About the platform

Privacy notice

RRL (rrl.syfers.eu) helps a project team prepare a proposal for their land and hand it to a câmara. It is run by Cooperativa Integral Sulitânia, CRL, the controller of the personal data described here.

At a glance

Summary · not legal textThe full text below takes precedence. Each item links to where it stands.

Who: Cooperativa Integral Sulitânia, CRL runs RRL and is responsible for your data. People (the federation’s shared sign-in) and a few service providers process it to make the platform work.§4 Who else handles the data
What: Your email address and your account. What you and your team put into a project. Names are kept apart, in each project’s person register.§3 What we keep, where, and for how long
Why: So you can sign in and your project works, and a câmara can later check how a project’s records came about. No advertising, no selling.§3 What we keep, where, and for how long
How long: Mostly as long as your account or the project exists. The audit log and the daily anchors stay for good, without email addresses. A deleted project stays 7 more days.§3 What we keep, where, and for how long
Your rights: See, correct, erase, restrict, take with you, and complain to the CNPD. You ask for erasure on Your account, under Sign-in and your data.§5 Your rights §6

3What we keep, where, and for how long

36 places · open › for the full text of a long cell

Where	What personal data	Why	How long
You and your account7signing in, your browser, email from RRL
Your account	Your email address, a random account number, your projects and roles, open invitations. If you give them: a name and short bio, your display choices and your time zone. If you choose to see requests from other residents: which kinds, which kinds of person you are, and in which districts; an organisation administrator may set this for a member. For an observer (such as a câmara): the kind of observer and whether they may see the exact location. When you register: which version of the terms you accepted, which version of the privacy notice you were shown, when, and that you confirmed being 16 or older.	To send sign-in links and decide what you may see and change. The acceptance record shows which terms applied when you started.	Until you or the project remove it, or it is erased on request.
Sign-in	Supabase sign-in and session tokens, with your email address and account number, in an HttpOnly cookie. For rate limiting: a shortened IP address and a fingerprint of the email address a link was asked for.	To keep you signed in and to slow down abuse.	The sign-in cookie is set for up to 400 days each time it is renewed; this does not guarantee that the session stays valid that long. Signing out clears it on that browser. Rate-limit data: 15 minutes.

Your browser	Cookies, and what your browser keeps on this device: your session, the project you work in, your language and display choices, and work you have not saved yet. Cookies: your session, the project you work in, your language, palette and reading level, and a preview you started. Only on this device, your browser also keeps: the demo house you design, the map view you chose, your task filter and workspace, whether the menu is folded, which sections you opened, and zone changes you have not saved yet. Where you installed the platform on a phone, a round you prepared for the field: what to measure at one place and the last values, without names, kept for the account that prepared it.	So the platform remembers how you work, on this device.	The sign-in cookie: up to 400 days from renewal, or until you sign out or clear it. Preference cookies have their own expiry. Other browser data stays until you save or clear it. A round prepared for the field stays until you prepare it again or sign out; on a lost phone it remains outside the platform’s reach.

What you have seen	Which notifications you have read, and for each page of a project when you last opened it. Never what you did there.	To show what is new since your last visit.	Until you leave the project (its pages), or your account is erased.

The daily email	Whether you get one email a day of what waits for you (on until you switch it off under Notifications), which of your notifications an email named, and the day one went, so nothing is named twice. It also names a change of RRL’s planned prices once, and its withdrawal; a notice before anything costs money would come even with the email off. The email names the project and what waits, never a value or a reason, and goes out through Resend.	So you do not miss a task in your name or a question for you, and no price change surprises you.	The choice: as long as your account. Which lines an email named: for a task 30 days, until it leaves the notifications; for a question or a price change until your account is erased. The day: until the next day.

First sign-in welcome email	Your email address is used to send one welcome message after your first sign-in. The platform keeps your account number and when it claimed or sent that message, so it does not send it again.	To explain where to start and how to find help.	The marker stays until your account is erased.

Account suspension	If a platform administrator suspends an account or hides its bio: when that happened. The audit log keeps who did it, as an account number.	To stop misuse without deleting what a person contributed.	Until a platform administrator lifts it, or the account is erased.

