Privacy Policy

1. Who we are

Kapital Keys (the "Service") is operated by João André Anica Galhardo, a sole trader registered in Portugal (Tavira) under tax number NIF 226 271 501 ("Kapital Keys", "we", "us", "our"). We are the controller of the personal data we collect about visitors to our marketing site and account holders ("you"). When you use Kapital Keys to manage staff, guests, or operations, we act as a processor for the personal data of those individuals on your behalf.

Contact for privacy questions: hello@galhardo.cloud.

2. Data we collect

Account data (you, the operator)

• Name, email address, password hash.
• Organization name, slug, currency, timezone, language preference.
• Subscription status, billing email, invoices.
• Sign-in events, IP addresses, device/browser metadata for security.

Workspace data (you input — about your business)

• Properties, units, sectors, task templates, schedules, shift codes.
• Bookings (guest names, check-in/out, channel, notes).
• Maintenance tickets and attached photos.
• Activity log of actions taken in the app.
• Invitations sent to your team (email + role).

Guest data (about your guests, processed on your behalf)

• Booking requests from your website: name, e-mail or phone, dates, number of guests and children's ages, message.
• Online check-in: for each guest, name, nationality, date and place of birth, identity document (type, number, issuing country) and country of residence, as SIBA requires; estimated arrival time; extras requested.
• Invoice details, only if the guest asks for an invoice with them: name or company name, tax number, address, e-mail.

When the law requires it, guest registration data is sent to AIMA through SIBA using your access key, which is stored encrypted. You remain the controller of your guests' data; we process it only to provide the Service to you.

Staff data (about your team members, processed on your behalf)

• Name, email, role, schedule, completed tasks.
• Optional: clock-in/out events, location-tagged check-ins (only if you enable them).

Telemetry

• Activation and usage events (e.g. org.created, property.created, daily_board.viewed) stored in our own database. We do not use Google Analytics, Facebook Pixel, or similar third-party trackers.
• Aggregate, non-identifying metrics on the marketing site if a privacy-first analytics tool is enabled (Plausible, Fathom, or PostHog with cookieless mode).

3. Why we use it

• To provide the Service: authenticate you, render your workspace, run jobs you trigger.
• To bill subscriptions and issue invoices.
• To send transactional email (invites, password resets, receipts, security alerts).
• To provide customer support when you contact us.
• To detect and prevent abuse, fraud, and security incidents.
• To improve the product based on aggregate, de-identified usage signals.

We do not sell your data, share it with advertisers, or use it to train external machine learning models.

4. Lawful basis (GDPR Art. 6)

• Contract — processing your account, workspace, and billing data is necessary to provide the Service you signed up for.
• Legal obligation — invoicing, tax records, and legally required disclosures.
• Legitimate interests — security, fraud prevention, product improvement based on aggregate usage. Balanced against your rights and freedoms.
• Consent — only for optional features such as marketing emails. You can withdraw consent at any time.

5. Who we share it with

We share data only where strictly necessary, and only with parties bound by confidentiality and data-protection terms:

• Subprocessors listed in §6.
• Authorities, when compelled by valid legal process. We will challenge overly broad requests.
• An acquirer, in the event of a merger or asset sale, with prior notice and the same protections.

6. Subprocessors

The following processors handle data on our behalf:

We do not use payment processors (guests pay hosts directly) or marketing analytics. Any new subprocessor, such as an e-mail delivery service, will be added here first.

We post material changes to this list on this page at least 30 days before they take effect.

7. Where it lives

Your account, workspace, and staff data are stored in the European Union (Supabase Frankfurt region by default). Some subprocessors operate globally; in those cases, transfers outside the EU are governed by the European Commission's Standard Contractual Clauses and additional safeguards where required.

8. How long we keep it

• Active accounts — for the life of the account.
• Cancelled accounts — workspace data deleted within 30 days after the end of the billing period, except where retention is legally required.
• Invoices and tax records — kept for 10 years as required by Portuguese law (Decreto-Lei n.º 28/2019).
• Guest registration (check-in) data — foreign guests: one year after the stay, as Portuguese law requires for the boletins de alojamento (Lei 23/2007, art. 15.º, n.º 5); Portuguese guests: 30 days after check-out. Then deleted.
• Guest invoice details — kept for the 10 calendar years after the year of the stay, as Portuguese tax law requires (CIVA art. 52.º), then deleted; if the stay was cancelled and not invoiced, deleted 12 months after the check-out date.
• Booking requests that do not become a stay — name, contacts and message removed after 12 months; dates and amounts kept for statistics.
• Security logs — kept for 90 days.
• Telemetry events — kept for 24 months, then aggregated.
• Backups — encrypted, retained for 30 days.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Portability — receive a machine-readable export.
• Withdraw consent at any time, where consent is the basis.
• Lodge a complaint with your supervisory authority. In Portugal: Comissão Nacional de Proteção de Dados (CNPD).

To exercise any right, email hello@galhardo.cloud. We respond within 30 days. Identity verification may be required for sensitive requests.

10. Security

• All data in transit is encrypted with TLS 1.2+.
• All data at rest is encrypted (AES-256 on Supabase managed Postgres and storage).
• Row-level security isolates each organization's data at the database layer.
• Authentication uses bcrypt-hashed passwords; sessions are JWT-signed and rotated.
• We log access to production systems and audit it monthly.
• We require single sign-on with hardware-backed 2FA for all staff with production access.

Despite our controls, no system is perfectly secure. If you suspect a security issue, email security@kapitalkeys.com.

11. Cookies

The marketing site uses no cookies by default. The product uses:

• Strictly necessary cookies — session and CSRF tokens. Cannot be disabled.
• Functional cookies — remembering your sidebar collapse state, language, and preferences. Stored in localStorage, not third-party cookies.

We do not set advertising cookies, tracking cookies, or third-party analytics cookies that would require a banner. If we add a cookie requiring consent, we will surface a clear opt-in.

12. Children

Kapital Keys is a B2B product and is not directed to children under 16. We do not knowingly collect personal data from children. If you become aware that a child has provided personal data to us, please contact us and we will delete it.

13. Changes

We may update this policy as the product and the law evolve. The "Last updated" date at the top reflects the latest revision. Material changes are announced by email to account holders at least 30 days before they take effect.

14. Contact

Privacy questions: hello@galhardo.cloud
Security reports: security@kapitalkeys.com
General contact: hello@galhardo.cloud

Postal address: João André Anica Galhardo, Tavira, Algarve, Portugal (full postal address on request at hello@galhardo.cloud).