This English version is provided for convenience. In case of any discrepancy, the Portuguese version prevails.
Data Controller
The data controller is DropBag. Data protection contact: suporte@dropbag.dev.
Personal Data Collected
- Email — at registration
- Full name — at registration
- Approximate GPS location — during active use only (with explicit permission; revocable at any time)
- Bag photos — at check-in and check-out (proof of condition)
- Booking data: dates, location, price, status
- Stripe payment identifier (no card data stored by DropBag)
- Technical data: device type, app version, anonymous error logs
- KYC documents (partners only): identity card, passport, or company certificate images — encrypted at rest, processed solely for identity verification
Purpose and Legal Basis
Account and booking management: contract performance (Art. 6(1)(b) GDPR). Location: consent (Art. 6(1)(a) GDPR) — used in real time for map display and Geo DropCoins gamification only; not stored after the session. Check-in/out photos: contract performance + legitimate interest. KYC documents (partners): legal obligation and legitimate interest (Art. 6(1)(b)(f) GDPR) — to verify partner identity before activation. Analytics and error monitoring: legitimate interest (Art. 6(1)(f) GDPR).
Storage and Security
Data is stored on Supabase (encrypted cloud, AWS infrastructure, SOC 2 Type II, GDPR compliant). All communication is encrypted in transit (TLS 1.2+) and data at rest is encrypted with AES-256. KYC document images are stored in encrypted, access-controlled private storage and are not publicly accessible. Payment card data never passes through our servers — processed by Stripe (PCI-DSS Level 1).
Website waitlist (dropbag.dev)
If you join the waitlist on dropbag.dev, we collect your email address, whether you signed up as a traveller or as a shop/host, and the language of the page you used. We use this only to tell you when DropBag launches near you and, for shops and hosts, to contact you about listing your space. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing suporte@dropbag.dev, and we will delete your data. The data is kept until you withdraw your consent. The website does not use advertising or tracking cookies.
Your Rights (GDPR)
- Access — request a copy of your data
- Rectification — correct inaccurate data
- Erasure — delete account and data (via Settings)
- Portability — receive your data in a structured format (JSON/CSV)
- Objection — object to processing based on legitimate interest
- Restriction — suspend processing while a complaint is reviewed
To exercise these rights: suporte@dropbag.dev. Response within 30 days. You may also lodge a complaint with your supervisory authority.
Minors
The service is not directed at users under 16 years of age. We do not intentionally collect data from minors.
Retention Period
- Account data: while active + 2 years after deletion
- Booking data: 5 years (legal/tax obligations)
- Bag photos: 12 months after booking completion
- Error logs (Sentry): 90 days
- Analytics data (PostHog): 12 months, then anonymized
- Location data: not stored — processed in real time only for map and Geo DropCoins gamification
- KYC documents (partners): 3 years after account closure (legal obligation)
Changes to this Policy
DropBag may update this Policy. For substantial changes, you will be notified in the app at least 15 days before they take effect.
Contact
Data controller · response within 30 days: suporte@dropbag.dev
Drafted in compliance with GDPR (EU) 2016/679.