In a project14the records, the names and the files
Person register (per project)	Names and contact details that stewards or architects enter: who holds a stewardship role, households, who holds or granted a right to the land, who is responsible for or did work on the land, outside authors of evidence, and who a proposal was handed to.	So the project can say who does what without writing names into its records.	Until the project deletes the entry, the project is deleted for good, or it is erased on request.
Project records (revisions)	No names or email addresses: references to the person register and the account number of whoever saved each revision. The land, its location (exact or approximate), plans, measurements and results.	The project’s own record, and the trail that lets others check it.	As long as the project exists. The platform can be set to delete old revisions after a set period (off by default, and never while the project has an observer); a deleted revision leaves only its fingerprint.
Evidence files	Whatever the file holds. A photo may show where it was taken; that location is kept and access to it is limited.	Evidence for what the project states.	As long as a revision refers to the file. Deleted on erasure, when the project is deleted for good, or when deleting old revisions leaves nothing that refers to it.
Plans on tasks	Beside a task: who will do it (a member’s account number, or a kind of person such as a surveyor), how and when, and a note, which may name someone. The account numbers of who wrote and changed it.	So the people in a project can say who takes a task on.	Until the plan is removed, 30 days after the task is done, or when the project is deleted for good. On erasure a note that names you reads “[erased]”.
Dates on the path	The day or month a member hopes to finish a step of the path, with their account number and when they set it. Members of the project read it; an observer never does.	So the people in a project can plan the steps together.	Until it is changed or removed, or the project is deleted for good. Erasing your account unlinks your account number from your email address; what the record holds may still point to you (see What stays after erasure).
Plots you are comparing	Before the land is chosen: a name you give each plot, which may name someone, the prédios as the cadastre gives them (parcel number, outline, stated area), whether a building stands, and the last reading of the national maps on the outlines. The account numbers of who added and changed it.	So a household can check plots against the national maps before buying, and set them side by side.	Until a member removes the plot, or when the project is deleted for good. Once the land is chosen the others stay as a closed list. On erasure a name that names you reads “[erased]”.
Authority decisions	A decision an authority sent about a check, recorded by a steward or architect: the letter, its date, the authority by its public code or a reference to the person register, and the account number of whoever recorded it.	So the record shows what the authority decided, and who typed it in.	Until the project is deleted for good. Erasure does not change the letter (see the limits below).
Downloaded house models	A house model (IFC) placed on the land carries the dwelling’s exact place, and is offered only to readers who may see it. The audit log keeps that it was downloaded, its fingerprint and how it was placed.	So an architect can start from the design, on the right spot.	The download is yours to keep; the audit row stays for good.
Photos and videos of the place	Photos and short videos of the land that a member adds, with a caption. Where a photo was taken is shown only to those who may see the exact location. The photos a member adds of the land: the picture without the camera’s metadata, and beside it what the camera recorded: where and when it was taken and in which direction, a caption, the account number of who added it and when. A short video is kept as recorded, with the data that said where the phone stood and which phone it was overwritten; its length is kept. The position is shown only to those who may see the exact location. Before an upload, whoever adds it confirms that the people shown agreed and takes responsibility for it; that confirmation is kept with who gave it and when. A photo is removed on request. A steward or architect may choose up to five, each with its caption, to open a proposal with: those go with the proposal to whoever receives it.	So a reader who has never been there sees what the place is like.	Until a steward or architect removes it, the project is deleted for good, or we erase it on request. Removing one changes no saved revision of the record; the audit log keeps the file’s fingerprint. A photo included in a handed-over proposal stays while that proposal is kept, until we erase it on request or the project is deleted for good; the proposal then says it was removed.
Building guides	Each building guide you make: the guide as it was made, the house design it came from, your account number and when. Whoever reads the project’s documents sees when it was made.	So the guide you hand to a builder is kept as it was, and you can see when it is out of date.	As long as the project; the guide stays with it. Erasing your account unlinks your account number from your email address; what the record holds may still point to you (see What stays after erasure).
Guide presentation links	Each link to a building guide as a presentation: the guide it shows, until when it is valid, whether and when it was ended, and the account numbers of who made and who ended it. The link itself is not stored. Whoever opens a valid link sees that guide, without an account.	So a builder without an account can follow the guide, for as long as you chose.	As long as the project. Erasing your account unlinks your account number from your email address; what the record holds may still point to you (see What stays after erasure).
Handed-over proposals and answers	The text of a proposal as handed over, which can include names of people in the project. A câmara’s answer letter.	The record of what was handed to whom, and what came back.	Until the project is deleted for good. Erasure does not change them.
Money (per project)	What is recorded under Money: budget items with their amounts, source and date; expenses with invoices and receipts; payments; accounts and cash with their balances; funding sources such as own money, loans, grants and gifts, with their terms and grant agreements; planning and estimates; an accountant profile, retention proposals and the packages for an accountant or a fund. The names and details of funders, suppliers and whoever keeps the books, as the steward enters them, and a reason someone gives for a change. The account number of whoever recorded something and of whoever was given financial access. Only the steward and the people the steward gives financial access see it.	So the household can see what the project costs and whether it can be done, and prepare the books and the reporting for an accountant or a fund.	As long as the project exists. Switching Money off deletes nothing, and a retention proposal gives no permission to delete anything. If you delete the project for good, these records are kept until a retention period has been set; that period will then be stated here. If you ask for erasure, the same applies until then, and we tell you which records are kept and why.
Deleted projects	Everything above for that project.	So a deletion by mistake can be undone.	7 days, then deleted for good. The audit log and anchors stay.

