Privacy Policy

1. Who is responsible for your data

ABRAÇOS & ALOHAS, UNIPESSOAL, LDA, NIF/NIPC PT517706814, is the controller of personal data processed through Abracos. Our registered address is Rua de Miguel Bombarda, 316, 4050-377 Porto, Portugal.

For privacy questions or requests, contact abracos@abracos.app.

2. Information we handle

• Account information: display name, verified email address, authentication identifier, account status and role or Venue membership.
• Loyalty activity: participating Venues, transaction amounts recorded by Venue staff, credited abraços, savings, follows, Coupons, reward progress, redemptions, discounts and referral activity.
• Support information: messages and details you choose to send when requesting help.
• Device and security information: session and security data, basic request and diagnostic information processed by our infrastructure, and a push-subscription endpoint if you enable notifications.
• Local preferences: information stored on your device to keep you signed in and remember choices such as completion of the app tour.

Abracos does not currently include advertising SDKs, sell personal data or use personal data for cross-service behavioural advertising.

3. Why we use information

We use personal data to create and secure your account; provide loyalty balances, rewards and Venue interactions; prevent duplicate or unauthorized operations; send notifications you request; answer support requests; maintain and protect the service; comply with law; and establish, exercise or defend legal claims.

Depending on the activity, processing is based on providing the service you request, our legitimate interests in operating and securing Abracos, your consent where required, or compliance with legal obligations. You may withdraw consent for optional processing without affecting earlier lawful processing.

4. Camera, notifications and location

Venue staff can choose to use the device camera to scan an Abracos QR code. Camera access begins only when the scan feature is opened. Abracos reads the QR value and does not upload or store camera photos or video.

Transaction notifications are optional. If enabled, we store the technical push subscription needed to deliver them. You can disable notifications in Abracos or your device settings.

The current application does not request or collect your device’s precise location. The map displays public Venue locations.

5. Who receives information

• Participating Venues: authorized staff receive the Customer and reward context needed to record or verify an interaction. A referral inviter may see the invited Customer’s display identity and referral progress, but not purchase history.
• Clerk: provides email-code authentication, session management and account security. Clerk processes Abracos Customer Data under its Data Processing Addendum; its separate Privacy Policy describes information Clerk handles for its own service operations.
• Cloudflare: provides application hosting, network security and database infrastructure. See Cloudflare’s Data Processing Addendum and Privacy Policy.
• OpenStreetMap Foundation: the map requests public tiles from OpenStreetMap infrastructure, which receives technical request information such as IP address, browser or device information, referrer and requested tiles. See the OSMF Privacy Policy and Tile Usage Policy.
• Notification delivery: if you enable transaction notifications, the device or browser push service receives the subscription and delivery information needed to send them. Depending on the device, this may involve Apple or Google Firebase Cloud Messaging.
• Google Workspace: processes support messages sent to our email address. See the Google Cloud Privacy Notice and Google Privacy Policy.
• Authorities and advisers: only where legally required or necessary to protect rights and security.

Where a third party processes personal data for Abracos, we require it by contract or other applicable terms to use the data only for the agreed service and to provide the same or an equivalent level of protection described in this policy and required by applicable law. Links above describe each provider’s own practices and contractual data-protection terms; Abracos remains responsible for responding to requests about Abracos Customer Data.

6. International processing

Some providers may process information outside Portugal or the European Economic Area. Where required, we use an approved transfer mechanism and supplementary safeguards. Contact us for information about safeguards relevant to your data.

7. How long we keep information

We keep identifiable account and loyalty information while your account is active and only as long as needed to provide and secure the service, resolve disputes and meet legal obligations. Retention depends on the record, our relationship with you, applicable accounting or legal requirements and backup expiry.

When you delete your account, personal profile, value and access data are erased. Completed operational records that must remain for integrity, fraud prevention, accounting or legal reasons are irreversibly detached from you and shown only as “Former customer”. We do not retain an email hash or visible identifier to reconnect them to the deleted account.

8. Your choices and rights

Subject to applicable law, you may ask to access, correct, delete, restrict or receive your personal data, and may object to certain processing or withdraw consent. Contact abracos@abracos.app. We may need to verify your identity.

You can delete the complete account directly in Abracos. See the account deletion instructions. You may complain to Portugal’s data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

9. Security and changes

We use organizational and technical safeguards designed to protect personal data, including verified email access, authorization boundaries and encrypted network transport. No service can guarantee absolute security.

We may update this policy when the service, providers or law change. We will update the date above and provide additional notice where a change materially affects your rights.