Privacy policy

Solvo is a Portuguese service, run from Lisboa since 2026. Contact: geral@solvo.pt.

Without an account, what you type into the calculators and the book is calculated and stored in your browser, and does not stay with us. Only three things leave your device: the requests for any page, which the host logs (IP address, time and page); an anonymous count of calculations made, without the values; and, if you use the extension, the facts of the listing you asked it to analyse, which are calculated on our server.

Only when you create an account and sync is enabled is your book also stored in our database, so you can open it on another device.

Account: your email address and, if you give it, your name. That is what a passwordless sign-in link and talking to you require.

Book (only with sync enabled): the properties, tenancies, transactions, mortgages, documents and receipts you enter, plus the tax profile you set at the start.

Saved calculations: when you ask us to email a calculation, we store the inputs, the result and the address you gave.

Subscription: your Stripe customer and subscription identifiers, plan, status and renewal date. Card details are handled by Stripe and never pass through us.

Bank connection (optional): the consent identifier at the provider, the bank's name, the list of accounts with the last four digits of the IBAN, and the transactions the bank reports. We do not store full IBANs or your banking credentials, which are entered only at the licensed provider.

Photographs of invoices: both the QR reading and the optical reading happen entirely in your browser. The image is not sent to us or to anyone else. What is downloaded is the text-recognition model, not your invoice.

Browser extension: when you open the panel on a listing, that listing's facts (price, area, typology, location and page address) are sent to us to compute the taxes and the yield. We do not receive the rest of the page and we do not follow your browsing. Without an account the calculation is tied to nobody; with one, and only if you ask to save, the listing joins your pipeline.

Technical logs: the host records requests (IP address, time, route) for security and diagnostics.

Tenants (landlord area, with an account): when a landlord adds a tenant, we store the tenant's name and email and, if the landlord gives them, their mobile number and tax number; the rent and the day it is due; and the payments the landlord records or the tenant declares. For this data the landlord is the controller and Solvo processes it on their behalf. We email the tenant the invitation, the landlord's answer to each payment and a reminder before each rent, which the tenant can turn off on their page. The tenant's page opens with a personal link, of which we keep a fingerprint (SHA-256) and an encrypted copy (AES-256-GCM), never the link in the clear.

Performance of the contract: account, sync, subscription, bank connection, and the receipts and service alerts tied to them.

Legitimate interests: security, abuse prevention and technical maintenance, including host logs.

Consent: connecting your bank account, which you authorise at the provider and can revoke at any time, and deadline emails, which you can switch off in your account.

Legal obligation: retention of billing records.

Hosting and application runtime: Vercel.

Database: Neon (Neon Inc.), managed PostgreSQL, with the data hosted in Frankfurt, Germany (AWS eu-central-1).

Transactional email (sign-in links, deadline alerts, renewal notices): Resend.

Payments and invoicing: Stripe, which acts as its own controller for payment data.

Bank data (if you connect a bank): Tink, licensed for account information services under PSD2.

We use Vercel's traffic analytics, which tells us how many visits each page had. It sets no cookies, does not follow you off this site, and builds no profile: the identifier that separates one visit from another is derived from the request and changes every day.

We use no advertising and no third-party tracking tools.

We set one session cookie, strictly necessary to keep you signed in. The traffic analytics set no cookies and store nothing on your device, which is why you are not shown a consent banner.

Stripe's checkout, when you open it, sets Stripe's own cookies on Stripe's domain.

Account and book: while the account exists. If you close it, we delete or anonymise within 30 days, except what we must retain by law.

Bank transactions in the review queue: we keep the transaction identifier even after it is dealt with, so the same payment is never offered to you twice.

Billing: for the statutory retention period.

Technical logs: a short period set by the host.

Tenants: for as long as the landlord keeps them in their account. An archived tenant loses access to their page and stops getting emails; the payments stay in the landlord's book, as part of their tax year, and are deleted with the account.

You may request access, rectification, erasure, restriction, objection and portability, and withdraw consent where consent is the basis. Write to the address in section 1.

If you are a tenant recorded by a landlord, address these requests to the landlord, who is responsible for your data; if you write to us, we pass the request on and help the landlord meet it.

You can export your book at any time, without asking us, from settings.

If you believe we process your data improperly, you may complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

Credentials for bank data access are stored encrypted (AES-256-GCM) and session identifiers are signed. Database access is restricted to the application.

Some processors may handle data outside the European Economic Area; where they do, GDPR safeguards apply, in particular standard contractual clauses.

If this policy changes materially we will say so in the service or by email. The date of the last revision is at the top of this page.