In a project14the records, the names and the files

Person register (per project)

Names and contact details that stewards or architects enter: who holds a stewardship role, households, who holds or granted a right to the land, who is responsible for or did work on the land, outside authors of evidence, and who a proposal was handed to.

So the project can say who does what without writing names into its records.

Until the project deletes the entry, the project is deleted for good, or it is erased on request.

Project records (revisions)

No names or email addresses: references to the person register and the account number of whoever saved each revision. The land, its location (exact or approximate), plans, measurements and results.

The project’s own record, and the trail that lets others check it.

As long as the project exists. The platform can be set to delete old revisions after a set period (off by default, and never while the project has an observer); a deleted revision leaves only its fingerprint.

Evidence files

Whatever the file holds. A photo may show where it was taken; that location is kept and access to it is limited.

Evidence for what the project states.

As long as a revision refers to the file. Deleted on erasure, when the project is deleted for good, or when deleting old revisions leaves nothing that refers to it.

Plans on tasks

Beside a task: who will do it (a member’s account number, or a kind of person such as a surveyor), how and when, and a note, which may name someone. The account numbers of who wrote and changed it.

So the people in a project can say who takes a task on.

Until the plan is removed, 30 days after the task is done, or when the project is deleted for good. On erasure a note that names you reads “[erased]”.

Dates on the path

The day or month a member hopes to finish a step of the path, with their account number and when they set it. Members of the project read it; an observer never does.

So the people in a project can plan the steps together.

Until it is changed or removed, or the project is deleted for good. Erasing your account unlinks your account number from your email address; what the record holds may still point to you (see What stays after erasure).

Plots you are comparing

Before the land is chosen: a name you give each plot, which may name someone, the prédios as the cadastre gives them (parcel number, outline, stated area), whether a building stands, and the last reading of the national maps on the outlines. The account numbers of who added and changed it.

So a household can check plots against the national maps before buying, and set them side by side.

Until a member removes the plot, or when the project is deleted for good. Once the land is chosen the others stay as a closed list. On erasure a name that names you reads “[erased]”.

Authority decisions

A decision an authority sent about a check, recorded by a steward or architect: the letter, its date, the authority by its public code or a reference to the person register, and the account number of whoever recorded it.

So the record shows what the authority decided, and who typed it in.

Until the project is deleted for good. Erasure does not change the letter (see the limits below).

Downloaded house models

A house model (IFC) placed on the land carries the dwelling’s exact place, and is offered only to readers who may see it. The audit log keeps that it was downloaded, its fingerprint and how it was placed.

So an architect can start from the design, on the right spot.

The download is yours to keep; the audit row stays for good.

Photos and videos of the place

Photos and short videos of the land that a member adds, with a caption. Where a photo was taken is shown only to those who may see the exact location.

The photos a member adds of the land: the picture without the camera’s metadata, and beside it what the camera recorded: where and when it was taken and in which direction, a caption, the account number of who added it and when. A short video is kept as recorded, with the data that said where the phone stood and which phone it was overwritten; its length is kept. The position is shown only to those who may see the exact location. Before an upload, whoever adds it confirms that the people shown agreed and takes responsibility for it; that confirmation is kept with who gave it and when. A photo is removed on request. A steward or architect may choose up to five, each with its caption, to open a proposal with: those go with the proposal to whoever receives it.

So a reader who has never been there sees what the place is like.

Until a steward or architect removes it, the project is deleted for good, or we erase it on request. Removing one changes no saved revision of the record; the audit log keeps the file’s fingerprint. A photo included in a handed-over proposal stays while that proposal is kept, until we erase it on request or the project is deleted for good; the proposal then says it was removed.

Building guides

Each building guide you make: the guide as it was made, the house design it came from, your account number and when. Whoever reads the project’s documents sees when it was made.

So the guide you hand to a builder is kept as it was, and you can see when it is out of date.

As long as the project; the guide stays with it. Erasing your account unlinks your account number from your email address; what the record holds may still point to you (see What stays after erasure).

Guide presentation links

Each link to a building guide as a presentation: the guide it shows, until when it is valid, whether and when it was ended, and the account numbers of who made and who ended it. The link itself is not stored. Whoever opens a valid link sees that guide, without an account.

