Privacy Policy

Última atualização: 12 October 2026

Este documento é disponibilizado em inglês, que é a versão vinculativa.

1. Who is responsible (controller)

The controller of your personal data is [COMPANY LEGAL NAME], [COMPANY ADDRESS], registration [REGISTRATION NUMBER]. Privacy contact: privacy@urbanworks24.com. [IF APPOINTED: Our Data Protection Officer can be reached at dpo@urbanworks24.com.]

2. What data we process

If you are a customer

• Account data: name, email, phone, password (stored only as a salted scrypt hash).
• Booking data: service, address, city, postal code, schedule, notes, price, status history.
• Optional media you attach to a booking (photos/videos of the job).
• Saved addresses and phone numbers you choose to keep.
• Reviews you write after completed bookings.

If you apply or work as a professional

• Application data: name, contact details, category, city, experience, country of origin.
• Verification (KYC) documents: profile photo, passport/ID, residence permit where applicable, proof of registered activity, and your CV.
• Work data: assigned jobs, earnings on the platform, ratings and reviews received.

Everyone

• In-app notifications and transactional emails we send you.
• Technical logs (IP-based rate limiting, security audit events) kept for safety.

3. Why we process it (legal bases, Art. 6 GDPR)

• Contract — creating your account, processing bookings and applications, matching professionals, support.
• Legal obligation — verifying professionals' right to operate (identity and activity documents), tax and accounting records.
• Legitimate interest — platform safety, fraud prevention, rate limiting, service quality (reviews), defending legal claims.
• Consent — only where we ask for it explicitly (e.g. optional marketing, if ever introduced). We do not use tracking cookies.

4. Identity documents — special care

Passports, permits and activity documents are stored in private, access-controlled storage. They are never public: only you (the applicant) and authorised operations staff can retrieve them, every admin download is audit-logged, and they are used exclusively to verify your application — never for marketing.

5. Who receives your data (processors)

• Hosting and private file storage: Vercel Inc. (application hosting, Vercel Blob).
• Database hosting: [DATABASE PROVIDER, e.g. Neon].
• Transactional email: Resend.
• The professional assigned to your booking sees what they need to do the job: your first name, address, schedule, notes, attached media and contact phone.

We never sell personal data. Where processors are outside the EEA, transfers rely on the EU Standard Contractual Clauses and/or an adequacy decision.

6. How long we keep it

• Account and booking data: for the life of the account, then up to the statutory limitation/tax periods.
• Rejected or withdrawn applications, including documents: deleted no later than 12 months after the decision.
• Booking media: deleted together with the booking record.
• Security logs: up to 12 months.

7. Your rights

You can ask for access, a copy (portability), rectification, erasure, restriction, and you can object to processing based on legitimate interest. Write to privacy@urbanworks24.com — we answer within one month. You can also complain to your supervisory authority: CNPD (Portugal), AEPD (Spain), CNIL (France) or the Garante (Italy).

8. Cookies & local storage

We use a single strictly-necessary cookie (uw24_session, httpOnly) to keep you signed in, and local storage for interface preferences (e.g. dismissing the cookie notice). There are no advertising, analytics or third-party tracking cookies — which is why we don't ask for cookie consent: none of our cookies require it.

9. Security

Passwords are hashed with scrypt, sessions are revocable server-side and stored only as hashes, documents live in private storage behind per-request authorisation, and admin access to sensitive files is audit-logged. No internet service can promise absolute security, but we design access narrowly by default.

10. Children

UrbanWorks24 is not directed at children under 16, and we do not knowingly process their data.

11. Changes

We will announce material changes to this policy on the platform. The current version always lives at this page.