PRIVACY POLICY
Draak-app Platform
Effective Date: November 10, 2026
1. Introduction
Welcome to the Draak-App platform! Draak-App is a digital ecosystem consisting of a Website (for Clients) and a Mobile Application (for Service Providers). Your privacy is fundamental to us. This Privacy Policy explains how we collect, use, disclose and protect your personal information when using any part of our Platform. By accessing the Site or downloading the Application, the user agrees to the practices described in this policy, which complies with the General Data Protection Regulation (GDPR) of the European Union.
2. Data Controller
The entity responsible for processing your personal data is: Willian Freitas Borges, Unipessoal Lda. Correspondence Address: Rua Pedro Alvares Cabral, 205, 4A, São Domingos de Rana, Cascais, 2785-396, Portugal. Privacy Email: contact@draak-app.com
3. Personal Data We Collect
| Category | Data Collected |
|---|---|
| General (All Users) | IP address, technical access data (dates, times), browser type, device model and operating system. Server audit logs: IP address, date, time and type of operation associated with actions such as login, failed login attempts, password recovery and change, profile and account changes, acceptance of legal documents, subscriptions and payments. |
| Clients | When booking: Name, phone number and email address (optional). Browsing: Search history and providers visited (anonymous data or associated with cookies). We do not collect the Client's Tax Identification Number. Online prepayment: if the Provider has enabled it and the Client pays, the payment method details (for example, card details) are entered directly on Mollie's pages and never pass through our servers. We only receive information about the payment (transaction identifier, amount, method, status and dates). |
| Service Providers | Name, email, phone, professional address, service/product details and profile/work photos. Transaction Data (Subscription): Payment confirmation provided by the App Store (e.g.: purchase ID, subscription expiry date). We do not have access to your banking or credit card data relating to the subscription, whose billing is managed entirely by the App Stores. The Tax Identification Number is not requested because of the subscription. |
| Providers with Online Payments | Only if the Provider connects their payment account: Mollie account identifier, status of the account and of the payment methods, and account access credentials (stored encrypted). Tax data: tax name, tax address, Tax Identification Number and whether the Provider is an individual or a company, obtained from Mollie and confirmed by the Provider. Consent record: date and time at which the Provider accepted the service fee. Transactions: amount, service fee, method, status and dates of each prepayment, linked to the booking. We do not have access to the Provider's banking or card data. |
| Authentication and Session | Session token stored locally on the device (valid up to 30 days when "stay connected" or biometric login is active). FCM token from the device for sending push notifications. In case of biometric login, an authentication token (never the fingerprint itself) is stored in the device's secure storage (Android Keystore) and is never transmitted to our servers. |
| App Permissions | Camera and Gallery: We request access if the Provider wishes to upload photos. Notifications: To send alerts for new bookings or reminders. |
4. Purposes of Processing
We process your data for the following specific purposes:
| Purpose | Description and Legal Basis (GDPR) |
|---|---|
| Account Management and Bookings | To allow Provider registration and Client bookings. Legal basis: performance of a contract. |
| Connection Between Users | To share Client contact details with the Provider when a booking is confirmed. Legal basis: performance of a contract. |
| Online Payments and Service Fee | To allow the Provider to receive prepayments from Clients through Mollie, to follow the status of payments and to charge the agreed service fee. Legal basis: performance of a contract. |
| Invoicing and Tax Obligations | To issue the invoices for the service fee, report them to the Tax and Customs Authority and keep the documentation required by law. Legal basis: compliance with a legal obligation. |
| Security and Auditing | Keep audit logs on our server to protect accounts against unauthorised access, detect abuse and fraud, demonstrate compliance with our obligations and resolve disputes. Legal basis: legitimate interest (security and fraud prevention) and, as regards payment, subscription and document acceptance records, performance of the contract and compliance with a legal obligation. |
| Communication and Support | To send booking confirmations or respond to enquiries. Legal basis: performance of a contract and legitimate interest. |
| Marketing | Sending news or promotions (only if authorised). Legal basis: consent. |
5. Sharing of Personal Data
We do not sell your personal data. Data sharing occurs only in the following strict situations:
- Between Client and Provider (Essential): When a Client confirms a booking, their Name, Phone and Email are automatically shared with the selected Provider. If there is a prepayment, the Provider also sees the payment status of that booking.
- Payments and Transactions: Subscriptions are processed directly by the Google Play Store or Apple App Store platforms, which are solely responsible for the respective payment data, in accordance with their own privacy policies. Booking prepayments are processed by Mollie (Mollie B.V.), through the Provider's own account. Draak-app does not collect or store card data or any other payment data. Mollie processes such data in accordance with its own privacy policy, and we share with it only what is necessary to create and follow the payment and to deduct the service fee.
- Certified Accountant: We share the Provider's tax data (tax name, tax address and Tax Identification Number) and the amount of the service fees with the certified accountant who issues our invoices, who is bound by a duty of confidentiality and by a personal data processing agreement.
- Technology Service Providers: We use trusted partners for hosting (Hostinger), transactional email and reminder sending (PHPMailer/SMTP), SMS reminder sending (Twilio) and push notifications (Firebase Cloud Messaging, by Google), who act under our instructions and confidentiality obligations.
- Authorities: When required by law or court order, including the reporting of invoices to the Tax and Customs Authority.
6. Online Payments, Service Fee and Invoicing
Online prepayment is an optional feature, available only to Providers with a plan that includes it and with Portugal as their tax country. The Provider connects their own Mollie account, creating it in the same process if they do not yet have one. The amount paid by the Client is credited directly to that account. Draak-app does not receive or hold those funds: it only receives the service fee, which Mollie deducts automatically from each payment.
