Privacy Policy

This Privacy Policy explains how Casaporte collects, uses, shares and protects your personal data, and the rights you have. The data controller is My Paws International, Lda., registered in Portugal at Av. Dom João II, n.º 98 A, 1990-100 Lisboa, NIPC 518562530 ('Casaporte', 'we'). For any privacy question or to exercise your rights, contact privacy@casaporte.eu.

This policy covers individuals who build or share a verified profile (renters and buyers), landlords and agents whose contact details we hold, and visitors to our website. When an agency or landlord receives your verified profile, they become an independent controller of that copy, and their own privacy notice applies to what they do with it.

Identity data: your name and the identity result from our verification partner (a pass/fail verdict plus basic document details such as document type and expiry). Contact data: your email, and a phone number only if you add one for viewings.

Financial facts: a verified monthly income figure or a band of available funds, an affordability band, and a housing-payment (rent or mortgage) streak — computed from documents you provide. Employment facts: contract type, and employer name only if you choose to share it.

Documents you upload (payslips, bank statements): processed transiently to compute the facts above, then deleted — see 'Data minimisation' below. Usage and technical data: basic logs, device/IP information and the cookies needed to run and secure the service. Organisation data: for agencies, business contact and account details.

Directly from you (what you enter and upload), generated during verification (the computed facts and verdicts), and automatically when you use the site (technical and cookie data). Where an agency invites you to verify, we receive your email and name from them so we can send you the invitation.

To provide the verification service you asked for and to let you share your profile — performance of a contract with you (GDPR Art. 6(1)(b)).

To share your profile with a specific recipient, to verify your identity, and to reveal optional details such as your exact income or employer — your consent (Art. 6(1)(a); for identity and biometric checks, explicit consent under Art. 9(2)(a)), which you can withdraw at any time.

To keep the service secure, prevent fraud and abuse, and improve how it works — our legitimate interests (Art. 6(1)(f)), balanced against your rights. And to meet legal obligations such as accounting for payments — legal obligation (Art. 6(1)(c)).

We are built to keep facts, not files. When you upload income documents, they are read once — in the memory of a single request — to compute just a few facts (a verified income figure, an affordability band, and a housing-payment streak). The original document is then deleted; we do not store your statements or a transaction-by-transaction copy of your finances.

Your exact income is hidden by default: a recipient sees an affordability band unless you switch the exact figure on. Your employer's name is hidden unless you opt to share it. We never show a photo of you to an agency or landlord.

Identity verification (a document scan and a liveness selfie) is carried out on our partner's own hosted page. That partner processes the biometric data needed to check liveness and match your face to your document; Casaporte receives only the result — a pass/fail verdict and basic document details — not your biometric data or images. This special-category processing happens on your explicit consent.

We do not carry out automated decision-making that produces legal or similarly significant effects about you (GDPR Art. 22). Casaporte never scores, ranks or recommends accepting or rejecting a person — it presents confirmed facts, and a human makes the housing decision. Document reading uses automated tools to extract fields, but you confirm each fact before it enters your profile.

We never sell your data. Your verified profile reaches a landlord or agency only through a share you initiate: named to a specific recipient, time-limited (14 days for renting, 30 for buying by default), logged, and revocable by you. You choose what each recipient sees.

We also share data with the processors that run the service (below), and we may disclose data if strictly required by law or to protect people's safety or our legal rights.

We use carefully chosen providers, each bound by a data-processing agreement, to run Casaporte: Supabase (database and hosting, EU region); Stripe (payments); Didit (identity and liveness verification); Google / Vertex AI and Google Cloud Vision (reading uploaded documents to extract facts); and Resend (transactional email). We keep this list current; the categories above reflect our stack today.

Our data is hosted in the European Union. Some processors are established outside the EEA or may process limited data there; where that happens we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses (and, where relevant, the EU–US Data Privacy Framework). You can ask us for details of the safeguards in place.

Uploaded documents are deleted as soon as your facts are computed. Your verified facts and profile are kept while your account is active so you can reuse them; a share's access ends when it expires or you revoke it. Access logs and basic records are kept for a limited period for security and accounting. When you ask us to delete your data, or after a period of inactivity, we erase it — except where we must keep a minimal record to meet a legal obligation.

Under the GDPR you have the right to access your data; to have it corrected or erased; to restrict or object to processing; to data portability; and to withdraw consent at any time (which doesn't affect processing already carried out). To exercise any of these, contact privacy@casaporte.eu and we'll action it. Verified facts are corrected by re-verifying rather than editing, so they stay trustworthy.

You also have the right to complain to a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt); you may also contact the authority where you live.

We use only the cookies needed to run and secure the service and to remember your choices — a session/authentication cookie, a language preference, and a short-lived referral cookie. We do not use advertising or cross-site tracking cookies.

Referral attribution is on by default — you can turn it off at any time via 'Cookie preferences' in the footer, after which we do not set that cookie. Embedded content such as a virtual tour loads only when you choose to open it, so it sets no cookies until then. The other cookies are strictly necessary or functional and do not otherwise require consent.

Casaporte is not intended for anyone under 18, and we don't knowingly collect data from children. If you believe a child has used the service, contact us and we'll remove the data.

We protect your data with EU hosting, encryption in transit, database access controls, and by keeping as little as possible for as short as possible. No system is perfectly secure, but minimising what we hold is our first line of defence. We may update this policy; for material changes we'll give reasonable notice, and the 'last updated' date above always reflects the current version.

Data questions or requests: privacy@casaporte.eu. The Portuguese-language version of this policy is the binding one.

Questions about your data: privacy@casaporte.eu · Privacy controls