or confidential personal data about third parties.
The production system should be configured to minimise, block or remove such data before AI processing wherever reasonably possible. If such information is submitted unintentionally, it should not be intentionally used to create a more intrusive profile and should be deleted or redacted in accordance with the applicable retention and deletion procedures, unless a separate lawful basis and appropriate safeguards have been established.
5. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Receive questionnaire information, generate and deliver the personalised report | Performance of a contract / steps requested before entering into a contract (GDPR Art. 6(1)(b)) |
| Process and confirm payments, issue legally required billing records and meet tax/accounting obligations | Performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c)) |
| Security, fraud prevention, abuse prevention and defence of legal claims | Legitimate interests and/or legal obligations, subject to applicable safeguards (Art. 6(1)(f) and/or (c)) |
| Customer support and service communications | Performance of a contract and/or legitimate interests (Art. 6(1)(b) and/or (f)) |
| Optional non-essential analytics or marketing | Consent where required (Art. 6(1)(a)); such processing must remain separate from the purchase and report-generation process |
BACK TO FUTURE does not sell personal data. Questionnaire answers and report content should not be used for unrelated marketing, advertising or model-training purposes unless a separate, valid legal basis and any required consent have been obtained.
6. How AI-assisted analysis works
The service may use automated rules and artificial-intelligence-assisted analysis to normalise questionnaire answers, identify relevant signals, compare relationships between different answers, detect tensions or supporting factors, and generate a personalised narrative containing plausible scenarios, turning points and indicators to observe.
The analysis is interpretative rather than deterministic. A “data completeness” or “data sufficiency” indicator measures only the completeness and contextual richness of the information supplied; it is not a probability that a scenario will occur.
The output does not make a decision that produces legal effects or similarly significant effects concerning the user. It is intended to support reflection, not to determine access to employment, credit, insurance, healthcare, education, public services or other significant opportunities.
7. AI provider transparency
Users are informed before submission that artificial intelligence contributes materially to the analysis and that the resulting report contains AI-assisted/generated text. This transparency notice is intended to support the applicable EU AI-transparency framework. The operator must continue to monitor the final production role it has under the EU Artificial Intelligence Act and any applicable implementing measures.
Where the OpenAI API is used as an AI-processing provider, questionnaire-derived inputs may be transmitted to OpenAI for the sole purpose of generating the requested analysis. OpenAI currently states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in. Under default API data controls, certain abuse-monitoring logs may be retained for a limited period. The operator must keep its API data-control configuration under review and ensure that its contractual/data-processing arrangements and this Policy accurately reflect the production setup.
AI use must be disclosed clearly before the questionnaire is submitted and before payment. The user should understand that some text in the report may be generated or edited with AI assistance.
8. Recipients and service providers
Personal data may be disclosed only where necessary to service providers acting for or with the controller, including: [HOSTING/CLOUD PROVIDER]; OpenAI or another specifically identified AI provider; Stripe and/or PayPal for payment processing; [EMAIL/SUPPORT PROVIDER, IF USED]; and professional advisers or public authorities where disclosure is legally required.
Before launch, the operator must identify the actual providers used in production, define their roles (for example, processor or independent controller where appropriate), and put required data-processing agreements in place.
9. International data transfers
If personal data are processed outside the European Economic Area, transfers will take place only where a lawful transfer mechanism and appropriate safeguards apply, such as an adequacy decision, Standard Contractual Clauses or another mechanism permitted by applicable law. Where required, supplementary measures and transfer-risk assessments will be used. The actual providers and transfer mechanisms must match the production deployment.
10. Retention and deletion
The production application is configured to delete generated report records from its own application database after a maximum of 30 days by default. The customer-facing download entitlement is more limited: the current service allows up to three authorised downloads during the 24-hour period beginning with the first authorised download. These operational limits do not replace any mandatory consumer remedy.
The BFL Customer administrative register contains limited order/customer fields needed for order support, payment reconciliation, invoicing/accounting, fraud/security, legal claims and management reporting. Those records, payment records and invoices are retained only for as long as required by the applicable contractual, tax, accounting or legal-obligation purpose. Security and diagnostic logs are retained for [DEFINE AND IMPLEMENT SECURITY-LOG RETENTION PERIOD].
Where OpenAI API processing is used, provider-side retention is governed by the production API configuration and OpenAI's applicable data controls. Under standard API data controls, API data are not used to train OpenAI models by default unless the customer opts in, while abuse-monitoring logs may be retained for up to 30 days. The operator must keep this configuration and statement under review.
Retention periods must be enforced technically and reviewed periodically. Data must not be retained merely because storage is available.
11. Security
BACK TO FUTURE will use technical and organisational measures appropriate to the risk, including HTTPS in production, access controls, strong authentication for administrative areas, secret/API-key management, least-privilege access, secure payment-provider integrations, data minimisation, logging appropriate to risk, software updates, backups where necessary and retention/deletion controls. Server-side source files, secrets and administrative data are not intended to be served as public website assets. Security headers and access controls are used to reduce unauthorised access. No online system can guarantee absolute security.
12. Your data-protection rights
Subject to applicable law and the circumstances of the processing, users may have rights of access, rectification, erasure, restriction, objection and portability, and may withdraw consent at any time where consent is the legal basis, without affecting the lawfulness of processing before withdrawal. Requests may be sent to [PRIVACY EMAIL]. Identity verification may be requested where reasonably necessary. Requests will be handled without undue delay and within the periods required by law.
Users may lodge a complaint with the competent supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).
13. Automated decision-making rights
BACK TO FUTURE is not designed to make solely automated decisions producing legal effects or similarly significant effects within the meaning of GDPR Article 22. If the service changes in a way that introduces such decision-making, users will receive the legally required information and safeguards before that processing begins.
14. Children
The service is intended only for persons aged 18 or over. Users under 18 must not submit the questionnaire or purchase the service.
15. Cookies, local storage and analytics
The service may use strictly necessary cookies, session storage or local storage for security, form continuity, payment flow and other essential functionality. Non-essential analytics, advertising or tracking technologies must not be activated until users have received the required information and, where required, have made a valid consent choice. Refusing non-essential tracking must not prevent access to the paid service.
First-party service metrics. The production application may keep aggregate counters for events such as page visits, questionnaire starts, report generation, payment initiation, payment confirmation and downloads. These counters are designed not to store questionnaire answers, report contents, IP addresses or browser identifiers in the analytics file and are used to understand service performance and conversion.
16. Changes to this Policy
This Policy may be updated to reflect changes in the service, providers, data flows or legal requirements. Material changes will be communicated appropriately. Last updated: 11 October 2026.
17. Important limitation of the report
Reports, profiles, scenarios and other outputs are provided for informational and analytical purposes. They are not guarantees, promises or factual determinations about future events and do not constitute financial, investment, tax, legal, medical, psychological, employment, insurance or other professional advice. Users should obtain appropriately qualified professional advice before making consequential decisions.