Privacy Policy

1. Who is responsible

Engomio is the controller for the data of visitors of our commercial sites, people who contact us and laundry users (administrators and employees). For the data of each laundry's customers, the laundry is the controller and Engomio is its processor.

Data-protection contact: geral@sourcepoint.pt.

2. Data we process

• Laundry users: name, email, password (stored only as a secure hash), profile and assigned branches.
• Laundry information: name, branches, contacts, opening hours, prices and settings.
• Customers of laundries (on the laundry's behalf): name, phone, email, optional tax number and notes, orders, credits, payments and portal account.
• Contact form: name, email, subject and message.
• Technical data: hosting providers keep short-lived security logs (such as IP addresses) to protect the service.

3. Purposes and legal bases

• Providing the service to laundries and their customers — performance of a contract.
• Security, fraud prevention and service improvement — legitimate interest.
• Answering your messages — your request and our legitimate interest.
• Keeping records required by law — legal obligation.

4. Engomio as processor for laundries

When processing customer data for a laundry, Engomio acts only on the laundry's instructions, keeps the data confidential and secure, isolates it from other laundries, uses only the sub-processors listed below, helps the laundry answer rights requests and deletes or returns the data when the service ends (Article 28 GDPR).

5. Sub-processors and transfers

We use the following providers:

• Vercel — application hosting.
• Neon — database hosting in the European Union (Frankfurt).
• Stripe — online payments, only for laundries that connect their Stripe account.
• Resend — transactional emails, when enabled.

6. International transfers

Some providers may access data from outside the European Economic Area. Such transfers rely on adequacy decisions (including the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.

7. How long we keep data

• User and laundry data: while the account is active and for 30 days after it is closed.
• Financial records: for the periods required by tax and accounting law.
• Contact messages: up to 12 months.
• Sign-in sessions: up to 30 days of inactivity.

8. Security

Data is encrypted in transit, passwords are hashed with a memory-hard algorithm, each laundry's data is isolated and access depends on the user's profile and branches.

9. Your rights

You have the rights described on our data protection rights page, including access, rectification, erasure and portability, and the right to complain to a supervisory authority.

10. Cookies, children and changes

We only use strictly necessary cookies (see the Cookie Policy). Engomio is not directed at children under 16. We will publish any changes to this policy on this page with a new date.