Privacy Policy
Last updated: April 3, 2026
ReHabita AI is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and protect your personal data, in compliance with the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and Portuguese data protection law (Law 58/2019).
1. Data Controller
The data controller for your personal data is the entity operating the ReHabita AI platform:
- Platform: ReHabita AI - rehabita.pt
- Contact email: [email protected]
2. Personal Data We Collect
We only collect data strictly necessary to provide our service:
2.1 Data you provide directly
| Data | Purpose | Legal Basis |
|---|---|---|
| Full name | Account identification and personalization | Performance of contract (Art. 6(1)(b) GDPR) |
| Email address | Authentication, service communications, and account recovery | Performance of contract (Art. 6(1)(b) GDPR) |
| Password (hashed) | Secure authentication | Performance of contract (Art. 6(1)(b) GDPR) |
| Tax ID (optional) | Invoice issuance | Legal obligation (Art. 6(1)(c) GDPR) |
| Billing address (optional) | Invoice issuance | Legal obligation (Art. 6(1)(c) GDPR) |
| Property photographs | 3D render generation | Performance of contract (Art. 6(1)(b) GDPR) |
2.2 Data collected automatically
| Data | Purpose | Legal Basis |
|---|---|---|
| IP address | Security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
| Access date and time | Security logs and diagnostics | Legitimate interest (Art. 6(1)(f) GDPR) |
| Browser type and device | Technical compatibility | Legitimate interest (Art. 6(1)(f) GDPR) |
3. How We Use Your Data
We process personal data for the following purposes:
- Service delivery - account creation and management, render generation, credit and project management;
- Payment processing - subscription management and transactions through a certified payment processor;
- Service communications - account notifications, terms updates, security alerts;
- Legal compliance - invoice issuance and tax obligations under applicable law;
- Security - fraud detection and prevention, abuse protection, and unauthorized access prevention;
- Service improvement - aggregated and anonymized usage analysis to improve the Platform.
4. Data Processors & International Transfers
To deliver our service, we use data processors (subprocessors) under Art. 28 GDPR for the following categories:
- Application hosting and infrastructure;
- Image storage and content delivery (CDN);
- Payment processing (PCI DSS certified);
- Transactional email delivery;
- Artificial intelligence processing (render generation).
Some processors may be located outside the European Economic Area (EEA). You may request the full list of subprocessors and their safeguards by contacting [email protected].
International data transfers outside the EEA are carried out based on Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), in accordance with Art. 46(2)(c) GDPR.
5. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected:
| Data | Retention Period |
|---|---|
| Account data (name, email) | While account is active, plus 30 days after deletion |
| Uploaded images and renders | While the project exists in your account; deleted when you delete the project or your account |
| Billing data (tax ID, address) | 10 years after the transaction, as required by Portuguese tax law |
| Security logs (IP address) | 12 months |
6. Your Rights
Under the GDPR (Articles 15-22), you have the following rights:
- Right of access (Art. 15) - obtain confirmation that your data is being processed and access it;
- Right to rectification (Art. 16) - correct inaccurate or incomplete data;
- Right to erasure (Art. 17) - request deletion of your data, where applicable;
- Right to restriction (Art. 18) - restrict processing in certain circumstances;
- Right to portability (Art. 20) - receive your data in a structured, commonly used, machine-readable format;
- Right to object (Art. 21) - object to processing based on legitimate interest;
- Right not to be subject to automated decisions (Art. 22) - including profiling with significant effects.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days, as required by Art. 12(3) GDPR.
7. Right to Complain
You have the right to lodge a complaint with the Portuguese data protection authority:
- Comissão Nacional de Proteção de Dados (CNPD)
- Rua de São Bento, 148-3.º, 1200-821 Lisbon, Portugal
- Phone: (+351) 213 928 400
- Website: www.cnpd.pt
If you are located in another EU/EEA country, you may also contact your local data protection authority.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data (Art. 32 GDPR), including:
- Password encryption with secure hashing algorithms (bcrypt);
- Encrypted communications via HTTPS/TLS;
- JWT authentication tokens with limited validity;
- Image storage on infrastructure with encryption at rest;
- Access monitoring and security logs;
- Role-based access control (only administrators can access user data).
9. Cookies & Similar Technologies
The Platform uses the following cookies and tracking technologies:
| Cookie / Technology | Purpose | Duration | Type |
|---|---|---|---|
| access_token | User authentication session | Session / 7 days | Essential |
| Google Analytics (_ga, _gid) | Anonymous usage analytics to improve the service | Up to 2 years | Analytics |
Essential cookies are exempt from the consent requirement under the ePrivacy Directive (Directive 2002/58/EC, Art. 5(3)). Google Analytics cookies are used for anonymous, aggregated analytics to help us improve the Platform.
The Platform does not use advertising cookies, behavioral tracking, or third-party marketing cookies.
10. Children
The Platform is not directed at anyone under 18 years of age. We do not intentionally collect data from minors. Under GDPR Art. 8, the processing of personal data of a child below the age of 16 (or 13 in Portugal) requires the consent of a parent or guardian.
If we become aware that data has been collected from a minor without appropriate consent, we will delete it immediately.
11. Changes to This Privacy Policy
This Privacy Policy may be updated periodically. Any significant changes will be communicated by email and/or by notice on the Platform at least 30 days in advance.
The last updated date will always be indicated at the top of this document.
12. Contact
For questions about data protection or to exercise your rights:
- Email: [email protected]
- Website: rehabita.pt