Privacy Policy

1. Data Controller

{{COMPANY_NAME}} (“we”, “us”, “our”) is the data controller for personal data processed through this service. Contact us at {{DPO_EMAIL}}.

2. Data We Collect

• Account data: name, email address, profile picture (from OAuth provider)
• Organization data: organization name, team memberships, roles
• Usage data: feature usage, page views, actions performed
• Billing data: subscription plan, payment history (processed by Calmony Pay)
• Technical data: IP address, browser type, device information

3. How We Use Your Data

• Provide and maintain the service (legal basis: contract)
• Process payments and manage subscriptions (legal basis: contract)
• Send service-related communications (legal basis: contract)
• Improve the service through usage analytics (legal basis: consent)
• Send marketing communications (legal basis: consent — opt-in only)
• Comply with legal obligations (legal basis: legal obligation)

4. Data Retention

We retain your personal data only as long as necessary for the purposes described above. Account data is retained while your account is active. Audit logs are retained for 90 days. Right-to-Rent check evidence is retained for 1 year after the linked tenancy ends; tenant personal data is anonymized 7 years after the tenant’s last tenancy ends. Financial records are retained for 7 years as required by UK law. You can request deletion at any time.

Retention is enforced automatically by scheduled background jobs — no manual intervention is required. See our Register of Processing Activities for the full enforcement mechanism, run cadence, and audit-log signature for each policy.

5. Your Rights

Under applicable data protection laws, you have the right to:

• Access your personal data
• Correct inaccurate data (Settings > Profile)
• Delete your account and all associated data (Settings > Danger Zone)
• Export your data in machine-readable format (Settings > Export)
• Withdraw consent for analytics and marketing (Settings > Privacy & Consent)
• Object to processing based on legitimate interest

6. Sub-Processors

We use the following third-party services to process data on our behalf:

• Vercel — hosting and deployment (US/EU)
• Neon — PostgreSQL database (configurable region)
• Calmony Pay — payment processing (US/EU)
• Resend — transactional email (US)

Each sub-processor is bound by a Data Processing Agreement (DPA) under GDPR Article 28. See the Sub-Processors & DPAs page for links to each DPA and the legal basis for international data transfers (Standard Contractual Clauses, EU–US Data Privacy Framework). Our Register of Processing Activities documents the purposes and legal basis of each processing activity.

7. Cookies

We use strictly necessary cookies for authentication and session management. Analytics and marketing cookies are only set with your explicit consent via the cookie banner. You can change your preferences at any time.

8. Contact

For privacy-related inquiries, contact our Data Protection Officer at {{DPO_EMAIL}}.