So that we can invoice the service fee, we obtain from Mollie, at the time of connection, the Provider's tax name, tax address and Tax Identification Number. The Provider confirms these details only once, on a dedicated screen, fills in anything that may be missing and states whether they are an individual or a company. Once confirmed, the details cannot be changed in the Application. To correct them, the Provider may disconnect and reconnect the account, or contact us. These details are necessary for us to comply with our tax obligations and, without them, prepayment is not available.
We invoice the service fee once a month, to each Provider, in a single document that gathers the fees of the previous month. The invoice is issued electronically by a certified accountant, at our request, and sent to the Provider by email. The applicable VAT is determined by the region of the Provider's tax address (mainland Portugal, Madeira or the Azores).
Tax data, invoices and the copy of the data of each invoice request are kept for the periods indicated below, in the section on Data Retention and Deletion.
7. SMS Communications
For Clients of Providers subscribed to the Connect, Prime or Elite plans, a reminder SMS regarding a scheduled booking may be sent, with a frequency of at most one message per booking. The mobile phone number used for this purpose is provided: (a) directly by the Client, on a mandatory basis, when making an online booking through the Website; or (b) by the Service Provider, on an optional basis, when manually registering a Client in the Mobile Application, it being the Provider's responsibility to inform the Client about the automatic communications (including email and SMS) that they may receive through the Platform. The mobile phone number is never shared with third parties for marketing or advertising purposes, being used exclusively to send this reminder through our messaging provider (Twilio). Message and data charges from the Client's mobile carrier may apply. The Client may request that these communications be discontinued by contacting the Provider directly.
8. Cookies and Tracking Technologies Policy
Our Website uses cookies to improve the browsing experience.
- What are they? Small text files stored in your browser.
- Types of Cookies we use: Essential (necessary for basic operation and booking) and Analytical (optional, used to measure and improve performance).
- Control: The user has full control over non-essential cookies through the site's consent banner.
9. International Transfers
If our external service providers are located outside the European Economic Area (EEA), we ensure that the transfer is made under appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.
10. Data Security
We implement technical (encryption, HTTPS) and organisational (restricted access) measures to protect your personal data. However, we remind you that it is the Provider's responsibility to keep Application credentials secure. Third-party authentication keys (Google Firebase) are stored outside the server's public folders, inaccessible via the web, and the access credentials to the Provider's Mollie account are stored encrypted. Location data used in the site search are approximate coordinates and are not stored or associated with any user.
11. Data Retention and Deletion
Data is retained for the period necessary for the purposes for which it was collected. The Provider may request account deletion directly in the Application, through the account settings section. After confirmation, personal data is deleted from our servers, with the exceptions below, which are imposed by legal obligation or necessary for the purposes indicated there. If the Provider cancels the subscription and does not request account deletion, data is retained for up to 12 months without an active subscription, with an email warning at 11 months. Once this period ends, the account and data are deleted, without prejudice to data we must keep by legal obligation.
- Provider tax data: if the account is deactivated and there are no service fees left to invoice, they are kept for 180 days and then deleted. If there are fees left to invoice, they are kept until invoiced. If the account is deleted, the tax data is erased at the time of deletion, after the final invoice request for any missing fees has been issued; only the copy contained in that request remains, under the next point.
- Invoices and invoice requests: the service fee invoices and the copy of the data on which each invoice request was based are kept for 10 years, the legal retention period for tax documents.
- Online payment records: records of the prepayments processed are kept for the applicable legal period. When the Client or the Provider deletes their data, these records are kept without the Client's personal data. Bookings with an online payment are kept anonymised: the Client's name is replaced by "Cliente Removido" and the email, phone number and notes are deleted.
- Technical and audit logs: records of logins, failed login attempts, password recovery and change, email verification and changes to the profile and account are kept for 12 months and then deleted. Records of login attempts used to limit abusive access are kept for 15 minutes. Records of subscriptions, payments, chargebacks and acceptance of legal documents are kept for as long as they are needed to comply with legal obligations and defend rights.
- Deleted accounts: the deletion record loses the IP address and the description after 12 months, and the IP address is also removed from the other records of that account within the same period.
- Mollie credentials: the credentials for access to the Provider's Mollie account are kept, encrypted, for 180 days after the account is deleted or the payment account is disconnected, solely to process late chargebacks and refunds and to resolve pending payments. Once this period ends, access is revoked and the credentials are deleted.
12. Data Subject Rights
In accordance with the GDPR, you have the right to Access, Rectify, Erase ("Right to be forgotten"), object to processing and request Portability of your data. To exercise these rights, send an email to: contact@draak-app.com. The right to erasure does not apply to data that the law requires us to keep, such as invoice data, nor to data that is necessary for the defence of rights, as described in the section on Data Retention and Deletion. As for payment data processed by Mollie, you may also exercise your rights with Mollie.
12.1. Exception for Professionals Registered by the Provider Company
If you are a professional operating under the management of a Provider Account (account holder company), your registration, data and eventual deletion must be managed primarily by the account holder Provider (the company) through the "Team Management" feature. Draak-app will only process deletion requests from individual professionals upon request or confirmation from the account holder Provider who performed the registration. This measure aims to protect the account data structure and ensure deletion authorisation.
13. Complaints
If you believe your data is not being processed correctly, you have the right to lodge a complaint with the national supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt
14. Changes to this Policy
We may update this policy periodically. The most recent version will always be available on the Site and in the Application. The effective date at the top indicates the latest revision. Relevant changes, in particular those concerning payments or tax data, will be communicated in the Application or by email.