Privacy Policy

Last Updated: October 2026

At Sachii Lisbon ("we", "our", "us"), we handle your property with care, and we treat your personal data in the exact same way. We operate in full compliance with the EU General Data Protection Regulation (GDPR) (EU 2016/679).

This Privacy Policy explains how we handle your personal information when you visit our website (sachiilisbon.com), book an introductory call, or hire us to look after your home in Lisbon.

1. Who is Responsible for Your Data (Data Controller)

Sachii Lisbon
Lisbon, Portugal
Direct Contact: us@sachiilisbon.com

2. What Data We Collect & Why

We only collect data that is strictly necessary to schedule calls and care for your home. We do not run advertising scripts, tracking cookies, or automated profiling.

A. Introductory Calls (Cal.com)

When you schedule an intro call through our website, we collect:

Your Name
Your Email Address
Meeting Notes: Any details you voluntarily share regarding your property care needs.
Why we need it: To confirm, schedule, and host your 15-minute intro call.
Legal Basis: GDPR Article 6(1)(b) - Taking steps at your request prior to entering a contract.

B. Active Home Watch & Property Oversight

When you become a client, we store the operational details needed to manage your home securely:

Access Credentials: Key mapping IDs, alarm codes, gate PINs, and utility meter locations.
Property Records: Service agreements, visit report PDFs, and mail summaries.
Visit Report Data: Temperature and relative humidity readings, a checklist of what we inspected, visit notes, and photos taken during each walkthrough. These are submitted through our secure visit-report form and are tagged only with an anonymous property ID. The form does not collect your name, address or contact details, and we never enter access codes into it. The link between an anonymous ID and your property is held only in our end-to-end encrypted Proton Drive.
Why we need it: To perform physical home inspections, prevent moisture damage, manage emergencies, and keep your home secure.
Legal Basis: GDPR Article 6(1)(b) - Execution of a home watch service agreement.

3. Third-Party Data Processors & Technical Security

We do not host your access codes or contracts on our public web server. Access codes and contracts are held in Proton's end-to-end encrypted services. Visit reports submitted through our secure visit-report form are held temporarily on Cloudflare before being archived in Proton Drive (see Section 5). To manage our communications and operations securely while maintaining GDPR compliance, we rely on the following third-party data processors:

Service Provider	Role & Data Held	Technical Security & Location
Cal.com, Inc.	Calendar Booking (Name & Email)	HTTPS/TLS in-transit encryption. Data hosted in EU / US under Standard Contractual Clauses. We do not set any cookies for our booking calendar. Cal.com may set its own strictly necessary security cookies (for example, bot protection) when the booking window loads or when you visit cal.com. Their cookies and privacy policy are governed by Cal.com.
Google LLC / Gmail	Email Communications & Enquiries	Transport Layer Security (TLS) encryption and secure cloud storage.
Mailjet SAS	Outbound Email Relay / Delivery	GDPR-compliant EU infrastructure (France) routing messages securely.
Proton AG (Proton Pass & Drive)	Property Access Credentials, Contracts, Archived Visit Reports & Photos, Files	End-to-end encrypted (E2EE) storage in Switzerland under Swiss Federal Data Protection Act.
Cloudflare, Inc. (website)	Website delivery and security	Global CDN. Processes technical data such as visitors' IP addresses to deliver and protect the site. We do not use it for tracking or analytics.
Cloudflare, Inc. (visit-report form)	Visit report data: readings, checklist results, notes and photos, tagged only with an anonymous property ID	Access restricted to us. Photos and notes are held temporarily and deleted once archived in Proton Drive, and in any case within 30 days; numerical readings and checklist results are kept for statistics (see Section 5).

4. Cookies & Tracking

Our website is built using static code. We do not use tracking cookies, local storage tracking, or third-party web analytics (such as Google Analytics). Our hosting provider, Cloudflare, may set a strictly necessary security cookie (cf_clearance) to protect the site from automated abuse. It does not identify you or track your activity.

All images, fonts, and scripts are served directly from our own domain, so no third-party font, script or tracking provider can log your IP address when you browse our site. Our hosting provider, Cloudflare, processes IP addresses to deliver and protect the site (see Section 3). When you open the booking window, it loads from Cal.com's servers, which receive your IP address.

5. How Long We Keep Your Data

We store your personal data strictly for as long as necessary to provide our services and satisfy our legal obligations:

Enquiries & Booking Requests: Meeting details and notes from prospective clients who do not onboard are permanently deleted after 90 days.
Physical Access Credentials: Alarm PINs, digital door codes, and access notes stored in our zero-knowledge Proton vault are permanently destroyed immediately upon contract termination.
Visit Reports & Photos (Proton Drive): Finished report PDFs and photos archived in Proton Drive are retained for 3 years following contract termination (aligned with the Portuguese Civil Code statute of limitations for property liability claims).
Visit Report Data (Cloudflare): Photos and visit notes are held on Cloudflare only temporarily. They are archived in Proton Drive and then deleted from Cloudflare, and in any case within 30 days of the visit. Numerical readings and checklist results, linked only to an anonymous property ID, are kept for statistical purposes. When the retention period for a client's records ends, or if you ask us to erase your data, we delete the link between the anonymous ID and your property, after which the remaining readings can no longer be linked to you.
Contracts & Tax Records: Signed service agreements, issued invoices, and payment records are retained for 10 years following contract termination as mandated by Portuguese tax law (Autoridade Tributária e Aduaneira).

6. Your Rights Under GDPR

You have full control over your personal data. Under the GDPR, you have the right to:

Access the personal data we hold about you.
Rectify any inaccurate or incomplete data.
Request Erasure of your data (subject to legal or tax retention obligations).
Restrict or Object to how we process your information.
Request Data Portability to move your data elsewhere.

To exercise any of these rights, email us directly at us@sachiilisbon.com.

If you believe your data is being handled improperly, you also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD - Comissão Nacional de Protecção de Dados) at cnpd.pt.