Privacy Policy
Version 2.0 · in force since 20 August 2026
This is a courtesy translation. If anything differs, the Portuguese version prevails.
This policy covers two different situations
Did you book a service? Read Part A. The person or business that provides your service is the one answerable for your data; Alayah is only the tool they use.
Do you have a platform account — are you a professional, or responsible for a business that uses Alayah? Read Part B. There, Alayah is the one answerable.
If you booked a service
The provider is the controller. Alayah is the processor.
A1. Who is answerable for your data
The data controller is the professional or business where you booked the service — below, «the provider». They decide which data is requested, what it is used for and how long it is kept, and they are who you should contact first; you will find their name and contact details on their booking page and in the confirmation e-mail you received.
Alayah is the processor(Art. 28 GDPR): it supplies the provider with the system where the data is stored, and processes it only on the provider's documented instructions.
A2. What data is collected
- First and last name — to identify the booking and the client record
- Mobile number — for the booking confirmation and, if you allowed it, for the reminder
- E-mail (optional) — for the confirmation and, if you allowed it, for reminders and messages from the provider
- Date of birth (optional) — used solely for the birthday discount, and only if you allowed marketing messages
- History of bookings and services received
- Service preferences (optional)
- Consent record — date, channel, version of this policy, and an irreversible code derived from your IP address, kept as proof that consent was given
A3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing the booking and providing the service, including the confirmation message | Performance of a contract — Art. 6(1)(b) |
| Reminders and notices about your bookings, by SMS or e-mail (only if you allow it, channel by channel) | Consent — Art. 6(1)(a) |
| Campaigns, news and the birthday discount, with the option to object at any time | Consent, or direct marketing to existing customers — Art. 6(1)(a) and Art. 13-A of Portuguese Law 41/2004 |
| Service history, to provide continuity of care | Legitimate interests — Art. 6(1)(f) |
| Invoicing and compliance with tax obligations | Legal obligation — Art. 6(1)(c) |
| Proof of the consents given, and platform security | Legal obligation (Art. 7(1)) and legitimate interests — Art. 6(1)(c) and (f) |
A4. How long it is kept
| Category | Retention |
|---|---|
| Client record and booking history | 5 years after the last service, unless you ask for erasure sooner |
| Invoicing documents | 10 years — a period imposed by law (Art. 52 of the Portuguese VAT Code and Art. 40 of the Commercial Code). It cannot be shortened on request. |
| Consent and withdrawal records | 5 years after they cease to have effect — they are the proof required by Art. 7(1) |
| Technical error and security logs | Up to 90 days |
Once those periods end, the data is erased or anonymised. An erasure request is always carried out as far as the law allows — what tax law requires to be kept remains, but is blocked for every other purpose.
A5. Do you have to provide this data?
There is no legal obligation to provide it, but your name and a contact are necessary for the booking to exist — without them the provider cannot hold the slot for you or tell you about a change. Without that data, the booking cannot be made through the platform.
Everything else — e-mail, date of birth, preferences, reminders and campaigns — is free and optional. Declining has no consequence for the service you receive, and the booking confirmation is sent either way.
A6. If you did not enter the data yourself
Your record may have been created by the provider — for example when you book by phone or in person. In that case the data comes from you, given to the provider during that contact, and is exactly what is described in A2, with the same purposes and retention periods.
You have the same rights, and you may ask the provider to show you what is on record (Art. 14 GDPR).
If you use the platform to work
Subscribing professionals and businesses. Here Alayah is the controller.
B1. Data controller
Mayara Rosa dos Santos
Sole trader, operating under the Alayah brand
Portuguese tax number (NIF): 246 342 439
Av. 25 de Abril de 1974 40A, 2795-227 Linda-a-Velha
Portugal
E-mail: assistentemsvirtual@gmail.com
B2. What data is processed and why
| Data | Purpose and legal basis |
|---|---|
| Name, e-mail, phone, hashed password, the business you belong to | Creating and maintaining the account and giving access to the platform — performance of a contract, Art. 6(1)(b) |
| Subscription and payment data, processed by Stripe | Charging the subscription and meeting tax obligations — Art. 6(1)(b) and (c) |
| Access and audit logs, IP address, error logs | Security, abuse detection and fault diagnosis — legitimate interests, Art. 6(1)(f) |
| Support messages you send us | Answering and resolving the request — Art. 6(1)(b) and (f) |
Account data is kept while the account exists and for up to 5 years after it is closed; invoicing documents, 10 years, as the law requires; technical logs, up to 90 days.
