Last updated: 13 August 2026

Privacy Policy

This is a plain-language draft covering how the site and product actually handle data today. It has not been reviewed by a lawyer. Before relying on it as your binding privacy policy, have it checked by a Portuguese/EU data-protection solicitor — particularly the [bracketed] company details, the international-transfer section, and whether a Data Protection Officer is required for your business.

1. Who controls your data

Shinyshells ("we", "us") is the data controller for the personal data described in this policy. Registered business name: [Insert legal entity name]. Registered address: [Insert registered address]. Contact for privacy questions: bb@shinyshells.com.

2. What we collect

Account data: first name, last name, email address and WhatsApp phone number. We don't use passwords — signing in works by emailing you a one-time code or link.
Property data: the homes/properties you register, and details about the repair or maintenance jobs you request (description, urgency, photos where you choose to share them).
Billing data: if you subscribe to Premium or Business, payment is handled directly by Stripe — we don't see or store your card details ourselves.
Communications: messages you send us or our workers over WhatsApp or email in connection with a job.
Technical data: basic request data (like IP address) that's inherent to operating the website and keeping it secure.

3. How we use it

To create and run your account and match your job requests with an available worker.
To process membership billing and send you related receipts/notices.
To communicate with you about a job, your account, or changes to the service.
To keep the service secure and to prevent abuse.

4. Legal basis for processing (GDPR)

We process your data because it's necessary to perform our contract with you (running your account, matching jobs, billing), because we have a legitimate interest in operating and improving the service securely, or, where applicable, because you've given consent (for example, optional marketing emails).

5. Who we share it with

Workers on our network — only the job details and contact info needed for them to do the work you requested.
Supabase — our database and authentication provider, which stores your account and property data on our behalf.
Stripe — our payment processor, for Premium/Business billing.
WhatsApp (Meta) — the messaging channel used to coordinate jobs, subject to WhatsApp's own privacy terms for messages sent through it.

We don't sell your personal data, and we don't share it with advertisers.

6. International transfers

Some of our service providers (including Supabase and Stripe) may process data on servers outside the European Economic Area. Where that happens, they do so under safeguards such as the EU Standard Contractual Clauses. [Confirm current hosting regions for Supabase/Stripe and update this section accordingly.]

7. How long we keep it

We keep account and job data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting and dispute-resolution obligations. You can ask us to delete your account and associated data at any time (see Section 8).

8. Your rights

Under GDPR, you can ask us to: give you a copy of your data, correct inaccurate data, delete your data, restrict or object to certain processing, or receive your data in a portable format. To exercise any of these, email bb@shinyshells.com. If you're not satisfied with our response, you can complain to Portugal's data protection authority, the CNPD.

9. Cookies

The site currently uses only the strictly-necessary session cookies set by our authentication provider (Supabase) to keep you signed in — we don't run third-party analytics or advertising cookies today. If that changes, we'll update this section and add a cookie-consent notice.

10. Security

We use industry-standard measures (encrypted connections, one-time sign-in codes instead of stored passwords, access controls) to protect your data, but no online service can guarantee absolute security.

11. Children

Shinyshells is intended for adults (18+) and isn't directed at children. We don't knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify active members by email before the changes take effect.

13. Contact

Questions about this policy or your data: bb@shinyshells.com or +351 927 692 409.