1. Who we are
The person responsible for your data is:
- Data controller: Patrícia Marques, until a company exists
- Privacy contact: startup.nossahorta@gmail.com
Nossa Horta is a pilot project. It helps neighbours to offer, ask for and reserve garden produce, small services and help, through an automatic assistant on WhatsApp.
2. What an automatic assistant (AI) is
The one who answers you is a computer program that uses artificial intelligence (a language model from Anthropic) to understand what you write and to write the answers. Its name is Pati and it always says that it is an AI. The AI can only make things happen (publish, reserve, change a setting) through the same actions as the buttons in the app. The rules that protect your data (who sees what, when a phone number is shared, the STOP button) are written in the program and are not decided by the AI. The legal texts (consent, STOP, ERASE) are fixed and the program sends them exactly as they are. We do not take automatic decisions that have legal effects on you or affect you in a similar way. We tell you in the very first message that you are talking to an AI.
3. What data we collect
| Data | When | How we use it |
|---|---|---|
| Phone number (WhatsApp) | When you write to us | To identify you, to answer you, and (only after both people say yes) to give it to the other person in a reservation |
| Address or location you give (text or a shared location) | When you register or change it | To work out the distance to listings and to show your listings on the Nossa Horta public map (see section 6). The text of the address never appears to other people; in the summaries only the name of the village or parish is shown. The exact address goes to the buyer only after the seller allows it, in a separate question |
| Your text messages | Every time you write | Sent to the AI to understand what you ask and to write the answer. After your consent we keep the conversation (your messages and all the answers, also those not written by the AI) for 30 days, so that the conversation can continue and so that the Nossa Horta team can read it (see section 6); before your OK we only keep, in a temporary space, what was said in the conversation (your messages, Pati's introduction and the notice), for at most 24 hours: it moves into the conversation when you say OK and is deleted if you say no, if you write ERASE, or after 24 hours. We also keep the result (for example the title of the listing) |
| The language of your messages | Every time you write | We note whether each message is in Portuguese, English or another language, and keep one language for you (Portuguese or English), so that we answer and write to you in your language. You can change it at any time by asking ("English", "português", "automatic language"). It is kept until you ask for ERASE |
| Short note on how to talk to you | After consent | Written by the AI to answer you in your own way (language, "tu" or "você" in Portuguese, short or chatty answers, emojis, what you already know about Nossa Horta, what you usually offer or look for). It never keeps health, religion, politics, finances, data about other people, exact addresses or phone numbers. It stays until you ask for ERASE |
| Daily counter of AI answers | Every time the AI answers | Only a number per day (no text), to limit abuse and costs |
| Voice notes | If you send them | Turned into text by a transcription service. We do not keep the audio |
| Pickup points (public name and exact location) | When you choose where to pick up | Showing the pickup point on the public map, exactly, so people know where to go. You choose the place (we suggest a public one). Deleted when you remove it, with ERASE, or with the account |
| Date of your last voice note, date of the last voice-note tip and whether you asked not to get it | Whenever you send a voice note or get the tip | The assistant only suggests voice notes to people who write briefly or in a hurry, if you sent none in the last 30 days, got the tip in the last 14 days, and never after you write "stop suggesting voice notes". Kept until you ask for ERASE |
| Photos of products | If you send one | We remove the metadata (for example the GPS location of the photo), an AI checks that it does not show faces, house numbers, number plates or forbidden items, and we keep the image in a private space. It is visible to anyone who asks for "photo n" from a summary that includes it |
| Listings, reservations and pickups | When you create them or answer | To make the service work: listings (two days), reservations, pickup confirmations, missed pickups |
| Settings (radius, time of the summary, pause, saving mode) | When you change them | To send the right summary at the right time |
| Record of your consent (date and time) | When you register | To prove that you agreed |
| Reports and blocks | If you report or block someone | Safety of the community |
| Date of your last message and the identifiers of the messages received | Always | To respect the WhatsApp 24-hour window and not to process the same message twice |
We do not ask for or keep your WhatsApp profile name. Please do not ask for or send sensitive data (health, religion, etc.) or data about other people.
