Privacy Policy

Last updated: 14 October 2026 Effective date: 29 May 2026 — the changes of 12 September 2026 and 14 October 2026 apply as described in Section 13

This Privacy Policy explains how ALerta ("we", "us", "our") collects, uses, and protects your personal data when you use our service available at alerta.com.pt and accessible at my.alerta.com.pt (collectively, the "Service").

ALerta is operated by Seventh Swell, LLC, trading as ALerta (2581 Haybale Street, Gilroy, CA 95020, United States). We are the data controller for the personal data described in this policy, except where stated otherwise.

For any questions, contact us at privacy@alerta.com.pt.

Did we contact you before you signed up? If you received marketing outreach from us as a registered AL operator, see our separate Outreach Privacy Notice, which explains how we handle business contact details obtained from the public RNAL register (Article 14 GDPR).

1. What data we collect

Data you give us directly

• Account information: name, email address, preferred language. We do not store passwords — sign-in is with Google, or with a one-time code or a single-use sign-in link sent to your email.
• Property information: addresses, AL license numbers, RNAL numbers, NIPC, SIBA credentials (encrypted), insurance details, safety certificate details
• Booking information: guest names, booking dates, booking amounts, platform of origin, payment dates
• Forwarded reservation emails (if you enable email-forward intake): the reservation confirmation emails you forward to your private ALerta address, and the reservation details we extract from them (guest name, dates, listing, amounts). The raw forwarded email is stored only briefly (see Section 7) and the parsed details become draft reservations for your review.
• Guest information for SIBA submissions: as required by Portuguese law (full name, nationality, date of birth, identity document type and number, country of issue, country of residence, dates of stay)
• Billing information (when you subscribe to a paid plan): your plan, the tax number (NIF) of your AL business and the result of its validation, your billing name and address, and the self-declaration you tick at checkout. Card details are entered on our payment processor's pages and never reach ALerta — see Section 3.
• Team members (when you invite people to your account): their name, email address and role, and the dates of the invitation, acceptance and removal — see Section 4.
• Property owners (when a property manager records the owners of the properties it manages, or invites them to the owner portal): name, tax number (NIF), contact details, bank account (encrypted), language and statements kept by the property manager, and the owner's own portal account — see Section 4A.
• Cleaner and operations contacts (when you use our operations features): name, phone number, role and, if the crew member chooses, that their work phone and email are shown to the owners of the properties they work on (Section 4A)
• Communications: any messages you send to our support team

Data collected automatically

• Usage data: pages visited, features used, timestamps
• Technical data: IP address, browser type, operating system, device type
• Authentication security log: for each sign-in attempt, the email address used, IP address, browser (user agent), and the outcome (code sent, sign-in completed, attempt failed) — kept for 30 days for account security and abuse prevention
• Cookies: strictly necessary cookies only — see Section 10.

Data from third parties

• Google: if you sign in with Google, we receive your name, email address, and Google profile ID
• Stripe: when you subscribe, we receive from our payment processor the status of your subscription and payments, invoice records and the result of the validation of your NIF against the EU VIES service (Section 3)

2. Why we use your data and our legal basis

We do not use your data for third-party advertising, profiling, or automated decision-making with legal effects. Marketing emails about ALerta itself are sent only if you opt in, and you can withdraw that consent at any time (see Section 8). Property owners invited to the owner portal never receive marketing emails.

3. Billing and subscriptions

When you subscribe to a paid plan, our payment processor Stripe hosts the checkout page, stores your payment method, issues invoices on our behalf and provides the customer portal where you manage your subscription. Your card details are entered on Stripe's pages and never reach ALerta.

We receive and keep: the plan you chose and its status; your Stripe customer and subscription identifiers; invoice records; the tax number (NIF) of your AL business together with the result of its validation against the EU VIES service; and the self-declaration you tick at checkout — with its date, version, language and IP address — as evidence that you buy the Service as a business for VAT reverse-charge purposes.

The lawful basis is the contract with you. Keeping the NIF, the VIES result, the self-declaration and the invoices for 10 years is a legal obligation under Portuguese and EU VAT rules. If a payment fails, Stripe retries it and we email you; access is then restricted as described in the Terms of Service.

4. Team members

An account owner may invite team members (staff or collaborators) to work in the account. For each member we process their name and email address, their role, and the dates of the invitation, acceptance and removal. The invitation email names the owner who sent it.

Members see the owner's properties, reservations and guest data as needed for their work, but not billing, team management or account deletion. The owner is responsible for informing the people they invite about this policy and for their activity under the account (Terms of Service, Section 4).

The lawful basis is the contract with the owner for the owner's account, and our legitimate interest in letting an owner delegate work for the member's own data, balanced against the member's rights — members may object at any time by writing to privacy@alerta.com.pt. Membership records are deleted 30 days after the member is removed; the invitation log is kept for 1 year.

4A. Property owners (Proprietários)

Some hosts manage properties on behalf of their owners ("property managers"). This section explains what happens to a property owner's data in ALerta.

