Privacy Policy

This policy explains what personal data Condelly processes, why, who we share it with and what your rights are. It applies to the condelly.com website, the management portal and the Condelly app.

1. Who we are and our role

For any privacy question, write to suporte@condelly.com.

Condelly is used by condominium management companies to communicate with residents and manage incidents, announcements and documents. We therefore have two roles:

• Controller of the data of client companies' accounts, of demo requests made on the website, and of the technical and security data the service needs to work.
• Processor of the data each management company manages in Condelly about its condominiums (residents, units, incidents, comments, announcements and documents). Here the controller is your condominium's management company, and we process that data only on its behalf and following its instructions.

If you have a request about your condominium's data, you can send it to the management company or to us. If you send it to us, we forward it to the company and help it reply.

2. What data we process

Account

• Name and email.
• Password, stored only in hashed form (we can never read it).
• If you sign in with Google: the name, email and identifier of your Google account. We do not receive your Google password, your contacts or any other account data.
• Preferred language and notification preferences.

Link to the condominium

• The management company, condominium and unit you are linked to, and your relationship with it (owner, household member or tenant).
• For company staff: the role (owner, administrator or staff) and the condominiums they look after.
• The invitations received (email, name given by the company and invitation status).

Content you create or receive

• Incidents: title, description, category, location in the building, photos, status, person responsible, next actions and, when given, deadlines and costs.
• Public comments and replies, likes, and the choice to follow or mute an incident.
• Announcements and documents published by the management company.
• Internal notes of the company's staff. These notes are never shown to residents.

On a public comment, neighbours in the same condominium see your first name and your unit (for example, "Rita, 1st Left"). The rest of your profile is not shown to neighbours.

Security and operation

• Sign-in codes sent by email, sessions and recognised devices.
• If you turn on an authenticator app: the secret that generates the codes.
• Technical logs kept by our hosting providers, such as the IP address, date and type of request, used for security and troubleshooting.

Notifications

• Your phone's notification identifier, when you allow notifications in the app.
• The notification history shown in the bell in the portal and the app.

Demo requests

• Name, email, company, phone (optional), number of condominiums and message.

Subscriptions

• The plan and subscription status of each client company. Condelly does not take online payments yet. When it does, payments will be made on the web portal through a payment provider, and we will not store card details. This policy will be updated before then.

What we do not do

• We do not sell personal data.
• We do not use your data for advertising or build commercial profiles.
• We do not use visitor analytics tools or advertising cookies.
• We do not automatically translate what users write.

3. What we use the data for and on what basis

• Providing the service (accounts, invitations, incidents, comments, announcements, documents and notifications): performance of the contract with the client company and of the terms of use with each user (Article 6(1)(b) GDPR).
• Sending account emails (invitations, sign-in codes, account confirmation and recovery, deletion confirmation): performance of the contract. We do not send activity notifications by email.
• Sending phone notifications: performance of the contract, when you turn on notifications on your phone. You can turn them off by topic or entirely in the settings.
• Protecting accounts and the service (email codes on new devices for company staff, bot protection, technical logs): legitimate interest in keeping the service secure (point (f)).
• Answering demo requests: steps taken at your request before entering into a contract (point (b)).
• Complying with legal obligations, such as tax rules once there is invoicing, or requests from authorities: legal obligation (point (c)).

4. Who can access the data

• In your condominium: the management company's staff see what they need to manage the condominium. Residents see their condominium's announcements, documents and public updates, and their neighbours' public comments. Internal notes are never visible to residents. Access is limited to each company and each condominium by the database itself.
• Authorities, when the law requires it.

Our processors handle data only to provide the service to us:

• Supabase: database, authentication and files, hosted in the European Union (Frankfurt, Germany).
• Cloudflare: hosting of the website and portal, DNS, network protection, bot checks (Turnstile) and email forwarding.
• Resend: sending account emails.
• Expo: sending phone notifications. Notifications also go through Apple's and Google's notification services, which deliver them to your phone.
• Google: sign in with Google, only if you choose it.

5. Transfers outside the European Economic Area

The database and files stay in the European Union. Some providers (Cloudflare, Resend, Expo, Google, Apple) are based in the United States or may process data outside the European Economic Area. When that happens, the transfer relies on the safeguards provided by the GDPR, such as the adequacy decision for the EU-US Data Privacy Framework, for providers that have joined it, or the standard contractual clauses approved by the European Commission.

6. How long we keep data

• Account: for as long as the account exists. When you delete your account, we delete your profile, preferences, links to condominiums and devices. The incidents, comments and photos you recorded stay in the condominium, because they are part of its management, but without your name.
• Condominium content: for as long as the management company uses Condelly. When the subscription ends, the company can ask for a copy of the data, which is deleted within 90 days, unless the law requires keeping it longer.
• Sign-in codes: valid for 10 minutes. The record of codes sent is deleted after one day.
• Recognised devices: up to 60 days after last use, or until you sign out.
• Demo requests: for as long as they are useful for the sales contact, at most 12 months.
• Technical logs and backups: for the short period set by the hosting providers, being replaced on a rolling basis.

7. Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, to data portability and to withdraw any consent you have given.

• You can correct your name and language and choose your notifications in the app and portal settings.
• You can delete your account at any time in the app (Settings) or in the portal (Settings, Account). A company owner deletes the account by writing to suporte@condelly.com, so the company is not left without an owner.
• For other requests, write to suporte@condelly.com. We reply within one month. For your condominium's data, you can also speak directly to the management company.

If you believe your data is not being handled properly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or to the authority in your country.

8. Cookies and storage on your device

We only use what the service needs to work, so we do not ask for cookie consent:

• Session (cookies starting with "sb-"): keep you signed in to the portal.
• Language ("NEXT_LOCALE", 1 year): remembers the language you chose.
• Sign in with Google ("condelly_oauth", 10 minutes): remembers what you were doing while you go to Google.
• Bot check (Cloudflare Turnstile): protects the sign-up, password recovery and demo request forms.

In the app, the session is stored in your phone's secure storage (Keychain on iPhone, Keystore on Android).

9. Security

All connections are encrypted (HTTPS). Passwords are stored hashed, files are private and opened through temporary links, and each company and each condominium can only access its own data, through rules enforced in the database itself. Company staff confirm each new device with a code sent by email and can turn on an authenticator app. If a data breach requires it, we inform the management company, the supervisory authority and the people affected, as the law requires.

10. Age

Condelly is intended for people aged 16 or over.

11. Changes to this policy

This policy has a version number and date. When we change it, we publish a new version on this page and keep the previous ones available. If the change is significant, we let you know on the website, in the portal, in the app or by email before it takes effect.