Legal · Privacy
Privacy Policy
This policy explains what personal data PropDesk collects, why, on what legal basis, who we share it with, how long we keep it, and the rights you have.
- Regulation
- EU GDPR (Regulation 2016/679) · Portuguese Law 58/2019
- Controller
- Tomás Reis dos Santos · NIF 256491968
- Address
- Avenida do Escurinho, Lote 39, 6.º R, 7000-372 Évora, Portugal
- Contact
- support@getpropdesk.io
- Version
- 1.1
- Effective
- 15 October 2026
- We ask for an email address and nothing else to create an account. No name, no phone number, no social login.
- Photographs are stripped of GPS and camera metadata in your own browser, before anything is uploaded.
- We run no advertising and we never sell your data.
- We count visits to the site with Vercel's analytics. It sets no cookies and stores nothing in your browser, and if your browser sends a Global Privacy Control or Do Not Track signal, your visit is not counted at all.
- Our email provider marks the sign-in emails with an invisible pixel that records when you open them. Their service gives us no way to remove it, so we name it here rather than hide it.
- Your card number never reaches us: it goes directly to Stripe.
- You can download or delete everything, at any time, by writing to us.
This box is a plain-language guide, not a substitute for the detail below.
Contents
Who we are
The controller responsible for your personal data is Tomás Reis dos Santos, sole trader (Empresário em Nome Individual) registered in Portugal under NIF 256491968, with registered address at Avenida do Escurinho, Lote 39, 6.º R, 7000-372 Évora, Portugal.
We are not required to appoint a Data Protection Officer. For anything concerning privacy (questions, requests, or complaints) write to support@getpropdesk.io. A person reads that mailbox, not a ticketing robot.
Our approach to data is the same as our approach to physics: collect only what the product genuinely needs, and be plain about what happens to it.
What we collect, why, and on what basis
The table below is the complete list. If something is not in it, we do not collect it.
| Data | Why | Legal basis |
|---|---|---|
| Email address The only thing required to register. |
To create your account, to send the one-time code that signs you in, and to contact you about the service. | Contract |
| Builds and saved work Components, parameters, results, saved builds, and your monthly usage count. |
To provide the tools, to store your work, and to apply the build limit of the free plan. | Contract |
| Community content Projects, build diaries, comments, photographs, and an optional public pseudonym, links, and city. |
To publish your work in the community, exactly as you ask us to. | Contract, and your choice to publish |
| Subscription data Plan, period end, and the customer and subscription identifiers issued by Stripe. |
To give you access to the plan you paid for and to meet our invoicing and tax duties. | Contract · legal obligation |
| Optional survey answers How you heard about PropDesk, and why you upgraded. |
To understand what is useful and where people find us. Both are optional and can be left blank. | Consent |
| Waitlist email If you ask to be notified. |
To tell you when something launches, and nothing else. | Consent |
| Reports you submit What you reported and why. |
To review reported content and to keep a record of moderation decisions, as the Digital Services Act requires. | Legal obligation · legitimate interest |
| Technical data IP address, browser and device information, and server logs, generated automatically by our hosting and database providers. |
To operate and secure the service, to diagnose faults, and to prevent abuse. | Legitimate interest |
| Visit statistics The page visited (its path only, never the parameters after it), the site that linked you to it, browser, operating system, device type, approximate location (country, region, city), and the time. |
To see which pages are used and how people find PropDesk. What we see are totals, never the visits of one person. | Legitimate interest |
Visit statistics. They come from Vercel Web Analytics, loaded by a small script on the site's pages (the legal pages, this one included, do not load it). It sets no cookies and stores nothing in your browser. To tell visitors apart within a day, Vercel calculates a hash from the request your browser sends and discards it after 24 hours; nothing in it lets Vercel or us follow you to another website. If your browser sends a Global Privacy Control or Do Not Track signal, the script is never loaded and the visit is not counted. You can also object at any time, as described under Your rights.
Passwords. We do not use passwords. You sign in with a one-time code sent to your email address, so there is no password for us to store or to lose.
Card details. Your card number is entered directly on Stripe's own checkout page. It never passes through PropDesk and we never see or store it.
We do not sell personal data, we do not share it for advertising, and we do not use it to build profiles or to make automated decisions that produce legal effects for you.
Photographs and location metadata
Cameras and phones normally embed hidden metadata in every photograph: GPS coordinates, camera model, date and time. Published without care, that metadata can reveal where you live or work.
PropDesk removes it before the file leaves your device. When you select a photograph, your browser re-draws the image onto a canvas and re-encodes it, which keeps the visible pixels and discards everything else. The image is also downscaled. What reaches our storage has no GPS and no camera metadata, because that information is never transmitted in the first place.
Uploaded photographs are stored in a private bucket and are served through short-lived signed links rather than public URLs.
Removing metadata does not remove what is visible in the picture. You remain responsible for what your photographs show. As our Terms set out, you must not upload images of identifiable people without their consent.