Owner records kept by a property manager. A property manager may record, for each property owner, their name, tax number (NIF), email address, phone number, bank account number (IBAN, stored encrypted), address, preferred language and notes, link the owner to the properties they own, and send them statements by email. ALerta processes these records on the property manager's behalf, as its processor (Section 11), and the property manager is responsible for informing the owner about them.

The owner portal. On the plans that include it, a property manager may invite a property owner to the owner portal — a read-only view of the properties that manager manages for them. The invitation is sent to the email address the property manager entered, and to accept it the owner confirms that they have read this policy. From acceptance, ALerta is the controller of the owner's portal account: name, email address, preferred language, Google profile ID (only if the owner signs in with Google), the date this policy was accepted, the property managers the owner is linked to and since when, notification and display preferences, the tax profile the owner enters (tax regime, VAT regime and tax residence), and the messages and replies the owner writes. Owners sign in with Google or with a one-time code sent to their email; we do not store passwords. One account serves every property manager who invites the same email address, and no property manager sees another manager's data or link.

What property owners see. Only the properties their property manager manages for them and, for each one: reservations with dates, channel and amounts, with the guest shown by first name and surname initial only — never the guest's email, phone, tax number, nationality, date of birth or identity document; what was charged, the channel costs, the management fee and what the owner receives; statements; an estimate of the owner's own tax on that income; the registration (AL, RNAL), insurance and safety-check status of the property; incidents and cleaning and maintenance tasks, with their status, photos, files, comments and costs, and whether each cost is borne by the property manager or charged to the owner; and the cleaning and maintenance crew members who work on the property, by name and type of work. A crew member's work phone and email are shown only if that crew member chooses to share them in the crew portal: by default they are not shared, the choice can be changed at any time, and the property manager sees, for each crew member, whether they have shared, not shared or not yet answered. The owner also sees the property manager's own name and contact details. The property manager may choose which sections of the portal each owner sees. Comments and photos in incidents and tasks are written or taken by the property manager and their crews; ALerta does not filter their content.

What property managers see. The property manager sees the messages and replies the owner writes and the date the owner accepted the invitation. The property manager and their team members may open the portal in read-only mode ("View as owner") to check what the owner sees; this uses a short-lived cookie (Section 10).

Emails. Property owners receive only service emails: the invitation, a notice if access is withdrawn, new messages, replies on incidents and statements. Property owners never receive marketing emails from ALerta. Emails about messages, incident replies and statements can be switched off in the portal settings.

Lawful basis. The owner's portal account: performance of the agreement to use the portal that the owner asks for by accepting the invitation (Art. 6(1)(b) GDPR). What the owner sees about the property manager's properties, guests and crews is shown on the property manager's instruction and under the property manager's own lawful basis (Section 11). Crew members' work phone and email: the crew member's own consent (Art. 6(1)(a) GDPR), which they can withdraw at any time in the crew portal. Security logs and usage statistics: as in Section 2.

Ending access and deleting the account. If a property manager withdraws access, the owner stops seeing that manager's properties from their next page load and receives a short email; the account remains while it is linked to other property managers. Property owners can export their data and delete their account in the portal settings (Section 8). Deletion removes the account and every link to property managers. The property manager keeps their own record about the owner and the statements already sent, which are the property manager's records — requests about them go to the property manager first (Section 11). Messages the owner wrote remain in the property manager's conversation, shown as "Owner (account deleted)". Retention periods are set out in Section 7.

5. Who we share data with

We share personal data with the third parties listed on our sub-processors and service providers page, which is organised by the role ALerta plays:

• A. Sub-processors that process host and guest data on our behalf under the Data Processing Agreement: hosting, database, email delivery, AI parsing of forwarded emails, payments, channel synchronisation, the background synchronisation worker, the email-intake edge worker and internal alerts.
• B. Providers for our own processing as a controller: sign-in with Google, subscription billing, outreach email, cookieless analytics, internal notes and our EU representative.
• C. Services you connect yourself (InvoiceXpress; Booking.com and Airbnb through Channex), where your own contract with them applies.
• D. Statutory recipients: SEF / AIMA through SIBA, as required by law.

Each row on that page states the purpose, the location of processing and the contract in place — a data processing agreement or addendum, executed or incorporated into the provider's terms — or says "to confirm" or "to execute" where we are still collecting it. We update that page before adding a sub-processor, and you may object as described in the Data Processing Agreement.

We do not sell your data. We do not share data with advertisers.

6. International data transfers

Our primary infrastructure is hosted in the European Union. Where any provider processes data outside the EU (for example, Google for sign-in, Anthropic for parsing forwarded emails, Railway for the synchronisation worker), the transfer is protected by Standard Contractual Clauses (SCCs) approved by the European Commission, the EU–U.S. Data Privacy Framework, or an equivalent safeguard, as stated on the sub-processors page.

ALerta's controller, Seventh Swell, LLC, is established in the United States, while your personal data is stored in the European Union (Supabase, Frankfurt). Access to that EU-stored data from the United States is an international transfer, and we use two safeguards. Guest data that we process on your behalf is covered by the EU Standard Contractual Clauses (Module Two) incorporated in our Data Processing Agreement (Section 10 and Annex 2): you are the data exporter and Seventh Swell, LLC is the data importer. Your own account, property and billing data, for which we are the controller, is protected by the measures in Section 9 and by our EU representative (Section 14); for this data we are completing self-certification under the EU–U.S. Data Privacy Framework (planned for the fourth quarter of 2026) and will update this section when it is listed.

