Version: 2026-10-11

Privacy Policy

Version: 2026-10-11 Last updated: 11 October 2026

This policy explains how [[PLATFORM NAME]] (the "Platform") processes the personal data of its users, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Data Protection Code (Legislative Decree 196/2003).

In short: we use your data only to run the Platform: managing properties, leases, rent, maintenance requests, documents and communication between landlords and tenants.

We do not sell your data or share it with third parties for their own purposes.
We do not use it for advertising, marketing or profiling.
We do not use it to train artificial intelligence models.
We do not make automated decisions about you.

1. Who processes your data

1.1 Controller

[[COMPANY NAME / FULL NAME]] [[FULL ADDRESS]] [[VAT NUMBER / TAX CODE]] Privacy contact: [[privacy@domain.com]]

No Data Protection Officer (DPO) has been appointed, as none of the cases requiring one under Art. 37 GDPR applies. [[If appointed, add the DPO's contact details here.]]

1.2 Roles: the Platform and landlords

Data on the Platform is processed under two different roles:

Data	Who decides how it is used	Role of the Platform
Your account data: email, name, phone, language, policy acceptance, security and sign-in data	The Platform	Controller
Tenancy data entered or managed by a landlord: leases, rent, payments, maintenance, documents, messages and announcements	The landlord (or property manager) using the Platform	Processor on the landlord's behalf (Art. 28 GDPR)

If you are a tenant, the controller of your tenancy data is your landlord. The Platform processes that data only on the landlord's behalf and instructions. For requests about that data you can contact your landlord or us: in the latter case we forward your request and help the landlord respond.

2. What data we process

Category	Examples	Source
Registration and account data	Email, password (stored by the authentication service only as a non-reversible hash), name, phone, preferred language	You
Landlord organisation data	Organisation name, contact email, members	The landlord
Properties and units	Address, property name and type, unit status, notes	The landlord
Invitations	Email, name and phone of the invited person, unit and proposed terms (dates, rent, deposit)	The landlord who invites you (Art. 14 GDPR)
Leases	Unit, start and end dates, rent, deposit, status	The landlord, or created when you accept an invitation
Rent and payments	Due dates, amounts, payment dates, status, tenant payment claims	The landlord and you
Maintenance requests	Category, description, urgency, status, photos, landlord notes and costs	The tenant and the landlord
Documents	Uploaded files (e.g. leases, notices, certificates) with type and description	The landlord
Messages and announcements	Message text, conversation subjects, landlord announcements	Users
Policy acceptance	Accepted version, date and time, language, context (signup, invitation, new version)	Generated by the Platform
Privacy requests	Request type, dates, outcome	You and the Platform
Technical and security data	IP address, browser type, request date and time, sign-in events	Generated automatically by hosting and authentication systems

Please do not upload data that is not needed, in particular special categories of data (for example health data) or photos in which people can be recognised. The Platform does not ask for such data and does not use it for any purpose.

Some data is required: without an email and password an account cannot be created; without tenancy data the Platform cannot provide its features.

3. Purposes and legal bases

The Platform uses data exclusively for the purposes listed below.

Purpose	Legal basis (Art. 6 GDPR)
a) Create and manage your account, authenticate you and show you the right portal (landlord and/or tenant)	Performance of the Platform terms of use — Art. 6(1)(b)
b) Provide the Platform features: properties, leases, rent, maintenance, documents, messages, announcements, reports and CSV exports	Performance of contract — Art. 6(1)(b). For tenancy data we act on the landlord's behalf (see §1.2)
c) Send service emails: signup confirmation, invitations, password reset	Performance of contract or pre-contractual steps you requested — Art. 6(1)(b)
d) Keep the Platform secure, prevent abuse and unauthorised access, keep technical logs	Legitimate interest in service security — Art. 6(1)(f)
e) Respond to data-subject requests and comply with legal obligations	Legal obligation — Art. 6(1)(c)
f) Establish, exercise or defend legal claims, where necessary	Legitimate interest — Art. 6(1)(f)

What we do NOT do with your data:

no newsletters, advertising or commercial messages;
no profiling and no behavioural analysis for commercial purposes;
no selling, transfer or sharing of data with third parties for their own purposes;
no profiling or tracking cookies and no third-party analytics;
no use of data to train artificial intelligence models;
no decisions based solely on automated processing (Art. 22 GDPR).

If we ever wanted to use data for a different purpose, we would inform you first and, where the law requires it, ask for your separate and optional consent.

Accepting this policy at signup records that you have been informed. It is not consent and it is not the legal basis for the processing described above.