Who processes data for us
We rely on a small number of providers. Each processes data on our behalf, under contract, and only on our instructions.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Authentication, database, and photo storage | Account data, your builds and projects, photographs, technical logs |
| Vercel | Website hosting, the serverless functions behind checkout, and visit statistics | IP address, request logs, and the visit details listed above |
| Stripe | Payment processing and subscription management | Email address, payment details you enter with them, subscription status |
| Brevo | Delivery of the sign-in emails that carry your one-time code | Email address, delivery metadata, and (through an invisible pixel they add to every message, which their service gives us no way to remove) whether and when you opened the email |
Content delivered from a third-party network
One file comes from outside our servers: the library that turns a build into a PDF, which the calculator loads from Cloudflare cdnjs. The typefaces, the stylesheets and the rest of the code are served from getpropdesk.io. If you do not open the calculator, your browser contacts no delivery network other than ours.
Cloudflare is not a processor acting for us. When your browser fetches that file, it connects directly to their network and, as with any web request, discloses your IP address and basic browser information to them. We receive nothing from that exchange and set no cookies through it. We mention it because you are entitled to know when a page reaches outside our servers, and the calculator is the one page that does.
Beyond these providers, we disclose personal data only where the law obliges us to, or to establish, exercise, or defend a legal claim.
International transfers
We choose European hosting where our providers offer it, so that data stays inside the European Economic Area by default.
Some providers are established outside the EEA or use infrastructure and support teams there. Where personal data is transferred outside the EEA, it takes place under the safeguards the GDPR requires, normally the European Commission's Standard Contractual Clauses, or an adequacy decision covering the destination country.
If you would like to know the precise arrangement for a specific provider, ask us and we will tell you.
How long we keep things
| Data | Kept for |
|---|---|
| Account, builds, and saved work | While your account exists. Deleted when you delete the account. |
| Published community content | While you keep it published. Deleted when you remove it or delete your account. |
| Invoicing and tax records | Ten years, as Portuguese tax law requires. This period cannot be shortened by a deletion request. |
| Moderation records | As long as needed to justify a decision and to comply with the Digital Services Act. |
| Waitlist email | Until you unsubscribe, or until the launch it relates to has happened. |
| Server and security logs | Short retention periods set by our hosting providers, typically no more than a few weeks. |
| Visit statistics | The visitor hash is discarded after 24 hours. The visit records, which carry no identifier, are kept by Vercel for its standard analytics retention period. |
We keep no backup copies of the database, so data you delete does not stay behind in an older copy.
Your rights
Under the GDPR you have the right to:
- Access: obtain a copy of the personal data we hold about you;
- Rectification: have inaccurate data corrected;
- Erasure: have your data deleted, except what we must keep by law;
- Restriction: ask us to limit how we use your data while a question is resolved;
- Portability: receive the data you gave us in a structured, machine-readable format;
- Objection: object to processing based on legitimate interest, on grounds relating to your situation;
- Withdraw consent: at any time, where processing is based on consent. Withdrawal does not affect what was lawful before it.
You can delete your account yourself: open the account panel and choose Delete account. That removes your saved builds, projects, photos, comments and usage history, and cancels any subscription immediately so you are not charged again. Past invoices stay with our payment provider because tax law requires us to keep them. For anything else, write to support@getpropdesk.io. We answer within one month, and will tell you if we need longer because a request is complex. Exercising these rights is free.
Security
Practical measures rather than reassuring adjectives:
- All traffic is encrypted in transit (HTTPS), and data is encrypted at rest by our providers.
- Access to your rows in the database is enforced at database level by row-level security policies, not merely hidden in the interface.
- Sensitive fields (your plan, your billing period, and administrator status) cannot be written by a browser at all. Only the payment webhook, running on the server, can change them.
- Photographs live in a private bucket and are reachable only through short-lived signed links.
- There are no passwords to steal, because sign-in uses a one-time code.
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the supervisory authority as the GDPR requires.
Children
PropDesk is not intended for children. You must be at least 16 to create an account, as our Terms set out.
We do not knowingly collect personal data from children below that age. If you believe a child has given us data, tell us and we will delete it.
Cookies and similar storage
We use only the storage strictly necessary to sign you in and to keep the application working, plus a small amount that remembers your place during a session. Nothing stored in your browser follows you to another website. The visit statistics store nothing in your browser at all, and the pixel in our sign-in emails, described under Who processes data for us, lives in the email.
None of that storage is used for tracking, and the visit statistics set nothing on your device, so we do not show a consent banner. If we ever introduce non-essential storage, we will ask for your consent before setting it. Our Cookie Policy lists every item by name.
Changes to this policy
We will update this policy when what we do changes. The version number and effective date at the top of this page always show the current version.
If a change is material (a new purpose, a new category of data, or a new recipient) we will tell you by email or in the app before it takes effect.
Contact and complaints
For any privacy matter: support@getpropdesk.io
Tomás Reis dos Santos, sole trader (Empresário em Nome Individual), Portugal · NIF 256491968 · Avenida do Escurinho, Lote 39, 6.º R, 7000-372 Évora, Portugal
If you are not satisfied with how we handle a request, you may complain to the Portuguese supervisory authority:
CNPD, Comissão Nacional de Proteção de Dados
Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt
You may also complain to the supervisory authority of the EU country where you live or work.