4. What we use the data for, and the legal basis
- Providing the service you asked for (listings, reservations, daily summary): carrying out the service you asked for and your consent. [to be confirmed by the lawyer: basis for each purpose]
- Sending you a daily summary of listings near you: your consent, given when you say yes (or give a time) to "do you want this every day?", right after your first list. Meta considers the summary a marketing message. You can pause it, switch to "saving mode" or stop everything with STOP.
- Turning voice notes into text and using AI to understand messages, write the answers and check photos, and keeping your messages for 30 days and a short note on how to talk to you so that the conversation can continue, and letting the Nossa Horta team read them to fix problems and improve the service (including Pati's answers): your consent.
- Safety and prevention of abuse (reports, blocks, repeated missed pickups, forbidden listings or scams): legitimate interest [to be confirmed].
- Meeting legal obligations, if any.
We only process data of people who are 18 or older. The notice at the start says "By replying OK, you confirm you are 18 or older": your OK is that confirmation (there is no other question). If we find out that you are under age, we stop processing your data and we erase it.
5. Who processes the data for us (processors)
We use the services below. Each one receives only what it needs for its job. [the lawyer confirms the processing contracts (DPA) and the safeguards for transfers outside the EEA, for example standard contractual clauses]
| Service | What for | What data it receives | Location |
|---|---|---|---|
| Meta Platforms (WhatsApp Business) | Sending and receiving the messages | Your number, the messages, voice notes, photos and the location you share | [to be confirmed: USA / EU] |
| Anthropic (Claude) | Understanding the text of messages, writing the answers and checking photos | The text of the messages (without phone number or address), the latest messages and the note on how to talk to you, and the photos to check | [to be confirmed: USA] |
| Deepgram | Turning voice notes into text | The audio of the voice note (not kept by us) | [to be confirmed: USA] |
| Supabase | Database and storage of photos | All the data in section 3 | [region chosen, ideally EU] |
| OpenStreetMap / Nominatim | Finding the village or parish of a written address or of a location | The text of the address or the coordinates, and the IP address of our server (not yours) | [United Kingdom / EU: to be confirmed] |
We do not sell data. We do not use it for third-party advertising.
6. Who sees what, between neighbours
- In the assistant's summaries and lists, others see the title of your listing and your village or parish. Nothing else.
- The public map. Your active listings appear on the Nossa Horta public map (visible to anyone, without registration), at the pickup point you choose, exactly, as "Pickup point: <name>". When you post for the first time the assistant asks where people can pick up and suggests a public place (the parish office, a café, the square, a roundabout) rather than your home; you can share the location of that place or write its name. For the next listings it asks "the same place as last time?". If the point looks like your home (you say "home", or it is within about 150 m of your area) it warns you once per point and lets you "Keep" it or "Choose another". Your area (the village or street you gave at the start) is private: it is only used to search near you and never appears on the map. We show the title, the type, the price, the village or parish, the name of the point, whether it has a photo and the dates of the listing; we never show your number, your name or the text of your address. If you remove a pickup point, the listings that used it leave the map at once. When a listing ends, is removed, or you write STOP or ERASE, it stops appearing on the map. (The "approximate map" option no longer exists: the map shows the pickup point, not your home.) [the lawyer confirms the legal basis and the text of the notice]
- Your phone number is given to the other person in a reservation only after both say yes, and only to that person.
- Your exact address is sent to the buyer only after you, as the seller, answer yes to a specific question about it.
- If you block someone, you stop seeing each other.
- The Nossa Horta team. Two people of the team, the ones who run the project, can read the saved conversations of the last 30 days. They do it to fix problems (reports, disputes, safety) and to improve the service, including Pati's answers. They read them on a protected administration page: only someone with an authorised number and the code sent by WhatsApp can enter. On that page phone numbers are partly hidden (for example
+351 91•••007) and addresses and coordinates never appear. The page is read-only: it does not write in the conversations or change anything. The period is the same (30 days) and ERASE erases everything, also for the team.
