Privacy notice (GDPR)

Last updated: October 23, 2026

This notice applies to anyone using Imóvel Gestor from the European Economic Area (EEA) and supplements the general Privacy Policy. It explains how we process personal data under Regulation (EU) 2016/679 (GDPR).

1. Who is responsible

• Controller for your account data: Elton Santos (Imóvel Gestor), Fortaleza/CE, Brazil.
• Privacy contact: elton.melo.santos@gmail.com

2. Two different roles

Your account data (name, email, password, subscription, app usage): Imóvel Gestor is the controller.

Data you record about others (tenants, guarantors, service providers — such as name, contacts, tax ID, ID document, rent amounts, receipts and contract documents): the landlord or manager using the app decides what to record and why. For that data, the landlord is the controller and Imóvel Gestor acts as a processor, processing it only to provide the service and on the landlord's instructions (see section 9).

3. What we process and why

• Account and sign-in — creating and keeping your account, signing in (including Google and Apple). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Property management — properties, contracts, rent, deposits, expenses, inspections with photos, maintenance, tax obligations and reports. Legal basis: performance of a contract.
• Subscription — plan status and App Store / Google Play events processed by RevenueCat. Legal basis: performance of a contract and legal obligations.
• Notifications — reminders of due dates and deadlines on your phone and by email. Legal basis: performance of a contract; push notifications depend on your device permission.
• Security and audit — access and change logs, abuse prevention. Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f)).
• Ads on the free plan — Google AdMob ads. Personalized ads only with your consent, requested through the consent message when you open the app (Art. 6(1)(a)). Without consent, only non-personalized ads are shown.
• Support — answering your messages. Legal basis: performance of a contract and legitimate interest.

We do not ask for photos of ID documents. If you choose to attach a tenant's document, you need a legal basis to do so and must inform the tenant.

4. Who we share data with

We do not sell personal data. We use providers that process data on our behalf:

• Supabase — database and file storage.
• Vercel — web application hosting.
• RevenueCat — store subscription management.
• Google — Google sign-in and AdMob ads.
• Apple — Sign in with Apple.
• Expo — push notifications.
• Resend — transactional email.
• Portuguese Tax and Customs Authority (AT) — only when a Max plan subscriber asks to issue an electronic rent receipt: we send that receipt's data (landlord and tenant tax IDs, contract number, period and amount) and the Portal das Finanças sub-user credentials entered at that moment. The password goes encrypted straight to the AT and is not stored.

5. Transfers outside the EEA

Some providers, and the controller itself, are outside the EEA (for example in the United States and Brazil). These transfers rely on European Commission adequacy decisions, including the EU-U.S. Data Privacy Framework where the provider is certified, or on standard contractual clauses approved by the Commission. You can ask for more information using the contact above.

6. How long we keep data

• Account and property data are kept while your account is active.
• When you delete your account (in the app, under Settings), data is erased, except what the law requires us to keep or what is needed to defend legal claims.
• Backups are deleted on the scheduled technical rotation.
• Security and audit logs may be kept for a limited additional period.

7. Your rights

You can ask for access, rectification, erasure, restriction and portability of your data, object to processing based on legitimate interest, and withdraw consent at any time (without affecting processing already carried out). Write to elton.melo.santos@gmail.com. We reply within one month.

You also have the right to lodge a complaint with the supervisory authority of your country; in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

If you are a tenant and a landlord recorded your data, please contact your landlord first, as they are the controller of that data. We can help them answer.

8. Security

• Passwords stored with bcrypt hashing; all traffic over HTTPS.
• Data separated per manager and role-based access control.
• Sessions end automatically after inactivity.

9. Processing tenant data on behalf of the landlord

When you record data about tenants and other people, Imóvel Gestor, as processor:

• processes that data only to provide the service and on your instructions;
• ensures that anyone with access is bound by confidentiality;
• applies appropriate technical and organizational security measures;
• only uses the providers listed in section 4, under equivalent obligations;
• helps you answer data subject requests and meet your obligations;
• notifies you without undue delay if it becomes aware of a personal data breach;
• deletes the data when you delete your account, unless the law requires retention.

The landlord is responsible for having a legal basis to process their tenants' data, for informing them and for recording only what is necessary.

10. Terms for users in the European Union

If you are a consumer living in the European Union, you keep the rights that the law of your country of residence grants you and that cannot be waived by contract, including the right to bring proceedings in the courts of your country. Subscriptions are bought on the App Store or Google Play and follow those stores' cancellation and refund rules.

Imóvel Gestor helps you organize your rentals but does not replace a lawyer or an accountant. Suggested deadlines and amounts (for example for reporting to the tax authority, stamp duty or rent updates) are indicative and must be confirmed for your situation.