Privacy policy

1. Who we are and who decides

Revezaí is a service of RB Solutions, registered in Brazil under CNPJ 32.875.738/0001-99, based in Porto Alegre, RS ("Revezaí", "we").

The building is the controller of its residents' data: it decides who gets in and how the spaces are used. Revezaí is the processor of that data and handles it on the building's behalf, to provide the service.

For your account (name, e-mail, password and mobile number), which works in every building, and for the site's data, Revezaí is the controller.

2. Data we process

Account: name, e-mail, password (stored irreversibly), mobile number if you give one, and preferred language.

Use in the building: unit and role in each building, bookings, waitlists, draws, event requests and cancellation comments.

Technical: IP address and browser of the session, sign-in attempts and the record of administrative actions (who approved, changed or cancelled what, and when).

Site: name, e-mail, phone and message of whoever writes through the contact form.

3. What we use it for, and the legal basis

Creating and keeping the account, and running bookings, waitlists, draws and e-mail notices: performance of the contract for using the service (LGPD Art. 7, V).

Letting the building's management approve residents, keep the history and see reports: performance of the contract with the building and its legitimate interest in managing the shared spaces (Art. 7, V and IX).

Mobile number: it is optional and only lets the building's management reach you more easily, for example on WhatsApp. Legal basis: legitimate interest (Art. 7, IX). You can delete it in your profile at any time.

Security and abuse prevention (sessions, sign-in attempts, record of actions): legitimate interest (Art. 7, IX).

Answering whoever writes through the site: steps before a contract and legitimate interest (Art. 7, V and IX).

We do not sell data, do not use it for advertising and do not build profiles. The draw for time slots is random, follows the building's rules, is the same for everyone and is recorded.

4. Who else sees it

Other residents of the same building see the unit and first name of whoever booked each time. The building's management sees the data of that building's residents, including the mobile number when given. Other residents do not see your number or your e-mail.

The Revezaí team only enters a building to give support, and each entry is recorded.

Suppliers that run the platform, as processors: hosting (Vercel), database (Neon), e-mail delivery (Resend) and real-time schedule updates (Ably, which receives no personal data, only a notice that something changed).

5. International transfer

The data is stored on servers in the United States (Vercel and Neon), and e-mails are sent through Resend, also in the United States. These transfers rely on those suppliers' contractual data protection clauses (LGPD Art. 33), and your rights apply to this data in the same way.

6. Cookies

We only use the necessary cookies: the session one (to keep you signed in) and the one for the chosen language. The light or dark theme preference is kept only in your browser. We use no tracking or advertising cookies.

7. How long

Account: while it exists. When you delete it, name, e-mail, mobile number and password are erased. Past bookings stay in the unit's history, without your name, because they are part of the building's records.

Building data (units, bookings, history and record of actions): while the building uses the service. When it stops, this data is erased.

Sessions and links sent by e-mail: until they expire (30 days at most). Sign-in attempts: 2 days. Error log: 30 days. History of e-mails sent: 180 days. Contact form messages: 2 years. The clean-up is automatic.

8. Your rights

Under the LGPD (Art. 18), you can: confirm whether we process your data and access it, correct incomplete or wrong data, ask for anonymization, blocking or erasure of what is unnecessary or excessive, take your data to another service, know who we share it with, object to a processing and ask for the account to be erased.

You can do much of it yourself in the app: correct name, mobile number and language in your profile, download all your data (Profile → Your data → Download my data) and delete the account.

For the rest, write to the data protection officer (section 11). We answer within 15 days. Requests about a building's data can also go to its management, and we help it answer.

You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

9. Security

Passwords stored as hashes, encrypted connections, encrypted database, each building's data kept apart from the others, limits on sign-in attempts, two-step verification for the team and a record of administrative actions.

If there is a security incident that may bring relevant risk or harm, we notify the ANPD and the people affected within the legal deadlines.

10. Children and teenagers

Revezaí is for people 18 and older. Children and teenagers use the spaces through a parent or guardian, who books with their own account. If we learn of an account of a minor, it will be deleted.

11. Data protection officer and contact

Data protection officer: RB Solutions. To reach the officer, exercise a right or ask about this policy, write to contato@revezai.com.br or use the site's contact form.

12. Changes

If this policy changes, we will let you know in the app and by e-mail before the change takes effect.