Privacy · GDPR · POPIA where applicable
Your information should never be the hidden price.
This notice explains what AlugaCerta currently processes, why it is needed, who may receive it and the choices available to you.
Last updated: 27 August 2026Who is responsible
The AlugaCerta operating entity will be the controller under the GDPR. It will also be the responsible party under POPIA only if the operator is domiciled in South Africa or uses processing means there beyond merely forwarding information. A group-company statement in the footer does not identify the legal operator. The final legal identity and direct privacy contact will be added before the service opens publicly.
For current assistance, use the contact page. Do not send identity documents by ordinary email, WhatsApp or general support messages; invited applicants should use the private evidence area.
Information handled
- Account and security
- Email address, profile details, role, sign-in and security events, and a protected session cookie. IP address, browser or device information, requested page and timestamp may also appear in hosting and audit records.
- Search and saved stays
- Area, dates and guest count can appear in the page address when you search. Saved property identifiers remain in your browser and are not attached to your AlugaCerta account at this stage.
- Invited host applications
- Operator type, legal and trading name, contact details, date of birth or incorporation, NIF or NIPC, addresses, property and authority information, RNAL details, insurance, tax-activity information, statutory declarations and application decisions are stored in the private onboarding service.
- Private host evidence
- Invited applicants may upload identity, authority, RNAL, insurance and tax evidence as PDF, JPEG or PNG files. Files are stored privately with their filename, size, type, integrity hash, review status and retention date. Bank and payout details are not collected in the host-application form.
- Listing workspace
- Approved hosts can store listing descriptions, facilities, accessibility details, house rules, arrival times, price and cancellation versions, property images, calendar days and publication decisions. Draft and paused content remains private to the host and authorised operators. When an operator publishes a listing, the RNAL number, trader name, business contact details, listing content, accepted images, price and applicable calendar information become public.
- Booking requests and messages
- For a controlled request, AlugaCerta stores the guest account identity and contact details, host and listing identifiers, dates, guest count, an immutable snapshot of the accommodation price, trader/RNAL disclosure, cancellation and policy versions, status history, participant messages and reports. Booking records are private to the guest, host and authorised operators. Active requests temporarily block their exact dates to prevent overlapping requests.
- Payments and payouts
- AlugaCerta stores payment, refund, transfer and dispute identifiers, status, exact EUR amounts, the applicable host-commission snapshot, webhook-event hashes and balanced operational-ledger entries. Stripe collects and processes card, identity, bank-account and payout details through its hosted service; those credentials do not enter AlugaCerta forms or databases.
- Statutory reporting
- Private seller due-diligence facts, confirmed-stay activity, payment totals and reporting exceptions can be copied into restricted, integrity-checked DAC7 or EU short-term-rental review snapshots. A separate host-only record tracks whether a SIBA reporting responsibility needs review or has an evidence reference; AlugaCerta does not store passport data in that record.
- Privacy requests
- Signed-in users can submit a request for access, correction, deletion, restriction, portability or objection. The request type, status, deadline, proportionate identity step, handling events, outcome and any scoped legal hold are recorded so the request can be answered and evidenced.
- Other preview forms
- Illustrative properties cannot create a request. Local-partner interest remains a demonstration and does not create a partner account.
Purposes and legal grounds
| Purpose | GDPR basis | POPIA basis |
|---|---|---|
| Provide accounts and protect the service | Requested service and legitimate interests in security | Contract steps and legitimate interests |
| Create, manage and communicate about a requested stay | Steps requested before and performance of a contract | Conclusion or performance of a contract |
| Review an invited host and property | Steps requested before entering a contract | Conclusion or performance of a contract |
| Check registration, tax, fraud and marketplace-safety requirements | Legal obligation and legitimate interests, as applicable | Legal obligation and legitimate interests, as applicable |
| Record required declarations, decisions and audit evidence | Legal obligation and legitimate interests in accountable operations | Legal obligation and legitimate interests |
| Send optional hosting news | Consent, which can be withdrawn | Voluntary, specific consent |
AlugaCerta does not sell personal information, build advertising profiles or use solely automated decisions with legal or similarly significant effects. Host approval is a human-reviewed decision.