4. Who receives the data

Only those needed to run the Platform can access the data:

Other users, within their role. A landlord sees the data of their own properties and tenants. A tenant sees their own lease and payments, their own requests, the documents and announcements that concern them, and the messages exchanged with the landlord. Separation between organisations is enforced at database level.
Technical providers acting as processors (Art. 28 GDPR), contractually bound to use the data only to provide their service to us:

Provider	Service	Processing location	Safeguards for transfers outside the EU
Supabase	Database, authentication, file storage, service emails	Database in region [[e.g. EU – Frankfurt (eu-central-1)]]	EU Standard Contractual Clauses, Module Two (Supabase DPA)
Vercel Inc.	Web application hosting	Global network, headquartered in the United States	EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses (Vercel)
[[Dedicated email provider, if any]]	[[Email delivery]]	[[ ]]	[[ ]]

Platform administrators. Authorised staff access data only to handle data-subject requests, for security reasons or for technical support you requested. Access is protected by two-factor authentication and every operation is logged.
Authorities. Only where required by law or by an order of a competent authority.

The up-to-date list of providers is available on request at [[privacy@domain.com]].

5. How long we keep data

Data	Retention
Account and related data	While the account is active. After an erasure request, within one month (see §7)
Tenancy data (leases, rent, payments)	As long as the landlord keeps it on the Platform, except where the landlord must comply with legal retention obligations (e.g. tax or civil law). In those cases data may be kept in pseudonymised form for the required period: [[PERIOD, to be confirmed with counsel]]
Unaccepted invitations	Expire after 14 days; deleted [[within X days of expiry or revocation]]
Data exports prepared for an access request	Deleted automatically after 30 days
Policy acceptance records	For the life of the account; deleted with the account
Privacy request register	[[PERIOD]], with no personal data in clear (the data subject is identified only by a non-reversible code)
Technical and security logs	According to the hosting and authentication providers' retention: [[e.g. up to 30 days]]
Backups	Deleted data may remain in backups until they expire ([[e.g. 7 days]]). Backups are never used to restore data whose erasure was requested

6. How we protect data

Encrypted connections at all times (HTTPS/TLS).
Strict separation of each organisation's data through database access rules (Row Level Security).
Application-level encryption of the most sensitive personal data (contact details, message text, descriptions) before storage, with keys kept separately from the database and replaceable at any time.
Files kept in private storage, reachable only through temporary links.
Restricted administrative access, with two-factor authentication and an operations log.
Passwords never stored in clear.

7. Your rights

You can exercise the rights under Articles 15 to 22 GDPR at any time:

access (Art. 15): know whether we process your data and receive a complete copy;
rectification (Art. 16): correct inaccurate data; most data can be edited directly on the Settings page;
erasure (Art. 17): have your data deleted, except where the law requires us to keep it;
restriction (Art. 18) of processing;
portability (Art. 20): receive your data in a structured, machine-readable format (JSON);
objection (Art. 21) to processing based on legitimate interest.

How: write to [[privacy@domain.com]], preferably from the email address linked to your account. To protect your data we may ask you to confirm your identity before we proceed.

Timing: we respond without undue delay and in any case within one month of your request. For complex or numerous requests this may be extended by two further months: we will tell you within the first month and explain why. The first copy of your data is free of charge.

Account erasure:

If you are a landlord and the only owner of your organisation, we erase the whole organisation with its properties, leases, documents and messages. Linked tenants keep their own accounts but lose access to that tenancy.
If you are a tenant, your tenancy data also belongs to the landlord (see §1.2). We therefore inform the landlord, and some data, such as rent paid, may be kept in pseudonymised form where the law requires it.

Complaints: if you believe the processing infringes the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, PEC protocollo@pec.gpdp.it (Garante Privacy – complaints), or with the supervisory authority of the EU country where you live or work.

8. Cookies

The Platform uses technical cookies only, required for it to work:

Cookie	Purpose	Duration
Authentication session cookies (`sb-…-auth-token`)	Keep you securely signed in	Session / automatic renewal
Language preference (`NEXT_LOCALE`)	Remember your chosen language	[[e.g. 1 year]]

We do not use profiling, marketing or third-party analytics cookies. For technical cookies only, neither consent nor a banner is required: this policy is sufficient (Garante Privacy – cookie FAQ).

9. Minors

The Platform is intended for adults who manage or live in a rented property. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy, for example when Platform features or providers change. Each version is identified by a date. When the policy changes, you will be asked to review and accept the new version at your next sign-in before you continue using the portal. Previous versions are available on request.