Privacy Policy (GDPR)

Scobovault (VAT/NIF 222222222), Av. Dr. Miguel, Portugal. Privacy / rights requests: adalio.semedo@scobovault.org.

Until the final PHYZIUS legal entity is fully constituted/published, these details identify the current operational controller of the site.

Purchases and accounts: email; name; phone; delivery or pickup details; account data (hashed password); order history and status; Stripe subscription data when applicable; chosen payment method (we do not store full card numbers — Stripe does); promo codes; messages/payment proofs you send us.

THE PHYZIUS DROP: email; name (social entry); entry type (purchase or social); entry weight; link to the order when applicable; self-declared social metadata (no automatic Instagram verification). Published winners appear with a masked email.

PHYZIUS Daily Pod (launch offer): linking the free gift to an eligible order (order id, email/customer, allocation status and campaign remaining stock).

THE PHYZIUS ROUTINE (opt-in ranking): with a signed-in account and explicit opt-in, we store display name, marked days and derived metrics (consistency, streaks) for the public Top 10. Without opt-in, daily check-in stays on your device only; you can request erasure via our privacy email or DELETE on the sync API.

Waitlist / contact: email and, if provided, name, when you join or contact us.

Technical data: browser analytics events (console in development; dataLayer/gtag only if configured), cookies/storage needed for session and bag. No Meta Pixel enabled by default.

Contract performance (GDPR Art. 6(1)(b)): orders, payments, shipping/pickup, accounts, support and purchase-linked gifts (e.g. Daily Pod).

Legitimate interest (Art. 6(1)(f)): security, fraud prevention, site operations, Drop draw auditability and internal aggregated metrics.

Legal obligation (Art. 6(1)(c)): retention of order/billing records for applicable accounting periods.

Consent (Art. 6(1)(a)): free social Drop entry; waitlist/communications when requested; publication on the public Routine ranking; non-essential cookies/marketing if/when enabled.

Entering the Drop does not guarantee winning. Purchase entries are created automatically from eligible paid orders. Social entries are voluntary and self-declared.

We keep Drop data while the campaign is active and for as long as needed to run the draw, notify winners, meet legal duties and handle disputes. Afterwards we anonymise or delete what is no longer needed.

We may use: hosting (Vercel), database (Neon), payments (Stripe), transactional email (Resend). These processors act on our behalf with appropriate safeguards and, where relevant, international transfer protections (e.g. standard contractual clauses).

Instagram (@phyzius.health) is a separate Meta service. We do not automatically verify follow/like/comment and we do not send your email to Instagram through this site.

Orders and billing: applicable legal period. Accounts: while they exist or until deletion is requested, subject to legal duties. Password-reset tokens: short-lived (~1 hour). Drop/Daily Pod: as above and for campaign duration. Routine ranking: while opt-in is active or until you request removal/erasure.

You may request: access, rectification, erasure, restriction, objection and portability under the GDPR. You may also withdraw consent (without affecting prior processing based on that consent).

To exercise rights: email adalio.semedo@scobovault.org with subject “GDPR / PHYZIUS rights”, your account/order email and the request (e.g. access, delete account, remove Drop social entry, leave the Routine ranking). We respond within the legal timeframe.

You may lodge a complaint with the Portuguese CNPD (www.cnpd.pt) or your EU local data-protection authority.

This site is not intended for anyone under 16. We do not knowingly collect children’s data for purchases or giveaways.

We may update this policy when the site or purposes change. The version published at /legal/privacy prevails.