Recipients and international transfers
Authorised AlugaCerta reviewers can access an application and its private evidence for verification and support. Supabase provides authentication, the Frankfurt-hosted database and private file storage. Vercel hosts and delivers the website and may process technical logs. Stripe will provide regulated Connect onboarding, checkout, payment, refund, dispute and payout services after the operator account is approved. Registration information may be checked with official registers, insurers or professional advisers where lawful and necessary.
Before public launch, AlugaCerta must complete its processor register, written processing agreements, subprocessor review and transfer assessment. Any transfer outside the EEA must use a valid GDPR transfer mechanism; if POPIA applies, a transfer from South Africa must also meet its cross-border conditions.
How long information remains
- Account, application and listing records: kept while onboarding, publication or the future host relationship is active and then according to the applicable legal, claims and deletion schedule. Account deletion removes source listing and public-catalog rows unless a legal hold applies.
- Booking, message and payment-related records: retained only for the period required to perform the stay, resolve claims, meet accounting, tax and statutory-reporting duties and prevent fraud. Payment history and ledger evidence cannot be erased where a legal duty or live claim requires it; access can still be restricted and direct identifiers minimised where appropriate.
- Provider webhook evidence: limited to event and object identifiers, mode, timestamps, processing status and a payload hash rather than the full event body.
- Host evidence: currently receives a two-year review date. A shorter deletion period will be applied where the application is withdrawn or rejected and no legal hold or statutory duty requires continued retention.
- Consent and review evidence: limited decision records may be retained to demonstrate permissions, security and lawful decisions, with direct identifiers removed where they are no longer needed.
- Saved stays: remain on your device until you clear them or clear browser storage.
- Hosting and support records: retained according to configured provider settings and the final operating schedule.
The final schedule cannot be completed until the legal operator and its Portuguese and, if applicable, South African obligations are confirmed.
Security and data minimisation
Accounts use confirmed email, protected session cookies and database-enforced roles. Host evidence and draft listing images are stored in non-public buckets with row-level access for the applicant or host and authorised reviewers. Booking and payment facts, events, messages and refunds are restricted to participants or authorised operators as appropriate; overlapping dates are rejected transactionally, provider events are signature-verified and deduplicated, and booking, payment and ledger history is append-only. Files have type and size limits, an integrity hash and cannot be accepted until a reviewer records the required security check. Public media delivery verifies that the listing is live before returning a file. Review and security actions create protected audit evidence.
No system is risk-free. Automated malware scanning, paid production backups, custom transactional email, monitoring, incident response and tested recovery remain launch gates. Do not use ordinary email, WhatsApp or general messages to send passwords, card details or identity evidence.
Your privacy rights
Depending on the law that applies, you may ask for access, correction, deletion or destruction, restriction, portability, or objection; withdraw consent at any time; and object to direct marketing. You may also ask whether AlugaCerta holds information about you and who has received it.
Signed-in users can create, track or cancel an eligible open request in Account & privacy, and can download a current machine-readable copy of the server records available to their account. Local saved stays remain on the device and are identified separately in that export. Operator handling records acknowledgement, proportionate identity verification, any justified extension, the outcome and a scoped legal hold where erasure is limited by a live legal duty.
You can also use Human assistance and state “privacy request”. Do not send a full identity document unless a trained privacy contact explains why it is necessary and provides the private evidence route. You may complain to Portugal's Comissão Nacional de Proteção de Dados or, where POPIA applies, South Africa's Information Regulator. You may also contact the supervisory authority where you live or work.
Children and changes
The account, host-application and future booking services are intended for adults. Do not provide information about a child beyond what is genuinely necessary for a booking or support request. Material changes to this notice or a new processing purpose require an updated notice and, where consent is the basis, a new choice.