Privacy Policy

1. Who We Are

Pão Vivo is an artisan sourdough bakery located in Laranjeiro, Almada, Portugal. We also make the Pão Vivo bakery management app (see section 9). We are the data controller for any personal information you provide when placing an order or contacting us.

Contact: paovivo.bakery@gmail.com  ·  +351 939 984 082

2. What Data We Collect

When you place an order through our website, we collect:

• Your name
• Phone number
• Delivery address (if applicable)
• Order details (products, quantities, preferred collection time)

We do not collect payment card data. Payments are handled in person at the bakery or via bank transfer.

3. How We Use Your Data

Your information is used exclusively to:

• Process and fulfil your order
• Contact you regarding your order (confirmation, changes, delays)
• Respond to enquiries you send us directly

We do not use your data for marketing without your explicit consent, and we never sell or share your data with third parties for commercial purposes.

4. Legal Basis for Processing

We process your personal data based on contract performance — it is necessary to fulfil the order you placed with us (Article 6(1)(b) GDPR).

5. Data Storage

Your order data is stored securely in Google Firebase Firestore, a cloud database service provided by Google LLC, operating under GDPR-compliant infrastructure within the European Economic Area.

We retain order records for up to 12 months for operational and accounting purposes, after which they are deleted.

6. Your Rights

Under the GDPR, you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Object — object to how we process your data

To exercise any of these rights, contact us at paovivo.bakery@gmail.com. We will respond within 30 days.

7. Cookies

Our website does not use tracking or advertising cookies. Firebase may use essential technical cookies to ensure the order form functions correctly. No personal data is collected through cookies on this site.

8. Third-Party Services

We use the following third-party services on our website and app:

• Google Firebase — order data storage and hosting
• Google Fonts — typography (no personal data transmitted)
• Unsplash — photography (no personal data transmitted)
• Google Play Billing — Pão Vivo Pro subscriptions in the app
• Google ML Kit — on-device receipt reading in the app (images stay on the phone)

9. The Pão Vivo App (for bakers)

If you use the Pão Vivo – Bakery Manager Android app, we process the following data so the app can work for you:

• Account — your name, email address and bakery name. You sign in with email and password or with Google (Firebase Authentication).
• Your business data — recipes, stock, production batches, orders, expenses and sales, including the names, phone numbers and addresses of your own customers. Only your account can see it. Only what you choose to publish (menu, prices, product photos, opening hours, store location) appears on your public online storefront. For your customers' data, you are the data controller and we process it on your behalf.
• Location — only when you tap the button to set your store pin. The app reads your position once and saves it as your shop's location, shown on your storefront map. There is no background location tracking, and you can remove the pin at any time.
• Camera and photos — product photos you choose are uploaded to Firebase Storage and shown on your storefront. Receipt scanning reads the receipt on your phone with Google ML Kit; the receipt image is not uploaded — only the amount, supplier and VAT you save as an expense.
• Pão Vivo Pro purchases — subscriptions are bought and paid through Google Play; we never see your card details. We receive and store your subscription status, plan, purchase token and renewal/expiry dates, so Pro is unlocked on every phone you sign in to. Google notifies us of renewals and cancellations.
• Notifications — each phone you sign in on registers a Firebase Cloud Messaging token, used only to send you new-order, low-stock and reminder notifications. It is removed when you sign out.
• Timers and alarms — production timers and their alarm sound run on your phone. The alarm keeps ringing (as a foreground service) until you stop it. No data leaves your phone for this.

We do not show ads, and we do not sell or share your data with advertisers. Your data is kept while your account exists. You can delete your account and all its data inside the app (Profile → Delete account) or via paovivo.pt/delete-account.html.

10. Changes to This Policy

We may update this policy from time to time. Any significant changes will be reflected with an updated date at the top of this page.