7. How long we keep the data
PROVISIONAL periods, set in the code (
backend/concierge/config.ts,retention) until the owner of the project and the lawyer decide. If they change, this table changes. A daily task runs by itself (around 03:00, Lisbon time) and erases what has passed its period.
| Data | Period (provisional) |
|---|---|
| Listings | Active for 2 days. After they end (or after you remove them) they are erased 30 days later, with the photos |
| Photos | Erased when the listing is removed or ends, when you write STOP or ERASE, and in any case 30 days after the listing ends |
| Finished reservations (completed, declined, cancelled, expired, in dispute, missed pickups) | Erased 90 days after the agreed pickup time |
| Account of someone who wrote STOP and did not write again | Erased (like ERASE) after 12 months without any message from you |
| Account of someone who keeps using the service | While you use the service, or until you ask for ERASE |
| Voice notes | Not kept |
| Conversation before the OK (temporary space) | At most 24 hours. Moves into the conversation on OK; deleted if you say no, with ERASE, or after 24 hours |
| Pickup points | Until you remove them, until you ask for ERASE, or as long as the account |
| Conversation with Pati (your messages and the answers) | 30 days after they were written (the team only sees what is still kept). The note on how to talk to you, and your language, stay until you ask for ERASE. Before the OK only the temporary space of 24 hours exists (see below); if you say no, we erase whatever exists |
| Identifiers of messages received | 14 days |
| Messages we could not process at once (retry queue) | Processed in the next run (a few minutes) and erased; if the attempt always fails, erased after 24 hours |
| Cache of searched addresses (not linked to your number) | 180 days |
| Anti-abuse record (see below) | 24 months [to be validated by the lawyer] |
What stays after ERASE or after an account is erased for inactivity. So that a ban is not lost just because someone erases the data and registers again, we only keep, when there is something to keep (missed pickups, an active pause, reports or blocks made by other people against you): (1) an anonymous mark of your number (the result of a cipher with a secret key, which does not allow going back to the number) with the number of missed pickups and the pause in progress; (2) in reports and blocks made by others against you, your number is replaced by that mark. If you write again with the same number, that information is linked to you again. After 24 months this record is erased. The reports you made about other people stay, without your number. If there is nothing against you, we keep nothing. [Legal basis: legitimate interest in protecting the community; the lawyer confirms that this is proportionate.]
8. Your rights
You have the right to: access your data, correct it, erase it, limit the processing, object, receive a copy in a common format (portability) and withdraw your consent at any time, without affecting what was done before. To use any of them, write to startup.nossahorta@gmail.com from any means that lets us confirm that it is you; we answer within one month.
You also have the right to complain to the supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
9. STOP and ERASE
Write STOP (in Portuguese PARAR, PARA or SAIR; UNSUBSCRIBE also works) at any time, also by voice note. The assistant immediately stops sending you messages, removes your open listings, cancels your open reservations (telling the other person that they were cancelled) and erases the photos of your listings. To start again, write ENTER (ENTRAR in Portuguese) and you will give your consent again. STOP does not erase your account.
Write ERASE (APAGAR in Portuguese; also by voice note) to erase all your data. The assistant asks you first, with the buttons "Yes, erase" and "No" (the button is valid for 10 minutes). If you confirm, we erase your number, your address and coordinates, your settings and consent, the messages and the note of the conversation with Pati, your listings and photos (also in storage), your blocks (the ones you made and the ones made against you, see below), your reservations and pending pickup questions. Open reservations are cancelled and the other person is only told that "the other person left". At the end you get a message to confirm. Only the anti-abuse record described in section 7 stays, and only if there is something to keep. This is immediate and you do not need to write us an e-mail.
10. Security
The data is in a database with restricted access (only our service gets in; there is no public access), the photos are in a private space, and the access keys are in secret vaults, never in the code. The requests that Meta sends us are checked by signature. No system is perfect; if there is a data breach that affects you, we will tell you and the CNPD as the law requires.
11. Changes
If we change this policy in a relevant way, we will tell you on WhatsApp before the new version applies. The current version is always at nossahorta.pt/privacy/.
12. Contact
Patrícia Marques, startup.nossahorta@gmail.com