So a builder without an account can follow the guide, for as long as you chose.

As long as the project. Erasing your account unlinks your account number from your email address; what the record holds may still point to you (see What stays after erasure).

Handed-over proposals and answers

The text of a proposal as handed over, which can include names of people in the project. A câmara’s answer letter.

The record of what was handed to whom, and what came back.

Until the project is deleted for good. Erasure does not change them.

Money (per project)

What is recorded under Money: budget items with their amounts, source and date; expenses with invoices and receipts; payments; accounts and cash with their balances; funding sources such as own money, loans, grants and gifts, with their terms and grant agreements; planning and estimates; an accountant profile, retention proposals and the packages for an accountant or a fund. The names and details of funders, suppliers and whoever keeps the books, as the steward enters them, and a reason someone gives for a change. The account number of whoever recorded something and of whoever was given financial access. Only the steward and the people the steward gives financial access see it.

So the household can see what the project costs and whether it can be done, and prepare the books and the reporting for an accountant or a fund.

As long as the project exists. Switching Money off deletes nothing, and a retention proposal gives no permission to delete anything. If you delete the project for good, these records are kept until a retention period has been set; that period will then be stated here. If you ask for erasure, the same applies until then, and we tell you which records are kept and why.

Deleted projects

Everything above for that project.

So a deletion by mistake can be undone.

7 days, then deleted for good. The audit log and anchors stay.

Working together7with contractors, other residents and a Lab
Executors	Someone invited from outside a project to carry out named commitments: the invited email address while the invitation is open, then their account number; who invited them; which commitments; their display name, seen by stewards and architects; the work they report with its date, a note in their own words, and the files they attach. A photo can show people and holds where and when it was taken.	So outside providers can carry out stewardship work and report it, and someone else can check it.	The invitation and the assignment until the work ends or the project is deleted for good. What they reported, and its files, as long as a revision refers to it, like other evidence. Removed on erasure; their files are erased as other evidence is.
Requests from a task	Requests for help that a member opens from a task, and the answers. Readers see the step, what is asked, the district and the note, never the project or where the land is. A request a member opens from a task: what is asked for, the step, the kind of person, the district, a note in their own words, which may name someone, and the account number of who opened it. Each answer: one message and the account number of who wrote it. The account numbers a platform administrator switched off from answering. Accounts that chose to see such requests read the step, what is asked, the district and the note, never the project, a name or where the land is. Only an answer shows the resident the answerer’s display name and bio, and the answerer the project’s name.	So a resident stuck at a step can find someone who did it before, without anyone being listed.	Open until the resident closes it, and at most 90 days; 90 days after it is closed it is removed with its answers. Also when the project is deleted for good. On erasure your requests and your answers are removed, and a note that names you reads “[erased]”.
Learnings at a step	What a member writes at a finished step of the path. A shared learning is copied without its author to the same step in other projects. What a member leaves at a step of the path once it is done: one text in their own words, which may name someone, whether they shared it, when, and their account number; kept for them. A shared learning is copied, without the author, the project, the district or a date, beside the same step in every other project, where members read it; nothing links the copy back to the author. RRL refuses a shared text that holds a name, the project’s name, its district or a register reference it knows, but free text can still hold one.	So the next resident at the same step reads what others ran into.	The learning: until the project is deleted for good, or your account is erased. A shared copy: until erasure finds it by its words, or a platform administrator hides it (it is then no longer shown); since it has no author, it cannot be found by your account. On erasure a learning of someone else that names you reads “[erased]”.
Questions and answers	Your questions and answers: the text, the project and page you asked from, your account number and when. Whoever answers reads them: the project’s steward for a question about the land or the rules, the platform administrators for a question about the platform.	So someone who knows can answer where the question arises.	A question about the platform: 12 months after it is resolved. A question about the land or the rules: as long as the project. On erasure your messages read “[erased]”; the other side keeps the conversation.
Photos with questions	A photo or screenshot you add to a message in a conversation. A JPEG or HEIC is redrawn in your browser before it is sent, so where it was taken stays on your device. Only those who may read the conversation see it (see above); it is never part of the project’s evidence.	So whoever answers sees what you see.	As long as its conversation. Erasure deletes your photos; the other side keeps the conversation.
Organisations and their members	An organisation’s name, kind and description; for each member, their email address and role; who is assigned to which project; and who invited the organisation to a project (an account number).	So a câmara, an office or a university can take part as a whole.	Until the organisation is dissolved or the membership removed, or it is erased on request.
A Lab of the federation	If a steward links the project to a Lab of the federation: what the Lab’s apps (lens, compass and chart) receive, and what RRL keeps about it. None of them receives the exact location or names from the person register. If a steward links the project to a Lab of the Syntrociety federation: the Lab, a label the steward chose, which may name someone, what each of the Lab’s apps may do, and the account number of who set it. When a steward, architect or platform administrator sends a handed-over proposal to the Lab’s document store (lens), lens receives the edition without the exact location and without names from the person register; the project’s name and free text go as written. The audit log keeps who sent it and the document number lens returned. Each quarter the Lab’s compass may read a summary of counts, states and dates, without a name, a place or a value. When a steward turns on tasks for the Lab’s chart, a steward, architect or platform administrator can send open tasks there. For each task chart receives only what kind it is (which measurements, or which kind of work), the Lab and the chart zone it is for, the number and fingerprint of the project’s latest revision, and random numbers for the project and the task: never a name, a place, free text or RRL’s own project number. Chart answers whether the task is open, done or recalled, with the measurements and dates; RRL keeps that beside what it sent, and the audit log keeps who sent or recalled a task. Figures RRL reads from the Lab’s chart are kept like open data.	So a Lab can keep its projects’ proposals, read its land beside its own self-assessment, and carry out a project’s tasks in its chart.	The link: until a steward removes it, the project is deleted for good, or we erase it on request. A copy sent to lens is kept by lens; RRL keeps the audit row for good. A task sent to chart: RRL keeps what it sent and what chart answered until the project is deleted for good; chart keeps what it received.

