This policy explains what personal data the Prima Prime app processes, why, for how long and what your rights are. It covers the iOS and Android app and the services behind it.
Who is responsible
Luis Manuel Santo Maia, data controller. Contact for anything about privacy: [email protected].
What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: name, email, password (stored only as a hash, never in plain text) | Create and keep your account and sign you in | Performance of a contract (Art. 6(1)(b)) |
| Record of your choices: which version of the Terms and this policy you accepted, whether you agreed to usage data, and when | Show what you agreed to | Legal obligation (Art. 6(1)(c)), to meet Art. 7(1) |
| Sessions: IP address and device/browser type of each signed-in session | Keep you signed in, protect the account, detect abuse | Legitimate interest in security (Art. 6(1)(f)) |
| Rate limits: IP address, briefly | Stop brute-force attacks on sign-in | Legitimate interest in security |
| What you save in the app (favourites, dates, partners, as these features launch) | Provide the service you ask for | Performance of a contract |
| Error reports (Sentry): technical description of the error, device model, OS and app version, your internal id — no name, email or IP | Find and fix bugs | Legitimate interest in a working app |
| App usage (PostHog): screens visited, app opened and closed, device model, language, version, your internal id — no name, email or anything you type; no screen recording | Understand which features are used and improve them | Consent (Art. 6(1)(a)) — optional, off by default; turn it on or off at any time in Profile → Share usage data |
We don’t sell data, don’t use it for advertising and don’t track you across other apps or websites. The app doesn’t ask for your location, contacts, photos, camera or microphone; if a future feature needs one, it asks at that moment and explains why.
Who processes data for us
Providers that process data only on our instructions (processors):
| Provider | Role | Where |
|---|---|---|
| Vercel | API servers | Frankfurt, Germany |
| Neon | Database | Frankfurt, Germany |
| Sentry (Functional Software) | Error reports | Germany (EU region) |
| PostHog | Usage analytics | European Union |
| Expo (650 Industries) | App update delivery (receives the device’s IP address when the app checks for updates) | USA |
Some of these providers are US companies; where data is transferred to or accessed from outside the EU, the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses apply.
Apple and Google process data under their own policies when you download the app from their stores.
How long
- Account and content: while the account exists. When you delete your account they are deleted from the database at once, as is your usage data in PostHog (database backups roll over within 24 hours).
- Sessions: until you sign out or after at most 30 days unused.
- Rate limits: minutes.
- Error reports: 30 days.
- Usage data: 12 months, linked only to an internal id.
Your rights
You can access, correct and delete your data, restrict or object to its processing, and receive it in a portable format.
- Delete your account: in the app, Profile → Delete account. It’s immediate and removes everything that belongs to the account.
- Withdraw consent to usage data: in Profile → Share usage data. We stop collecting it from that moment.
- Other requests: write to [email protected]. We answer within one month.
- Complaints: you can complain to your data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
Minimum age
Prima Prime is for people aged 18 or over.
Changes
If this policy changes in a meaningful way, we tell you in the app before the change takes effect. The date at the top shows the latest version.