Privacy

Who is responsible

Sofala is run by Megahard, Lisbon, Portugal ("we"). We are the controller of the personal data described here. Contact: [email protected].

What we keep

• Your account: your email address, the name you give (optional), your country and town (optional), your profile photo (optional), when you made the account and accepted the terms, and when you last used it.
• Signing in: the 6-digit codes we email you (stored only as a keyed hash, never the code), and your sessions (a random token, stored as a hash, in one cookie).
• What you sell: your listings (title, description, category, condition, price, place, delivery and payment notes, the private lowest price if you set one) and their photos. We re-encode every photo and remove its metadata, including GPS location and camera details.
• Between buyers and sellers: messages, offers, deals (including the handover code), ratings and comments, and whether each of you chose to share contact details.
• Your assistants: which assistants you connected (their name and the address they identify with), and the access tokens we give them (stored as hashes).
• Saved searches you ask us to watch, and reports you send us.
• Security data: a keyed hash of your IP address (never the address itself) to limit sign-ups, codes, photos and messages per connection, and the result of the human check (below).
• Early-access list (before Sofala opened): email, what you wanted to sell or buy, country, and a first-listing draft with photos. If you make an account with the same email, that draft becomes a private draft listing of yours.
• Visits: the page you open, the page you came from, your screen width and country, and a daily changing visitor hash, counted with our own cookieless script; and the web server log (with IP addresses), which rotates after a few days.

What others see

Your listings with their photos and place, your name (or "Sofala member" and a number), your profile photo, since when you are a member, and your ratings and the comments on them. Your email address is never shown. Phone numbers, emails and links in messages stay hidden until both of you choose to share contact.

Why, and on what basis

• To run the marketplace you signed up for: your account, listings, messages, offers, deals and ratings, and the emails about them (performing our contract with you).
• To keep Sofala safe: the human check, limits for new accounts, checking a new seller's first listing, warning about scam patterns in messages, handling reports, and keeping ratings honest (our legitimate interest, and yours, in a marketplace without scams).
• To understand how Sofala is used, in aggregate (legitimate interest).
• To meet legal duties, such as answering notices about illegal content (legal obligation).

We do not sell your data, we show no ads, and we do not use your data to train AI models.

Who else handles it

• Cloudflare delivers the website and runs the human check (Turnstile); it sees your IP address and the requests you make.
• Resend sends our emails (codes, messages, alerts); it receives your email address and the email's content.
• Your assistant (Claude, ChatGPT or another) receives what Sofala sends it for you, under its provider's own privacy terms. You choose which assistants to connect and can disconnect them on your account page.

Cloudflare and Resend may process data in the United States; they do so under the EU's standard contractual clauses or the EU-US Data Privacy Framework. Our own server and database are operated by us.

How long

• Your account and listings: while you have the account. Sold and removed listings stay in your account until you close it.
• Messages, deals and ratings: while either of you has the account, because both of you rely on them; ratings stay on the other person's profile in your name until you close your account, then without your name.
• Sessions: until you sign out, 30 days without a visit, or 180 days. Assistant access: an hour per token, renewable for 60 days, or until you disconnect.
• Reports and moderation decisions: up to two years, to handle repeat abuse and complaints.
• When you close your account (email [email protected] from your account's address), we delete your profile, listings, photos and saved searches within 30 days.

Cookies

One cookie, __Host-sofala_session, keeps you signed in; it is necessary for the service and is not used for anything else. No advertising or tracking cookies. The human check loads a script from Cloudflare when you sign in.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form: email [email protected]. We answer within a month. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority where you live.

Age

Sofala is for people aged 18 and over.

Changes

When this notice changes in a way that matters, we tell members by email before it applies.