Privacy Policy
Last updated: 9 March 2026 · Version 1.0
1. Who We Are
LINEUP (“LINEUP”, “we”, “us”) is the data controller for personal data processed through the LINEUP platform (lineupsurf.net). We are registered in Portugal and comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Portuguese Law 58/2019.
2. Data We Collect
| Category | Examples | Legal Basis |
|---|---|---|
| Account data | Name, email, phone, password hash | Contract performance |
| Identity verification | ID document photo, selfie | Legitimate interest (trust & safety) |
| Payment data | Stripe customer/account IDs, last-4 card digits | Contract performance |
| Booking data | Dates, board details, messages | Contract performance |
| Usage data | IP address, browser, pages visited | Legitimate interest (analytics & security) |
| Location data | City, pickup coordinates (Owner-provided) | Consent / Contract performance |
3. How We Use Your Data
- To create and manage your account.
- To process bookings, payments, and payouts.
- To verify user identity (KYC) for trust and safety.
- To communicate booking updates and platform notifications.
- To improve the platform through anonymised analytics.
- To comply with legal obligations (tax, anti-fraud).
4. Who We Share Data With
- Stripe: Payment processing. Stripe acts as an independent data controller for payment data. See Stripe’s Privacy Policy.
- Supabase: Database and authentication hosting (EU-region infrastructure).
- Other users: Your public profile (name, avatar, city, verified badge) is visible to other platform users. Your email and phone are never shared directly; communication happens through the platform messaging system.
- Legal authorities: If required by Portuguese or EU law, court order, or to protect our rights and safety.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 3 years after deletion |
| Identity documents | Deleted within 30 days of verification approval/rejection |
| Booking & payment records | 7 years (Portuguese tax law) |
| Damage claim evidence | 2 years from claim resolution |
| Messages | Duration of account + 1 year |
| Usage analytics | 26 months (anonymised) |
6. Your Rights (GDPR)
Under the GDPR you have the right to:
- Access — Request a copy of all data we hold about you.
- Rectification — Correct inaccurate or incomplete data.
- Erasure — Request deletion of your data (“right to be forgotten”), subject to legal retention obligations.
- Restriction — Restrict processing in specific circumstances.
- Portability — Receive your data in a structured, machine-readable format.
- Objection — Object to processing based on legitimate interest.
- Withdraw consent — Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at hello@lineupsurf.net. We will respond within 30 days.
7. Cookies
LINEUP uses strictly necessary cookies for authentication and session management. We do not use tracking or advertising cookies. If we introduce analytics cookies in the future, we will obtain your consent first.
8. Security Measures
- All data is transmitted over HTTPS / TLS 1.3.
- Passwords are hashed using bcrypt (via Supabase Auth).
- Identity documents are stored in a private bucket with strict RLS policies; signed URLs expire after 10 minutes.
- Database access is restricted by Row Level Security.
9. International Transfers
Your data is primarily processed within the EU. Where data is transferred outside the EEA (e.g., Stripe’s US infrastructure), it is protected by Standard Contractual Clauses (SCCs) or an adequacy decision.
10. Children
LINEUP is not directed at individuals under 18. We do not knowingly collect data from minors. If we become aware that a user is under 18, we will delete their account and data.
11. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated by email at least 30 days before taking effect. The “Last updated” date at the top indicates the latest revision.
12. Supervisory Authority
If you believe your data protection rights have been violated, you may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD): www.cnpd.pt.
13. Contact
Data Protection Officer
LINEUP
Lisbon, Portugal
Email: hello@lineupsurf.net