Privacy Policy

1. Data We Collect

We collect information you provide directly, including name, email, property data, bookings, and billing information.

2. How We Use Your Data

We use your data to: (a) provide and improve our services, (b) process payments, (c) communicate with you, (d) comply with legal obligations.

3. Data Sharing

We do not sell your data. We only share with essential service providers (Lemon Squeezy, Firebase, OpenAI) under strict confidentiality agreements.

4. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, or destruction.

5. Your Rights (GDPR)

You have the right to: (a) access your data, (b) correct inaccurate data, (c) delete your data, (d) export your data, (e) object to processing. To exercise these rights, contact us.

6. Cookies

We use essential cookies for site functionality and analytics cookies (only with your consent) to improve your experience.

7. Data Retention

We retain your data while your account is active or as necessary to comply with legal obligations. After account deletion, data is removed within 30 days.

Legal Basis for Processing

• Contract performance: processing necessary to provide our services
• Legitimate interest: analytics, security monitoring, and service improvement
• Consent: marketing communications and optional cookies
• Legal obligation: tax records, anti-fraud, and regulatory compliance

Your Rights as a Data Subject

• Right of Access: request a copy of all personal data we hold about you
• Right to Rectification: correct inaccurate or incomplete data
• Right to Erasure: request deletion of your personal data ("right to be forgotten")
• Right to Restriction: limit how we process your data
• Right to Data Portability: receive your data in a structured, machine-readable format
• Right to Object: object to processing based on legitimate interest
• Right to Withdraw Consent: withdraw consent at any time for consent-based processing

Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Account data is retained while your account is active. After account deletion, data is removed within 30 days, except where retention is required by law.

International Data Transfers

Your data may be processed on servers located within the European Economic Area (EEA). When data is transferred outside the EEA, we ensure adequate protection through Standard Contractual Clauses or equivalent safeguards.