Privacy Policy

    This policy explains how ALpronto collects, uses, and protects your personal data, in compliance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and applicable Portuguese law.
  

Data controller
Data we collect
How we use your data
Legal bases for processing
Who we share data with
How long we keep your data
Your rights
Security
Cookies
Contact and complaints

1. Data controller

The data controller for personal data is the operator of the ALpronto service, available at alpronto.com and app.alpronto.com.

For privacy-related enquiries, you can contact us at: [email protected]

2. Data we collect

2.1 Registration and account data

When you create an ALpronto account, we collect:

Full name
Email address
Password (stored in encrypted form, never in plain text)
Registration date

2.2 Platform usage data

While using the app, the data you enter is processed on your behalf:

Booking information (guests, dates, amounts)
Lead and potential guest data
Issued quotes
Property configurations

This data belongs to you. ALpronto acts as a data processor when handling this data.

2.3 Technical data

IP address (anonymised)
Browser type and version
Access timestamps (security logs)

2.4 Payment data

ALpronto does not store credit card data. Payment processing is entirely managed by Polar.sh (Polar Software Inc.), which acts as the Merchant of Record for ALpronto transactions.

As Merchant of Record, Polar is responsible for processing payment data, issuing invoices, and fulfilling associated tax obligations. The data Polar collects during the purchase process (name, billing email, card details) is handled in accordance with Polar's Privacy Policy.

ALpronto only receives from Polar a confirmation of active subscription and the customer identifier — without access to card data or detailed financial information.

3. How we use your data

Purpose	Data used
Providing the ALpronto service	All account and usage data
Authentication and security	Email, encrypted password, IP, logs
Service communications	Email (updates, account alerts)
Subscription and payment management	Email, plan data
User support	Email, data relevant to the enquiry
Product improvement	Anonymised usage data

We do not use your data for third-party advertising. We do not sell or share user data with advertisers.

4. Legal bases for processing

Performance of a contract (Art. 6(1)(b) GDPR) — to provide the service you subscribed to
Consent (Art. 6(1)(a) GDPR) — for marketing communications, if you opt in
Legitimate interest (Art. 6(1)(f) GDPR) — for security, fraud prevention, and service improvement
Legal obligation (Art. 6(1)(c) GDPR) — when required by applicable law

We share data only with the following processors, strictly to provide the service:

Entity	Purpose	Location
Cloudflare, Inc.	Infrastructure, hosting, CDN, database	USA (adequacy + SCCs)
Polar.sh (Polar Software Inc.)	Payment and subscription processing	USA (adequacy + SCCs)

For transfers to countries outside the European Economic Area, we ensure appropriate safeguards (Standard Contractual Clauses or an adequacy decision by the European Commission).

We do not share data with third parties for marketing or advertising purposes.

6. How long we keep your data

Data type	Retention period
Active account data	As long as the account is active
Data after cancellation	30 days (then permanently deleted)
Payment records	10 years (legal tax obligation)
Security logs	90 days
Support data	3 years after resolution

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you
Right to rectification — correct inaccurate or incomplete data
Right to erasure ("right to be forgotten") — request the deletion of your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interest
Right to restriction — restrict processing in certain circumstances
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, send an email to [email protected]. We will respond within a maximum of 30 days.

    You can delete your account and all associated data at any time directly in the app settings under Account → Delete account. Deletion is permanent and occurs immediately for operational data (exception: tax records that the law requires us to retain).
  

8. Security

We implement technical and organisational measures to protect your data:

Encrypted transmission via HTTPS/TLS at all points
Passwords stored with hashing — never in plain text
JWT authentication with automatic expiration
Infrastructure on the Cloudflare network with DDoS protection
Automatic backups and geographic redundancy
Database access restricted and authenticated

In the event of a data breach posing a risk to your rights, we will notify the CNPD (Portuguese Data Protection Authority) within 72 hours and contact affected users without undue delay.

9. Cookies

ALpronto uses only cookies that are strictly necessary for the operation of the service:

Cookie	Purpose	Duration
ps_token	JWT authentication (login session)	7 days
alpro_*	Local app data cache (localStorage)	Session

We do not use tracking, advertising, or third-party analytics cookies. There is no Google Analytics, Facebook Pixel, or similar tools installed.

10. Contact and complaints

For any questions about this policy or the processing of your personal data:

Email: [email protected]

If you believe your rights have not been respected, you have the right to lodge a complaint with the competent supervisory authority in Portugal:

CNPD — Comissao Nacional de Proteccao de Dados (Portuguese Data Protection Authority)
Rua de Sao Bento, 148-3o, 1200-821 Lisbon
www.cnpd.pt

This policy may be updated periodically. The date of the last update is indicated at the top of this document. Significant changes will be communicated by email to registered users.

Table of Contents