Privacy Policy

1. Controller

The data controller is:

2. Personal data we collect

Depending on how you use the Service, we may process:

• Account data — name, email address, password (hashed), profile photo, organisation/workspace details, and preferences.
• Customer content — data you enter about your clients and work (for example client names, emails, companies, proposals, invoices, time entries, notes, and files).
• Billing and payment data — subscription status, invoices for Rebban fees, and limited payment metadata processed by Stripe (we do not store full card numbers).
• Integration data — OAuth tokens and related metadata when you connect Gmail, Outlook, Stripe Connect, or similar services.
• Usage and device data — IP address, browser type, device information, pages viewed, approximate location derived from IP, referring URLs, and timestamps.
• Marketing preferences — whether you opted in to product updates.
• Support communications — messages you send us and related correspondence.

3. How we collect data

• Directly from you when you sign up, use the Service, or contact us.
• Automatically through cookies, pixels, and similar technologies (see Tracking and analytics below).
• From third-party services you connect (for example Google or Microsoft for email, Stripe for payments).

4. Purposes and legal bases

We process personal data for the following purposes:

• Providing the Service — account management, proposals, invoices, time tracking, client pages, email sending, and related features (performance of a contract, Art. 6(1)(b) GDPR).
• Billing — subscriptions, trials, invoicing, and payment collection (contract and legal obligation where tax records are required).
• Security and abuse prevention (legitimate interests, Art. 6(1)(f) GDPR).
• Product analytics and improvement — understanding how the Service is used (legitimate interests and/or consent where required for non-essential cookies/tracking).
• Marketing and advertising measurement — product updates you opt into, and advertising/analytics tools such as Google Analytics and Meta Pixel (consent where required).
• Legal compliance — responding to lawful requests and enforcing our Terms (legal obligation and/or legitimate interests).

5. Tracking and analytics

We use third-party tracking and analytics tools to measure traffic, understand product usage, improve the Service, and measure the effectiveness of our marketing. These tools may set cookies or similar identifiers on your device, collect usage data, and receive information about your interactions with our sites and ads.

Tools we use or may use include:

• Google Analytics (Google Ireland Limited / Google LLC) — website and product analytics, including pages viewed, events, device/browser information, and approximate location. Google may process data in accordance with its own privacy policy and terms. See Google’s Privacy Policy.
• Meta Pixel (Meta Platforms Ireland Limited / Meta Platforms, Inc.) — advertising measurement, conversion tracking, and audience insights related to our marketing on Meta products (for example Facebook and Instagram). Meta may process data under its own policies. See Meta’s Privacy Policy.

Where EU/EEA or Portuguese law requires consent for non-essential cookies or similar tracking (including many analytics and advertising pixels), we will request your consent before enabling those technologies, and you can withdraw consent at any time via cookie settings we provide or by adjusting your browser. Blocking or rejecting cookies may limit some features or our ability to measure marketing performance.

These providers may process personal data in countries outside the EEA (including the United States). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s approved transfer mechanism.

6. Cookies and similar technologies

We use strictly necessary cookies to operate the Service (for example authentication and security). We may also use analytics, functional, and marketing cookies or pixels as described above. On first visit we show a cookie banner where you can accept all, allow essential cookies only, or customize analytics and marketing preferences. You can change this later in Settings → Legal → Cookie preferences, or through your browser settings.

7. Your role when you store client data

When you upload or manage information about your own clients or contacts in Rebban, you typically act as an independent controller of that data. You are responsible for having a lawful basis and providing any required notices to those individuals. We process that Customer Content on your instructions as a processor to provide the Service, except where we process it for our own purposes described in this Policy (for example security, billing of your account, or aggregated analytics that do not identify your clients).

8. Who we share data with

We share personal data with:

• Infrastructure and product providers — for example hosting, database, authentication, and email delivery vendors needed to run the Service.
• Stripe — for subscription billing and, where you enable it, client payment processing and payouts.
• Google and Microsoft — when you connect Gmail or Outlook so we can send email on your behalf.
• Analytics and advertising partners — including Google Analytics and Meta Pixel as described in Tracking and analytics.
• Professional advisers and authorities — where required by law or to protect our rights.

We do not sell your personal data. We may share aggregated or anonymised statistics that do not identify you.

9. International transfers

Some processors and partners are located outside the European Economic Area. When we transfer personal data internationally, we use safeguards required by GDPR, such as Standard Contractual Clauses or an adequacy decision, where applicable.

10. Retention

We retain personal data only as long as needed for the purposes described in this Policy, including to provide the Service, comply with legal, accounting, or tax obligations, resolve disputes, and enforce our agreements. If you delete your account, we will delete or anonymise associated personal data within a reasonable period, except where retention is required by law or for legitimate security/audit needs.

11. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, or alteration. No method of transmission or storage is completely secure; you use the Service at your own risk regarding residual security risks.

12. Your rights

Under GDPR (subject to conditions and exceptions), you may have the right to:

• access your personal data;
• rectify inaccurate data;
• erase data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with a supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD).

To exercise these rights, email hello@rebban.com. You may also delete your account in the Service where self-service deletion is available.

13. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. For material changes, we may also notify you by email or in-app notice.

15. Contact

Privacy questions or requests: hello@rebban.com.