Privacy.

This grant is funded by many small donations. To process them, we collect some personal data. This policy explains what we collect, what it is used for and what rights you have. We collect only what is essential, we never sell data, and card details never touch our servers.

Who is responsible

The Luís Andrade Barreira Grant (“the Grant” or “we”) is the controller of your personal data. The grant is a partnership between the Andrade Barreira family, who run it, and i3S — Institute for Research and Innovation in Health (Porto), the scientific partner that selects and monitors the projects and holds the capital in escrow until it is invested.

For any privacy question, or to exercise your rights, write to privacidade@bolsaLAB.org.

What data we collect

When you donate: your name, your email and the amount. Optionally, a message and your consent to appear on the public list of donors.

Card details (number, expiry, CVC) are collected and handled directly by Stripe, our payment processor, and never pass through our servers.

Minimal technical data needed to run the site, used only for security and to prevent abuse (for example, rate-limiting by IP address).

What we use it for

To process and confirm your donation (one-off or monthly) and manage recurring donations.

To meet legal, accounting and tax obligations, including issuing receipts where applicable.

To contact you about your donation and, only if you consent, about the progress of the grant and the funded projects.

To show the public list of donors — only with your explicit consent, showing only your name (and your message, if left) and never your email.

To produce aggregate transparency statistics (amounts, number of supporters, projects funded), which do not identify you.

On what legal basis (GDPR)

Performance of the donation you request (pre-contractual/contractual relationship); compliance with legal obligations (tax and accounting); your consent (public list and communications); and our legitimate interest in keeping the service secure and preventing fraud.

Who we share it with

We use processors that handle data on our behalf and only to provide the service: Stripe (payments), Supabase (database) and Vercel (hosting).

The scientific partner (i3S) receives only the information needed to select and monitor projects on merit — it does not receive donor data.

We do not sell, rent or hand over your data for third-party marketing.

How long we keep it

We keep data for as long as the relationship lasts and for the periods required by law (for example, accounting and tax obligations). After those periods, data is deleted or anonymised.

International transfers

Some processors may handle data outside the European Economic Area. When that happens, it is done with appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

Your rights

You can access, correct, delete, restrict or object to the processing of your data, request portability, and withdraw consent at any time (without affecting processing already carried out). To exercise any right, write to privacidade@bolsaLAB.org.

You also have the right to lodge a complaint with the supervisory authority — in Portugal, the CNPD (www.cnpd.pt).

Public list of donors

The public list includes only those who gave explicit consent when donating. It shows only the name (and an optional message), never the email nor the individual amount when that is not public. You can ask to be removed at any time by writing to the address above.

Cookies

We use only cookies essential to running the site. See the cookie policy for details.

Changes to this policy

We may update this policy to reflect legal or service changes. We publish the version in force here, along with its update date.

Last updated: July 2026