Working together7with contractors, other residents and a Lab

Executors

Someone invited from outside a project to carry out named commitments: the invited email address while the invitation is open, then their account number; who invited them; which commitments; their display name, seen by stewards and architects; the work they report with its date, a note in their own words, and the files they attach. A photo can show people and holds where and when it was taken.

So outside providers can carry out stewardship work and report it, and someone else can check it.

The invitation and the assignment until the work ends or the project is deleted for good. What they reported, and its files, as long as a revision refers to it, like other evidence. Removed on erasure; their files are erased as other evidence is.

Requests from a task

Requests for help that a member opens from a task, and the answers. Readers see the step, what is asked, the district and the note, never the project or where the land is.

A request a member opens from a task: what is asked for, the step, the kind of person, the district, a note in their own words, which may name someone, and the account number of who opened it. Each answer: one message and the account number of who wrote it. The account numbers a platform administrator switched off from answering. Accounts that chose to see such requests read the step, what is asked, the district and the note, never the project, a name or where the land is. Only an answer shows the resident the answerer’s display name and bio, and the answerer the project’s name.

So a resident stuck at a step can find someone who did it before, without anyone being listed.

Open until the resident closes it, and at most 90 days; 90 days after it is closed it is removed with its answers. Also when the project is deleted for good. On erasure your requests and your answers are removed, and a note that names you reads “[erased]”.

Learnings at a step

What a member writes at a finished step of the path. A shared learning is copied without its author to the same step in other projects.

What a member leaves at a step of the path once it is done: one text in their own words, which may name someone, whether they shared it, when, and their account number; kept for them. A shared learning is copied, without the author, the project, the district or a date, beside the same step in every other project, where members read it; nothing links the copy back to the author. RRL refuses a shared text that holds a name, the project’s name, its district or a register reference it knows, but free text can still hold one.

So the next resident at the same step reads what others ran into.

The learning: until the project is deleted for good, or your account is erased. A shared copy: until erasure finds it by its words, or a platform administrator hides it (it is then no longer shown); since it has no author, it cannot be found by your account. On erasure a learning of someone else that names you reads “[erased]”.

Questions and answers

Your questions and answers: the text, the project and page you asked from, your account number and when. Whoever answers reads them: the project’s steward for a question about the land or the rules, the platform administrators for a question about the platform.

So someone who knows can answer where the question arises.

A question about the platform: 12 months after it is resolved. A question about the land or the rules: as long as the project. On erasure your messages read “[erased]”; the other side keeps the conversation.

Photos with questions

A photo or screenshot you add to a message in a conversation. A JPEG or HEIC is redrawn in your browser before it is sent, so where it was taken stays on your device. Only those who may read the conversation see it (see above); it is never part of the project’s evidence.

So whoever answers sees what you see.

As long as its conversation. Erasure deletes your photos; the other side keeps the conversation.

Organisations and their members

An organisation’s name, kind and description; for each member, their email address and role; who is assigned to which project; and who invited the organisation to a project (an account number).

So a câmara, an office or a university can take part as a whole.

Until the organisation is dissolved or the membership removed, or it is erased on request.