Applies to everyone
Processors, security, cookies and your rights.
C1. Who the data is shared with
Data is never sold or traded. It is shared only with the suppliers needed for the platform to work, all bound by a processing agreement under Art. 28 GDPR:
| Supplier | Role | Location |
|---|---|---|
| Supabase | Alojamento da base de dados (PostgreSQL) | União Europeia |
| Vercel Inc. | Alojamento e entrega da aplicação web | EUA — EU-U.S. Data Privacy Framework |
| Brevo (Sendinblue) | Envio de email e SMS de confirmação, lembrete e campanhas | União Europeia |
| Functional Software, Inc. (Sentry) | Registo de erros técnicos da aplicação, para diagnóstico e segurança | EUA — EU-U.S. Data Privacy Framework |
| Stripe Payments Europe, Ltd. | Processamento dos pagamentos da subscrição da plataforma pelos prestadores | Irlanda (UE) |
| Google Ireland Ltd. | Correio electrónico do canal de privacidade (receção dos pedidos de exercício de direitos) | União Europeia |
Data may also be disclosed to public authorities where the law requires it.
C2. Transfers outside the European Union
The database is hosted in the European Union. Two suppliers are US companies — Vercel (application hosting) and Sentry (technical error logging). Transfers to the United States rely on the European Commission adequacy decision for the EU-U.S. Data Privacy Framework of 10 July 2023, supplemented by standard contractual clauses.
You may request a copy of the applicable safeguards at the e-mail address given in C7.
C3. Security
Data always travels encrypted (HTTPS/TLS) and access to the platform requires authentication, with permissions limited to what each role needs. Consent records do not store the IP address in plain text: they store an irreversible code derived from it. Passwords are stored hashed and never in readable form.
In the event of a personal data breach, the supervisory authority is notified within 72 hours (Art. 33) and data subjects are informed whenever the breach is likely to result in a high risk to their rights (Art. 34).
C4. Cookies and local storage
This site uses no advertising, tracking or audience-analytics cookies, and does not share browsing data for those purposes. Only strictly necessary mechanisms are used: the authentication session for people entering the management area, and a local record in your browser that remembers your choices so you are not asked again.
Being strictly necessary, these mechanisms are exempt from consent under Art. 5(3) of Portuguese Law 41/2004. You may delete them in your browser settings, with the consequence that you will have to sign in again.
C5. Your rights
Under the GDPR (Reg. EU 2016/679) you have the right to:
- Access — know what data exists about you and obtain a copy (Art. 15)
- Rectification — correct inaccurate or incomplete data (Art. 16)
- Erasure — the «right to be forgotten» (Art. 17), within the limits of what tax law requires to be kept
- Restriction — suspend processing while a question is resolved (Art. 18)
- Portability — receive your data in a structured, commonly used format (Art. 20)
- Objection — object to processing based on legitimate interests (Art. 21(1)). For direct marketing the right to object is absolute: you only have to ask, with no need to give reasons (Art. 21(2))
- Withdraw consent at any time (Art. 7(3)) — withdrawing is as easy as giving it. Use the link at the foot of any e-mail, reply «STOP» to an SMS, or ask the provider. Withdrawal does not affect what was done beforehand, and does not cancel existing bookings.
You may also use the Right to Erasure page to submit a deletion request.
C6. Automated decisions
No automated decisions are taken that produce legal effects or similarly significantly affect you (Art. 22), and no profiling is carried out to predict behaviour. Bookings and messages are triggered by simple rules and by human decisions of the provider.
C7. How to exercise your rights, and how long we take
If you booked a service, address your request to the provider. If you prefer, send it to the address below and we will forward it to the controller, telling you that we have done so.
If you use the platform to work, send the request directly to: assistentemsvirtual@gmail.com
We answer without undue delay and in any event within one month of receiving the request. That period may be extended by up to two further months where the request is complex or where several requests are in hand — in which case you will be told of the extension and the reason for it within the first month (Art. 12(3)).
You always have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD).
C8. Data Protection Officer
No Data Protection Officer has been designated, as the conditions in Art. 37(1) GDPR are not met — the activity does not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data. All privacy matters are handled through the contact given in C7.
C9. Changes to this policy
This policy may be updated. The version and the date it took effect are shown at the top of the page, and every consent is recorded with the version in force at the moment it was given. Material changes are announced prominently on the site and, where they affect processing based on consent, by e-mail.
Questions? Contact assistentemsvirtual@gmail.com