Privacy Policy

Last updated: November 2, 2026 · Version 3

1. Who is responsible for your data

The controller of your personal data in Casanostra is:

We process personal data under the EU General Data Protection Regulation (GDPR) and Portuguese law (Law no. 58/2019). For any privacy question or request, write to support.casanostra@gmail.com.

2. What we collect

• Account: email address, name (if you add one), password (stored only as a secure hash by our sign-in provider), how you sign in, and which version of the Terms and this policy you accepted and when.
• Houses and vehicles: names, addresses, details, rooms, appliances, warranties, maintenance and costs.
• Tasks, incidents, action items, notes, reminders and calendar dates.
• Files you upload, such as manuals, documents, photos and problem-report screenshots.
• Other people: contact details of people you add (for example a plumber) and the email address of co-owners you invite.
• Payments: when you pay, our payment provider handles your card or payment details — they never reach our servers. We only receive payment identifiers, amount, status and the method type. For invoices we keep the billing details you give us (name, tax ID, address).
• Feature requests and votes, quote requests (name, email, company, message) and problem reports you send us.
• Technical logs: IP address, browser, time of requests and errors, needed to deliver and secure the service.

3. Why we use it and on what legal basis

• Providing the service: your account, houses, vehicles, tasks, sharing, reminders and calendar links — performance of a contract (Art. 6(1)(b) GDPR).
• Payments, invoices and billing records — performance of a contract and legal obligation (Art. 6(1)(b) and (c)).
• Security, preventing abuse and fixing errors — legitimate interest (Art. 6(1)(f)).
• Answering problem reports, quote requests and feature requests — legitimate interest or steps before a contract (Art. 6(1)(f) and (b)).
• Optional analytics, if we ever add them — consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not sell your data and we do not use it for advertising.

4. Who processes data for us

We only share data with the people you invite to a house or vehicle and with these service providers, under data processing agreements:

• Vercel Inc. (USA) — hosts and delivers the website. Receives IP addresses and request logs. Transfers outside the EEA are covered by the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.
• Supabase Inc. — database, sign-in and file storage. Your data is stored in the EU (Ireland). Any access from outside the EEA (for example support) is covered by the EU Standard Contractual Clauses.
• Google (Google Fonts) — the app's fonts are loaded from Google's servers, which receive your IP address and browser details. Covered by the EU-U.S. Data Privacy Framework.
• Cloudflare, Inc. (USA) — Turnstile checks that a person, not a bot, is signing up or signing in. It receives your IP address and browser details on the sign-in page and does not set advertising cookies. Covered by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
• Google and Lovable — only if you choose "Continue with Google": Google confirms your identity and Lovable (lovable.dev) provides the sign-in connection.
• Payment providers — Revolut Bank UAB (Lithuania) and Mollie B.V. (Netherlands), both in the EU, process payments once paid plans are live.

If you add a calendar link to Google, Apple or Outlook Calendar, that provider fetches your dates from us under its own privacy policy. We do not use analytics, advertising or email marketing services.

5. How long we keep it

• Account and content: as long as your account exists. When you delete your account, your content is deleted straight away. Houses and vehicles you move to the trash are deleted after 30 days.
• Payments, invoices and the billing details on them: 10 years, as required by Portuguese tax law.
• Backups: kept by our database provider and overwritten automatically; deleted data disappears from them within 30 days at most.
• Technical logs: kept for a short period by our hosting provider.
• Problem reports and quote requests: as long as needed to deal with them; you can ask us to delete them at any time.

6. Your rights

You can ask us to access, correct, delete, restrict or port your data, object to processing based on legitimate interest, and withdraw consent at any time. Many of these you can do yourself: Profile & settings → Download my data, and Profile & settings → Delete my account. For anything else, write to support.casanostra@gmail.com. We reply within one month.

You can also complain to the Portuguese data protection authority, CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt).

7. Other people's data

If you add contact details of others (a plumber, a cleaner), make sure they are fine with it. They can ask us to remove their data.

8. Security

Data is encrypted in transit, access is restricted per account, and files are stored privately.

9. Minimum age

Casanostra is not intended for anyone under 16. We do not knowingly collect data from children under 16.

10. Changes

If we change this policy in an important way, we will tell you in the app before the change applies. The version and date are shown at the top.