A Lab of the federation

If a steward links the project to a Lab of the federation: what the Lab’s apps (lens, compass and chart) receive, and what RRL keeps about it. None of them receives the exact location or names from the person register.

If a steward links the project to a Lab of the Syntrociety federation: the Lab, a label the steward chose, which may name someone, what each of the Lab’s apps may do, and the account number of who set it. When a steward, architect or platform administrator sends a handed-over proposal to the Lab’s document store (lens), lens receives the edition without the exact location and without names from the person register; the project’s name and free text go as written. The audit log keeps who sent it and the document number lens returned. Each quarter the Lab’s compass may read a summary of counts, states and dates, without a name, a place or a value. When a steward turns on tasks for the Lab’s chart, a steward, architect or platform administrator can send open tasks there. For each task chart receives only what kind it is (which measurements, or which kind of work), the Lab and the chart zone it is for, the number and fingerprint of the project’s latest revision, and random numbers for the project and the task: never a name, a place, free text or RRL’s own project number. Chart answers whether the task is open, done or recalled, with the measurements and dates; RRL keeps that beside what it sent, and the audit log keeps who sent or recalled a task. Figures RRL reads from the Lab’s chart are kept like open data.

So a Lab can keep its projects’ proposals, read its land beside its own self-assessment, and carry out a project’s tasks in its chart.

The link: until a steward removes it, the project is deleted for good, or we erase it on request. A copy sent to lens is kept by lens; RRL keeps the audit row for good. A task sent to chart: RRL keeps what it sent and what chart answered until the project is deleted for good; chart keeps what it received.

The trail2what stays so others can check
Audit log	For every change: when, which account number, what kind of change, which project, and a reason if someone typed one. RRL never writes the old or new value or an email address into it.	So a project’s stewards and observers, who can export it, and the platform administrators can check which account changed what.	For good: rows are never removed, also not when the project is deleted. Erasure replaces a reason that names you with “[erased]” (in rows written from 10 October 2026), and after erasure your account number no longer leads to your email address; what stays after erasure is listed below.
Public anchors	None. Once a day a fingerprint of all records is published on GitHub, without project names, ids or contents.	So anyone can later check that the trail was not rewritten.	For good.

The trail2what stays so others can check

Audit log

For every change: when, which account number, what kind of change, which project, and a reason if someone typed one. RRL never writes the old or new value or an email address into it.

So a project’s stewards and observers, who can export it, and the platform administrators can check which account changed what.

For good: rows are never removed, also not when the project is deleted. Erasure replaces a reason that names you with “[erased]” (in rows written from 10 October 2026), and after erasure your account number no longer leads to your email address; what stays after erasure is listed below.

Public anchors

None. Once a day a fingerprint of all records is published on GitHub, without project names, ids or contents.

So anyone can later check that the trail was not rewritten.

For good.

Platform administration4what administrators record
Platform invitations	The email address a platform administrator invited without a project, that administrator’s account number, and when.	So that address can sign in before there is a project for it.	Until the invitation is withdrawn or the address is erased.
Readers of the potential model	The email address a platform administrator lets in to read the platform’s potential model, that administrator’s account number and when. For each link to the model: the view it shows, and the account numbers of who made and who ended it.	So the model is shown only to the people it was meant for.	Until a platform administrator removes the address or ends the link, or we erase it on request.
Price lists	The account number of the platform administrator who saved or withdrew a price list.	So anyone can see who set what RRL costs.	For good, with the price list.
Help articles	The articles in the help panel: a title, a text, its language and pages, and the account number of the platform administrator who published it. Platform administrators write them; everyone signed in reads the published ones. An article holds no names: one made from an answer starts without the question’s names, project or place, and the platform administrator removes what might still identify someone before publishing.	So the next person finds an answer before they have to ask.	Until a platform administrator removes it. It holds nothing of yours to erase; if something that identifies you slipped in, ask, and a platform administrator changes or removes it.

Platform administration4what administrators record

Platform invitations

The email address a platform administrator invited without a project, that administrator’s account number, and when.

So that address can sign in before there is a project for it.

Until the invitation is withdrawn or the address is erased.

Readers of the potential model

The email address a platform administrator lets in to read the platform’s potential model, that administrator’s account number and when. For each link to the model: the view it shows, and the account numbers of who made and who ended it.

So the model is shown only to the people it was meant for.

Until a platform administrator removes the address or ends the link, or we erase it on request.

Price lists

The account number of the platform administrator who saved or withdrew a price list.

So anyone can see who set what RRL costs.

For good, with the price list.