7. How long we keep data

After the retention period, data is deleted or anonymised.

8. Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to our legal retention obligations
• Restrict how we process your data
• Receive your data in a portable format
• Object to processing based on legitimate interest
• Object to a newly listed sub-processor within 30 days of its listing (Data Processing Agreement, Section 6)
• Withdraw consent at any time (where consent is the legal basis)
• Lodge a complaint with the Portuguese supervisory authority, CNPD (cnpd.pt)

Marketing emails: if you opted in, you can withdraw your consent at any time — use the unsubscribe link included in any marketing email, or your account settings. Withdrawing consent stops marketing emails only; service emails and your use of the Service are unaffected.

Property owners and crew members. Property owners exercise these rights for their portal account in the portal settings (export and deletion) or by writing to privacy@alerta.com.pt; for the records their property manager keeps about them, they contact the property manager first, as guests do (Section 11). Crew members can withdraw their choice to share their work phone and email with owners at any time in the crew portal; the change applies from the owner's next page load.

To exercise any of these rights, contact us at privacy@alerta.com.pt. We will respond within 30 days. We may ask you to verify your identity before acting on your request.

9. Security

We use the following security measures:

• TLS encryption for all data in transit
• Encryption at rest for stored data, including AES-256 encryption for SIBA credentials and other sensitive property fields (Wi-Fi password, lockbox code, alarm code)
• Passwordless authentication with Google sign-in and short-lived one-time codes or single-use sign-in links sent to your email
• Role-based access controls
• Audit logging of sensitive operations
• Regular review of access permissions
• Secure development practices, including code review for changes affecting personal data

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify the CNPD within 72 hours and notify you directly if there is a high risk to your rights.

10. Cookies and analytics

We use only strictly necessary cookies on my.alerta.com.pt: the session cookie that keeps you signed in, your language preference and legal-page language, a short-lived cookie that carries an invitation code during sign-up, and, for property managers who use "View as owner", a cookie that keeps that read-only view open for up to 2 hours. Stripe sets its own cookies on the checkout and customer-portal pages it hosts, under Stripe's privacy policy.

Our page-view statistics come from Vercel Web Analytics, which is cookieless: it records page views and aggregate device and country data without cookies, without cross-site tracking and without building a profile of you. We do not use advertising or tracking cookies.

11. Hosts and guest data

If you are a host using ALerta to manage your properties, you are the primary data controller for your guests' personal data. ALerta acts as your data processor for the purposes described in our Data Processing Agreement (Article 28 GDPR) — SIBA submissions, reservation and stay records, guest messages and payments from the channels you connect. Our sub-processors for that data are those in list A of the sub-processors page.

If you manage properties for their owners, the same applies to the owner records and statements you keep in ALerta: you are their controller and ALerta is your processor. When you invite a property owner to the owner portal, ALerta shows the owner, on your instruction, your records of the properties you manage for them, as described in Section 4A — including guests' first names and surname initials, the comments and photos in incidents and tasks, and the names and types of work of your crew members. You are responsible for informing your guests, your crews and the property owners accordingly.

This means that:

• Guests should direct requests about their data to you first
• You are responsible for informing your guests how their data is handled
• We will support you in responding to guest requests, and we will respond directly if you do not act on a request within 14 days

12. Children

ALerta is intended for use by adults: Portuguese AL hosts, the people they invite and the owners of the properties they manage. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Material changes are notified by email to the address on your account before they take effect, and for existing customers they take effect on the later of the date stated in the notice and 30 days after the notice was sent. The "Last updated" date at the top of this page and the version recorded with your account identify the text you were notified of.

The changes of 12 September 2026 — billing and subscriptions (Section 3), team members (Section 4), the rebuilt sub-processors page (Section 5), cookies and analytics (Section 10) and the new controller details — apply to new customers from 1 October 2026 and to existing customers from 12 October 2026. If you do not agree, you may export your data and delete your account before that date.

The change of 22 September 2026 — Section 6 now states the transfer safeguards in place (Standard Contractual Clauses in the Data Processing Agreement; Data Privacy Framework certification in preparation) — adds safeguards and changes nothing about what we collect or why; it applies from the same dates.

The change of 14 October 2026 — new Section 4A (property owners and the owner portal) and the related additions to Sections 1, 2, 7, 8, 9, 10, 11 and 12 — applies from 14 October 2026.

14. Contact

Data controller: Seventh Swell, LLC, trading as ALerta Address: 2581 Haybale Street, Gilroy, CA 95020, United States Contact person: Carlo Dangelo Email: privacy@alerta.com.pt EU representative (Art. 27): Our representative in the EU, appointed under Article 27 GDPR, is Prighter EU Rep GmbH (part of the Prighter Group). To exercise your rights as a data subject, or to contact our representative on any data-protection matter, please visit: https://app.prighter.com/portal/18427641667

Powered by Prighter

Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa www.cnpd.pt