Privacy Policy
This page describes how Fixklarn processes personal data in the current product: fault reports, landlord or manager and tenant accounts, and QR reporting. Processing follows the GDPR. In Portugal the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).
What we process
Depending on use: email, name, phone, password (handled by Supabase Auth), company name and account NIF (billing), property and home data (address, postal code when provided, home number), request content (title, description, category, urgency, status, notes, update history), fault photos (file up to 5 MB, JPEG/PNG/WebP, private issue-images bucket), guest-report name and email, IP addresses for invite and guest-report abuse limits, in-app notifications, and Stripe billing identifiers linked to the account (customer and subscription).
Why we process it
To authenticate users, link tenants and homes to the account, receive and track fault reports, show photos with short-lived signed URLs, send status-update emails when an email is available, bill plans via Stripe, and limit abuse of public invite and guest-report links.
Infrastructure and processors
The app runs on Vercel. Database, authentication, file storage and access policies (RLS) are on Supabase. Subscription payments and billing data go through Stripe. Transactional status emails are sent with Resend when the API key is configured. Each processes data only as needed for the service they provide to Fixklarn.
Where data is hosted
Data at rest (database, authentication and files) stays in the European Union on Supabase (region eu-west-1, Ireland). App compute (serverless functions) runs in the European Union on Vercel (region dub1, Dublin). Stripe and Resend are processors and may process data outside the EU under their own safeguards and contracts (DPA).
How long we keep it
Requests, photos, notes and history remain while the account is active and for 90 days after subscription cancellation or a deletion request; they are then deleted. Signed photo URLs expire after one hour. Invite and guest-report attempts store IP (and email on the invite path where applicable) for abuse limits, retained for 90 days. Payment data at Stripe follows Stripe's rules.
Cookies and local storage
We use the NEXT_LOCALE cookie (up to one year, SameSite=Lax) to remember language (pt or en). Auth session uses Supabase Auth cookies needed to keep you signed in. On public marketing pages we use Vercel Web Analytics, without cookies and without identifying users, to understand where traffic comes from (for example search engines and AI assistants). There are no advertising cookies. During checkout, Stripe may set cookies on the Stripe domain.
Security
Account data access goes through Supabase Auth and Row Level Security. Fault photos sit in a private bucket and are shown with a signed URL (one-hour validity), not a permanent public link.
Controller and processor
For tenant and request data entered in the customer account, the landlord or manager is the controller and Fixklarn is the processor. For landlord or manager account data (profile, account and billing), Fixklarn (operator in the Terms) is the controller.
Your rights
Under the GDPR you may request access, rectification, erasure, restriction, objection and portability where applicable, and lodge a complaint with the CNPD (www.cnpd.pt). The product does not yet offer self-service export or account deletion: request by email to support@fixklarn.com. Tenant requests about tenant and request data are answered by the landlord or manager of the account; Fixklarn assists when asked.
Supervisory authority
In Portugal the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD). Contact: www.cnpd.pt.
Privacy contact
Privacy requests: support@fixklarn.com. Operator: see Terms of Service (Operator section).