Privacy and Data Protection Policy (GDPR)

1. Data controller

The controller of your data is LavaJá, based in Odivelas, Portugal. For any privacy matter, contact contato@lavaja.pt.

2. What data we collect

Account and contact data: name, email, phone and, optionally, tax number (NIF) for invoicing.

Service data: pickup addresses, bookings, laundry preferences, instructions, weight and order history.

Payment data: handled directly by our processor Stripe. We do not store your full card details.

Technical data: minimal device and session information needed for the site to work and stay secure.

Acquisition data: when you sign up, we store how you reached the site (campaign, search engine or referring domain) and the landing page. This tells us which channels work. We store only the domain you came from, never the full address.

3. How we use the data

To provide the service: collect, treat and deliver laundry, manage your subscription and send order updates.

For invoicing and to meet legal and tax obligations.

To improve the service and personalise your experience (for example, remembering your laundry preferences).

For service communications, in the language you chose.

4. Legal basis

We process data based on the performance of the contract (providing the service), compliance with legal obligations and, where applicable, your consent or our legitimate interest in improving and protecting the service.

5. Sharing with third parties

We share data only with providers necessary to the service, such as the payment processor (Stripe), hosting and database infrastructure (Supabase), and operational pickup and delivery partners, always limited to what is strictly necessary.

We do not sell your data.

6. Retention

We keep data while your account is active and for as long as needed to meet legal obligations (for example, invoicing). After that, it is deleted or anonymised.

7. Your rights

You have the right to access, rectify, erase, restrict and object to processing, as well as data portability.

To exercise these rights, contact contato@lavaja.pt. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD).

8. Marketing communications

We only send you news and offers if you explicitly asked for them, by ticking the dedicated box at sign-up or enabling the option in your profile. It is never automatic and never a condition for using the service.

You can unsubscribe at any time, using the link in every message or by turning the option off in your profile. Unsubscribing takes effect immediately and does not affect service emails (collection, delivery and billing confirmations), which are part of the contract.

The mailing list is handled by Resend, acting as a processor and not using your data for its own purposes.

9. Cookies and local storage

We only use the cookies and local storage needed for the site to work (session, language and app prompt preferences). We do not use advertising cookies and we do not share data with ad networks.

Site analytics runs without cookies and without individual profiles.

The origin of your visit is kept in your browser session storage, only so we can attach it to your sign-up if you decide to create an account. It is deleted when you close the tab and never leaves your device before that.