Skip to main content
Log inStart free

Privacy Policy

In force since October 13th, 2026 · version 2026-10-13

This Policy explains how Noctelo handles personal data and what your rights are. It covers the website, the dashboard, the staff portal, the public showcase pages and the app.

1. Controller

The controller of the data described in this Policy is Rafael Henrique Barros. For any privacy matter, use the email address below.

  • Provider: Rafael Henrique Barros, an individual resident in Spain, trading as Noctelo.
  • Spanish tax ID (NIF/NIE): Z2504792M
  • Email: contato@noctelo.site

2. Two roles: controller and processor

We are the controller for the data of the accounts that use Noctelo (owners, managers and staff), for billing, for support and for website visitors.

The data each business enters about its clients and professionals — contact details, bookings, messages, notes, photos, amounts — belongs to that business, which is its controller. For that data we act only as a processor, on the business's behalf and on its instructions, as agreed in the Terms. If you are a client or professional of a business that uses Noctelo, please direct your requests to that business; if you write to us, we will forward your request and help answer it.

3. What data we process

  • Account: name, email, phone number, password (stored only as an irreversible hash), language, role and permissions, and a record of your acceptance of these documents (version, date and IP address).
  • Business: name, address, country, settings, plan and subscription history.
  • Billing: Paddle customer and subscription identifiers, amount, status and dates of payments. Card details are entered in Paddle's form and never reach us.
  • Usage and security: IP address, device and browser type, access and error logs.
  • Support: the content of the messages you send us.
  • Showcase visitors: pseudonymised visit statistics. The IP address is turned into a code that changes every day and cannot be reversed; the IP address itself is not stored.
  • On behalf of businesses (as processor): client data (name, phone number, booking history, WhatsApp and Telegram messages, notes, trust rating), professional data (name, contact details, schedules, earnings and commissions, showcase photos and profile, PIN) and, when the business uses arrival checks for outcall bookings, the booking address and the device's location at the moment of arrival.

4. Why we use data and on what legal basis

  • Creating and managing your account and providing the service you subscribed to — performance of a contract (GDPR Art. 6(1)(b)).
  • Billing, invoicing and tax and accounting obligations — performance of a contract and compliance with a legal obligation (Art. 6(1)(b) and (c)).
  • Security, fraud and abuse prevention, bot protection at sign-up and error diagnosis — our legitimate interest in keeping the service secure and working (Art. 6(1)(f)).
  • Service emails (account confirmation, password recovery, subscription notices and changes to these documents) — performance of a contract.
  • Pseudonymised showcase statistics, so a business can see how many visits it received — legitimate interest, using as little data as possible.
  • Answering support requests — performance of a contract or our legitimate interest in replying to people who contact us.

We do not sell personal data, use it for advertising, or make automated decisions that have legal effects on you. We do not send marketing communications without your consent.

5. Who we share data with

We use the providers below, who process data only to provide their service to us and under contractual protection obligations:

  • Paddle.com Market Ltd (United Kingdom) — Merchant of Record: checkout, payments, invoices, taxes and refunds. Paddle also processes payment data as an independent controller under Paddle's privacy policy.
  • Contabo GmbH (Germany, EU) — servers hosting the service and its database.
  • Backblaze, Inc. (USA) — off-site backup of the database.
  • Sendinblue SAS — Brevo (France, EU) — delivery of service emails.
  • OpenAI (USA) — processing of messages and requests by the AI features, when the business uses them.
  • Functional Software, Inc. — Sentry (USA) — technical error monitoring, with authentication headers and sensitive fields removed.
  • Cloudflare, Inc. (USA) — bot verification (Turnstile) at sign-up.
  • OpenStreetMap Foundation (United Kingdom) — converting an outcall address into coordinates, when the business uses arrival checks. Only the address is sent, with no name or contact details.
  • Browser push services (Google, Apple, Mozilla) — delivering the push notifications you switch on.

WhatsApp (Meta) and Telegram are not our providers: they are services a business connects with its own accounts, and messages passing through them are subject to those services' policies.

We may also share data with professional advisers (for example legal or accounting), who are bound by confidentiality, and with authorities where the law requires it.

6. International transfers

Some providers are outside the European Economic Area. Transfers to the United Kingdom rely on the European Commission's adequacy decision. Transfers to the United States rely on the EU-US Data Privacy Framework, where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of the relevant safeguards.

7. How long we keep data

  • Account and business data: for as long as the account exists. After a closure request there are 30 days to change your mind; after that period the data is deleted, and only a record containing no personal data that the deletion took place is kept.
  • Backups: rotated, with each copy deleted after 14 days.
  • Billing records: for the period required by tax and commercial law.
  • Error logs: up to 90 days.
  • Pseudonymised showcase statistics: 400 days.
  • Support messages: for as long as needed to handle the request and any follow-up.

8. Security

All connections are encrypted (HTTPS). Passwords are stored only as hashes, WhatsApp sessions are encrypted in the database, server access is restricted and key-based, and each business can only see its own data. No system is infallible; if a breach affects your data, we will notify you and the authorities within the time limits set by law.

9. Cookies and local storage

We only use strictly necessary cookies and local storage: your session and protection against forged requests (CSRF), your chosen language, theme and interface preferences such as muted notifications or the active business. We use no advertising cookies and no third-party analytics, so we do not ask for cookie consent.

10. Your rights

Under the GDPR, you can ask for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. The account owner can export the business's data and request closure directly in the settings.

To exercise these rights, write to contato@noctelo.site. We reply within one month, which may be extended in the cases the law allows. We may ask for information to confirm your identity.

If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD) or to the data protection authority of the country where you live or work.

11. Minors

The service is intended only for people aged 18 or over. We do not knowingly collect data from minors; if we learn that we have, we delete it.

12. Changes to this Policy

We may update this Policy, for example when we change providers. The date and version in force are shown at the top of the page; material changes are announced to account owners by email or in the dashboard.