Privacy policy
Last updated: 16 October 2026 · Version: 2026-10-15
At Profitand we take your privacy seriously: we only collect the data we need, we protect it with advanced safeguards and we never sell it. This policy explains what data we process, why, for how long and what your rights are, under Andorra's Qualified Law 29/2021 of 28 October on personal data protection (LQPD) and, where applicable, Regulation (EU) 2016/679 (GDPR).
1. Who is the controller
- Controller: CLOUDIFY CONSULTING S.L.U. ("Profitand", "we")
- Tax number (NRT): L-716939-P
- Address: Carretera de la Peguera, 30, AD600 Sant Julià de Lòria, Andorra
- Privacy contact: privacitat@profitand.ad
2. What data we process
| Category | Data | Source |
|---|---|---|
| Account | Email, the name you give us, language, parish (optional), sign-in provider identifier if you use Apple or Google | You |
| Orders | Bags reserved, shop, amount, date and time, pickup status, reviews | Use of the service |
| Payment | Transaction ID, last 4 digits and card brand if you save your card. We never store the full card number or CVV: these are handled by the certified payment gateway | Gateway |
| Credit & referrals | Referral code, friends invited, credit earned and used | Use of the service |
| Approximate location | Position rounded to ~1 km, only if you turn on nearby alerts | Your device, with your consent |
| Notifications | Device identifier for push notifications | Your device, with your permission |
| Consents | Which consents you've given or withdrawn, and when | You |
| Security | IP address (stored encrypted and irreversibly to limit abuse), technical and access logs | Automatic |
| Analytics | Anonymous or pseudonymised usage events, only if you accept usage stats | Automatic, with your consent |
| Businesses | Company name, NRT, contact person, phone, email, IBAN and payout data | The business |
We do not process special categories of data. The allergens shown on bags are product information, not health data about you.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, reserving and paying for bags, generating your pickup QR code, handling cancellations and refunds, customer support | Performance of a contract |
| Issuing receipts and invoices, keeping accounting and tax records | Legal obligation |
| Preventing fraud and abuse (mass reservations, referral abuse), protecting the security of the service | Legitimate interest |
| Notifying you about your orders and favourite shops | Performance of a contract and your preferences |
| Sending you news and offers by email or notification | Consent |
| Nearby alerts based on your approximate location | Consent |
| Measuring anonymously how the app is used to improve it | Consent |
| Parish leaderboard and public impact counter (aggregated data only, never individual) | Legitimate interest |
You can withdraw your consent at any time under Profile › Settings, without affecting the lawfulness of prior processing.
4. Who we share it with
We never sell or rent your data. We only share it with:
- The shop you reserve from: they see your name (as you entered it) and the order number so they can hand over your bag. They don't see your email or payment details.
- Processors that provide services to us and are contractually bound to protect it:
| Provider | Service | Where it's processed |
|---|---|---|
| Amazon Web Services EMEA SARL | App hosting, email, backups | European Union (Ireland) |
| Supabase, Inc. | Database and authentication | European Union (Ireland) |
| Cloudflare, Inc. | Content delivery, attack protection, bot verification | Global network; mainly EU |
| Payment gateway (Paytef or PayPal, depending on method) | Payments and refunds | EU |
| Apple, Inc. and Google LLC | Push notifications and sign-in, if you use them | USA and EU |
- Authorities, when required by law.
5. International transfers
Our databases and servers are located in the European Union, which has a recognised equivalent level of protection. Some providers (Cloudflare, Apple, Google, Supabase) are US companies or may access data from outside the EU in certain circumstances; in those cases the transfer relies on the safeguards set out in the LQPD, such as standard contractual clauses or the provider's certification under the EU-US Data Privacy Framework.
6. How long we keep it
| Data | Period |
|---|---|
| Account and preferences | While your account is active. If you delete it, it's erased immediately |
| Orders and payments | The period required by accounting and tax law (generally 6 years). If you delete your account, they're kept pseudonymised, with no link to you |
| Consent records | While your account is active and afterwards for as long as needed to prove them |
| Usage analytics | 13 months |
| Notifications | 6 months |
| Device identifiers | 9 months without use |
| Unconfirmed waiting list | 90 days |
| Security and audit logs | 3 years (then minimised) |
| Backups | 35 days |
7. How we protect it
We apply advanced technical and organisational measures: encryption in transit (TLS) and at rest, row-level access control in the database, a database that isn't directly reachable from the internet, mandatory two-step verification for admin staff, an audit log of every access to personal data, encrypted and immutable backups, perimeter attack protection and regular security reviews.
8. Your rights
You have the right to access, rectify and erase your data, to object to and restrict processing, and to data portability. You also have the right not to be subject to decisions based solely on automated processing with legal effects.
- In the app: under Profile › Settings you can download all your data (JSON) and delete your account in one click.
- By email: write to privacitat@profitand.ad. We'll reply within one month.
If you believe we haven't handled your rights properly, you can complain to the Andorran Data Protection Agency (APDA): www.apda.ad.
9. Minors
Profitand is intended for people aged 16 and over. Minors need their parents' or guardians' permission to make purchases.
10. Changes
If we make significant changes, we'll let you know in the app and, where necessary, ask for your consent again.