Help articles

The articles in the help panel: a title, a text, its language and pages, and the account number of the platform administrator who published it. Platform administrators write them; everyone signed in reads the published ones. An article holds no names: one made from an answer starts without the question’s names, project or place, and the platform administrator removes what might still identify someone before publishing.

So the next person finds an answer before they have to ask.

Until a platform administrator removes it. It holds nothing of yours to erase; if something that identifies you slipped in, ask, and a platform administrator changes or removes it.

Outside a project2before you have an account
Invitation requests	What you fill in on the start page’s request form: your name, email address and whatever else you give (where the land is, how many people, your project or organisation, a note). For rate limiting, a shortened IP address.	So a platform administrator can answer you and, if you ask to join a project, ask its steward about your invitation.	In RRL: until a platform administrator answers (invite or decline), and at most 90 days. Each platform administrator also receives it by email, in their own mailbox outside RRL; RRL cannot delete those emails. The shortened IP address: one hour.
Staying involved after the whitepaper	If you choose to stay involved at the end of the whitepaper: your email address, the name you gave (if any), which of the four kinds of involvement you ticked, when you confirmed and which version of these words you agreed to. Nothing is kept before you press Confirm behind the link in the confirmation email; that link holds your sign-up encrypted and expires after 7 days. To limit abuse, a shortened IP address. Separately, monthly totals of downloads, sign-ups and confirmations, without any IP address, cookie or identifier.	To send you what you chose: an occasional update (at most a few times a year) or a personal invitation to think along, share experience or become a pilot partner. Controller: Cooperativa Integral Sulitânia, CRL, which runs RRL; People (people.syfers.eu, Syntrociety federation) keeps the list as processor; Resend sends the confirmation email. Legal basis: your consent (GDPR art. 6(1)(a); for email also Portuguese Lei 41/2004, art. 13-A). No open or click tracking and no profile.	Until you unsubscribe: with the one-click link in every email, or by writing to the contact address above. Withdrawing does not affect what happened before. After you unsubscribe, People keeps only what stops further email. An unconfirmed sign-up is never kept. The shortened IP address: one hour. Monthly totals: 25 months. You keep the rights listed below, including access, erasure and a complaint to the CNPD.

Outside a project2before you have an account

Invitation requests

What you fill in on the start page’s request form: your name, email address and whatever else you give (where the land is, how many people, your project or organisation, a note). For rate limiting, a shortened IP address.

So a platform administrator can answer you and, if you ask to join a project, ask its steward about your invitation.

In RRL: until a platform administrator answers (invite or decline), and at most 90 days. Each platform administrator also receives it by email, in their own mailbox outside RRL; RRL cannot delete those emails. The shortened IP address: one hour.

Staying involved after the whitepaper

If you choose to stay involved at the end of the whitepaper: your email address, the name you gave (if any), which of the four kinds of involvement you ticked, when you confirmed and which version of these words you agreed to. Nothing is kept before you press Confirm behind the link in the confirmation email; that link holds your sign-up encrypted and expires after 7 days. To limit abuse, a shortened IP address. Separately, monthly totals of downloads, sign-ups and confirmations, without any IP address, cookie or identifier.

To send you what you chose: an occasional update (at most a few times a year) or a personal invitation to think along, share experience or become a pilot partner. Controller: Cooperativa Integral Sulitânia, CRL, which runs RRL; People (people.syfers.eu, Syntrociety federation) keeps the list as processor; Resend sends the confirmation email. Legal basis: your consent (GDPR art. 6(1)(a); for email also Portuguese Lei 41/2004, art. 13-A). No open or click tracking and no profile.

Until you unsubscribe: with the one-click link in every email, or by writing to the contact address above. Withdrawing does not affect what happened before. After you unsubscribe, People keeps only what stops further email. An unconfirmed sign-up is never kept. The shortened IP address: one hour. Monthly totals: 25 months. You keep the rights listed below, including access, erasure and a complaint to the CNPD.

4Who else handles the data

The services that run the platform: Vercel, People (the federation’s shared sign-in), Supabase, Upstash and Resend, and what each one handles.

Vercel hosts the platform, runs scheduled jobs, stores private files and measures page speed with Speed Insights. People (people.syfers.eu), the sign-in shared by the apps of the Syntrociety federation, signs you in: it holds your email address and gives RRL a session that works only in RRL. Supabase stores People’s database, with the sign-in, sessions and accounts, and RRL’s projects and audit log, kept apart from the other apps’ data; RRL’s server reaches its part through a connection reserved for RRL. RRL itself decides which projects you may open and what you may do there. Upstash handles rate limits, caches, duplicate-submission checks and access to the potential model. Resend sends sign-in links, the first sign-in welcome email, invitations, organisation membership notices, access-ending notices, invitation requests and answers, the daily email and deletion notices to administrators.

