Privacy Policy
This Privacy Policy explains how MyCasa ("we", "our", "us") collects, uses, and protects personal data when you use our Service. We process data in accordance with the EU General Data Protection Regulation (GDPR) and Portuguese data protection law.
Privacy and Document Storage Answers
Who is legally responsible for MyCasa?
MyCasa is a trading name, not a separate incorporated company. The Service is operated by Charles Al Soufi, an individual based in Geneva, Switzerland. Charles Al Soufi is the data controller responsible for deciding how and why MyCasa processes personal data.
Where are uploaded documents hosted?
Uploaded documents are stored on a private, encrypted persistent volume attached to the MyCasa application in Fly.io's Paris, France region (cdg). The volume is encrypted by Fly.io and document contents are additionally encrypted by MyCasa using AES-256-GCM before they are written to storage. Documents are not stored by Stripe or Resend.
Who processes the data?
Charles Al Soufi, trading as MyCasa, is the data controller. Fly.io, Inc. processes application data and uploaded documents as MyCasa's hosting provider, and Resend processes email addresses and email content when it delivers transactional messages. Stripe/Link separately processes payment and billing data as merchant of record; MyCasa does not receive or store full card details.
How long are documents retained after account deletion?
When you use the account-deletion control, MyCasa removes your documents from live storage before deleting your account and associated application records. Encrypted infrastructure snapshots may retain a residual copy for up to five days before automatic expiry. Limited billing or transaction records may be retained separately where required by law, but uploaded documents are not retained for that purpose.
Can MyCasa personnel access documents?
Documents are private to your account and are not routinely viewed by MyCasa personnel. A limited authorised production administrator can technically access them only where necessary to investigate a support request, respond to a security incident or comply with law. Hosting-provider personnel may have similarly restricted infrastructure access under their own security controls. Professionals and other users cannot access a document unless you deliberately create and share a document link or pack.
How do I permanently delete my data?
You can delete your account directly in Profile settings. You may also contact Charles Al Soufi through the privacy request form to request erasure or ask a data-protection question. MyCasa responds to rights requests within one month as required by GDPR.
1. Data We Collect
1.1 Account data
When you create an account, we collect your email address and, if you provide it, your name. This is used to authenticate you and communicate with you about the Service.
1.2 Property and journey data
Data you enter about properties you are tracking, purchase stages, tasks, notes and preferences. This is stored solely to provide the Service to you.
1.3 Documents
Files you upload to document storage, such as passports, NIF documents, bank statements, contracts and certificates. Files are stored on EU infrastructure and are used only to provide the Service.
1.4 Usage data
We collect first-party page views and a small set of product events (such as starting signup, opening checkout or using a calculator) to understand whether MyCasa is useful. We do not use third-party analytics. The server creates a pseudonymous visitor hash from trusted network information and the browser user agent using a secret HMAC key; we do not store the raw IP address in the analytics table, and the hash is not shared with advertisers.
1.5 Payment data
Buyer Pass payments are sold through Stripe Managed Payments / Link, which acts as merchant of record. Stripe/Link collects the name, billing address, payment details and transaction information it needs to calculate indirect tax, issue invoices and receipts, prevent fraud, handle transaction support, refunds and disputes. MyCasa receives limited transaction metadata such as customer, Checkout Session and payment identifiers, payment status, amount, currency, plan and access period. We do not receive or store your full card number.
1.6 Waitlist and launch-update data
If you join a waitlist or newsletter form, we collect your email address and basic technical metadata (such as IP address and user agent) to manage launch updates, prevent abuse and maintain a record of consent. You can unsubscribe from marketing updates at any time.
1.7 Contact and feedback data
If you use our contact form, we collect your name, email address, message, selected topic and basic technical metadata so we can receive, secure and respond to your enquiry.
2. Legal Basis for Processing
- Contract performance: account data, property data, journey data and documents necessary to provide the Service.
- Legitimate interests: product analytics, security logging, fraud prevention and service improvement.
- Legal obligation: retention of billing records as required by applicable accounting and tax law.
3. Data Sharing
We do not sell your personal data. We share data only with service providers needed to operate MyCasa:
- Fly.io, Inc.: application, database and encrypted document hosting in Paris, France.
- Resend: transactional email such as magic links and reminders.
- Stripe and Link: merchant-of-record payment processing, indirect tax, fraud prevention, invoices, receipts, transaction support, refunds and disputes.
If you contact a professional through the professionals directory, your contact details are shared with that professional with your explicit consent at the time of submission.
4. Data Retention
- Account and application data: retained while your account is active and removed from the live service when you delete your account, unless we must keep limited records by law.
- Documents: retained until you delete them or your account. Account deletion removes them from live storage immediately; encrypted infrastructure snapshots expire within five days.
- Billing records: retained as required by applicable accounting and tax law.
- Professional enquiries: retained as correspondence with the selected professional and MyCasa support for a limited period, unless you ask us to delete or anonymise them where legally possible.
- Waitlist/newsletter entries: retained until you unsubscribe or ask us to delete them.
- Contact and feedback messages: retained only as long as needed to respond, improve the Service and maintain appropriate support records.
- First-party analytics events and pseudonymous visitor hashes: retained for up to 90 days, then automatically deleted.
- Security logs: retained for a limited period to protect the Service.
5. Your Rights (GDPR)
Under GDPR, you have the right to:
- Access: request a copy of your personal data.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your data ("right to be forgotten").
- Portability: export your data in machine-readable format.
- Objection: object to processing based on legitimate interests.
- Restriction: restrict processing in certain circumstances.
To exercise these rights, use our privacy request form. We will respond within 30 days.
6. Cookies and Local Storage
We use a strictly necessary session cookie when you sign in and local storage for app preferences such as onboarding state and selected property. Our audience analytics does not set a cookie, write a browser identifier, or load a third-party tracker. We honour Global Privacy Control and browser “Do Not Track” signals by not sending analytics events. Because no non-essential analytics cookie or device storage is used, MyCasa does not show a consent banner solely for this measurement. We do not use advertising cookies.
7. Security
We use HTTPS for data in transit and EU-hosted infrastructure for application data. Fly.io encrypts the persistent storage volume, and MyCasa additionally encrypts each uploaded document with AES-256-GCM before storage. We follow security practices including signed sessions, rate limiting on authentication endpoints and restricted administrator access to production systems.
8. International Transfers
MyCasa is hosted in the EU. If a processor ever requires a transfer outside the EU/EEA, we will rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.
9. Changes to This Policy
We will notify you of material changes by email or in-app notice where appropriate. The current version is always available at mycasapt.com/legal/privacy.
10. Contact and Supervisory Authority
The controller responsible for your request is Charles Al Soufi, trading as MyCasa. For permanent deletion or any other data-protection enquiry, submit a privacy request.
You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD (cnpd.pt).