GitHub receives the daily anchor, which holds no personal data.

DGT (Direção-Geral do Território): the land map loads aerial photos and cadastre tiles directly from DGT, which sees your IP address and the area you view. A cadastre lookup sends a parcel number, never a name. For height data, the platform’s server sends DGT the rectangle around the land. Reading the national maps for a plot you are looking at sends DGT the rectangle around its outline, also for land the project does not hold. For the optional 2025 orthophotos, the platform server requests fixed tiles around the stored land, only for readers with exact-location access. DGT receives the server IP address and tile area, not the browser IP address or project identifier. These images are kept in a project-scoped internal cache for at most 24 hours; browser responses are not cached. The older 2023 imagery still loads directly from DGT in your browser, so DGT sees your browser IP address and viewed area for that edition.

When you open a project’s map, the road map loads directly from OpenFreeMap by default, unless you have chosen another view. OpenFreeMap sees your IP address and the area shown. For a reader who may not see the exact location, that area is rounded to about 5 km.

OpenStreetMap (Nominatim): when you search the land map for a postcode or a place name, the platform’s server sends those words to OpenStreetMap’s Nominatim service and nothing else, so it does not see your IP address. Coordinates you type are read in your browser and sent nowhere. Searches are not stored.

Open data services: when a project asks for public figures about its land, the platform’s server sends them a location, a rectangle or an outline, never a name, email address, parcel number or project.

Open data services: when a project asks for public figures for its land, the platform’s server (never your browser) sends the land’s location, rounded to about 1 km, to PVGIS (European Commission, JRC) for solar yield, Open-Meteo for rainfall and evaporation, and ISRIC SoilGrids for soil values. DGT, ICNF and EFFIS (the European Forest Fire Information System, European Commission) receive the rectangle around the land to read the national planning, land-cover and burnt-area maps, and EFFIS’s burnt-area and severity maps. The Copernicus Data Space (European Union) receives the outline of each zone, and of the land, to read satellite images and tree cover over it. The European Environment Agency (EEA) receives the rectangle around the land to read where water and wet ground and where hedges and tree lines are mapped (Copernicus Land Monitoring Service). No name, email address, parcel number or project is sent. APA (Agência Portuguesa do Ambiente) receives the rectangle around the land when a member with access to its exact location requests flood and water-body context. When a member with access to the exact location requests electricity and communications context, E-REDES receives only the centre rounded to 0.01° and a 2 km search radius. ANACOM receives the land’s rectangle and the public object identifiers needed for related operator and technology records. Neither receives project details, account details or the full land outline.

5Your rights

You can ask to see, correct or erase your data, to limit its use, or to receive it in a usable format. Write to hello@syntrociety.org. You can also complain to the Portuguese data protection authority (CNPD, www.cnpd.pt) or the authority where you live.

6How to have your data erased

Ask on Your account, under Sign-in and your data, or write to hello@syntrociety.org. A platform administrator then searches every project for your email address and any other names you give, confirms each match and then the erasure as a whole. The audit log records that an erasure happened, by whom and why, not who was erased.

What is erased

every person register entry that names you, in every project;

every place in a project’s revisions that refers to such an entry: it shows “[erased]”; no revision is rewritten;

your RRL account, memberships and invitations are removed, and existing RRL sessions can no longer open private data. Your People sign-in, which other apps of the federation may also use, stays: to erase it, ask People (people.syfers.eu/privacy);

evidence files that hold your data, once confirmed: the file is deleted and only its fingerprint is kept;

your own words: your messages in a conversation read “[erased]”, and what you had seen is forgotten.

where a household name is erased, the project’s exact location becomes approximate.

What stays after erasure

Backups held by Supabase, Vercel Blob and Upstash are not erased by the platform’s erasure action. Their expiry periods have not yet been verified. The previous database and migration exports also remain as recovery copies; no deletion deadline has yet been set. We must handle these copies separately and take subsequent erasure requests into account before restoring them.

Copies outside RRL: downloaded exports, and proposals or answer letters already handed over.

Inside RRL: the text of a proposal as it was handed over, and a câmara’s answer letter, stay as they were until the project is deleted for good. A learning you shared is kept without its author, so your account cannot find it: tell us its words and we look for them.

Names typed into free text (a note, a description, a label) or held inside a file are not found automatically: tell us where your name is written. The platform administrator handling your request also sees the files that may hold your data, and confirms each one before it is deleted.

Account numbers in historical records and the audit log stay. After account deletion, the live account directory no longer links them to your email address. Remaining copies and the content or context of a record may still identify you.