Privacy Policy

1. Controller

Maksym Kogin, acting as an individual, is the data controller for the processing described here.

Contact for anything in this document, including exercising your rights: maksymkogin@gmail.com.

Data Protection Officer: we have not appointed one. Our processing does not fall within Article 37(1) GDPR: it is not large-scale systematic monitoring, and it does not involve special-category data.

2. Our position in one paragraph

You are entrusting us with a picture of your personal wealth. We treat that as the sensitive thing it is, even though the law does not classify financial data as a “special category”. We collect the minimum needed to run the product, we do not sell it, we do not use it to train models, and we do not send it to advertisers. Where we send data to a third party, it is because the product cannot run otherwise, and that party is listed in section 8.

3. What we collect — identity and account

Email address and Google account identifier, at sign-in. Account creation date and last-seen date, generated by the Service, used to show “what changed since your last visit”. Display currency and interface language, which you choose.

We never receive or store a password. Authentication is delegated entirely to Google.

Demonstration sessions. A session opened without an account carries no identity data at all: no email address, no name, no identifier from any provider. The Service generates an internal identifier and a technical address in the reserved domain demo.invalid, which can receive no mail and belongs to no one.

4. What we collect — property and financial data

This is the substance of what you entrust to us: property name, type, address, postcode, area and status; purchase date and price, current value and valuation history; income and expense entries with dates, categories and notes; loan amount, rate, term, monthly payment and dates; inventory items and warranty dates; tasks and due dates; energy performance class (DPE) and its validity.

Warning about third parties. If you record a tenant’s name in a note, you are entering someone else’s personal data. For that data you are the controller and we are your processor. Only enter what you need, and make sure you have a legal basis for it.

5. What we collect — documents

Files you upload (PDF, JPEG or PNG only — verified by reading the file’s actual signature, not its name), with filename, size, type, document category and expiry date.

Documents are held in a private storage bucket and are served back to you through short-lived signed links. They are never published, and they are erased on your instruction or together with your account.

6. What we collect — technical data

Session cookies (Supabase Auth), kept for the duration of your session. IP address inside a rate-limiting counter, kept for a maximum of 24 hours, to prevent brute force and abuse. Error reports (Sentry), kept 90 days. Sharing-link access counters, kept 30 days, so you can see how often your link was opened.

On error reports specifically. Sentry is configured with sendDefaultPii disabled and a custom scrubber that strips cookies, request bodies, headers, and everything matching password / secret / token / authorization patterns before transmission. Of the user object, only the identifier is sent — no email, no IP address. Session Replay is deliberately off.

Calendar link. While the calendar feed is enabled, the Service stores one random token and the date it was issued. The calendar application you choose fetches the file directly from us; we send nothing and add no recipient. Revoking deletes the token.

7. What we do NOT do

• We do not sell your data — not to anyone, in any form, aggregated or not.
• We do not use your data to train machine-learning models. Our hosting provider reserves that right under its terms; the option is disabled in our account, and we will say so here if that ever changes.
• We do not do advertising, and we do not run advertising or analytics trackers.
• We do not profile you within the meaning of Article 22 GDPR, and we take no automated decision producing legal effects for you.
• We do not read your documents. They are stored, served back to you, and deleted on your instruction.

8. Legal bases (Article 6 GDPR)

Providing the Service, storing your data and computing indicators rest on performance of a contract (Article 6(1)(b)). Security, rate limiting, abuse prevention and error monitoring rest on legitimate interest (Article 6(1)(f)). Retaining proof that an erasure request was carried out rests on a legal obligation (Article 6(1)(c)). Any identifier that is not strictly necessary rests on consent (Article 6(1)(a)).

Where we rely on legitimate interest, we have balanced it against your rights. You may object at any time (section 12).

9. Retention

Account and portfolio data is kept for the duration of your account. After a deletion request, we keep it 30 days, then erase it irreversibly. Uploaded documents are kept for the duration of the account, then erased with it. A deletion audit record is retained after erasure, containing only your identifier, email and timestamps, as proof of compliance.

On the 30-day delay. Deletion is not immediate, deliberately. It protects you against an account takeover being used to destroy your portfolio, and it fits within the one-month response window of Article 12(3) GDPR. You can cancel during those 30 days by signing in again.

Demonstration sessions. Everything created in a session opened without an account — the account record, the sample portfolio and anything entered during the session — is erased automatically 48 hours after the session is opened, by the same process that carries out deletion requests. The 30-day delay does not apply here: there is no one to notify and no decision to reconsider.

10. Recipients and sub-processors

We disclose data to no one else, except where compelled by law. The following providers process data strictly to run the Service:

• Supabase Pte. Ltd (Singapore) — authentication, database and file storage — data stored in Stockholm, European Union (AWS eu-north-1). Transfers are covered by the EU Standard Contractual Clauses (Module Two), incorporated into Supabase’s Data Processing Addendum.
• Vercel Inc. (United States) — application hosting — server functions execute in Paris, France (region cdg1), pinned in our project configuration, so application code runs inside the European Union. Vercel Inc. is a United States company and its staff may access systems for administration and support. Static files are distributed by a global content delivery network and carry no personal data. Vercel's processing terms are published at vercel.com/legal/dpa.
• Sentry — error monitoring, and only after you have consented — data stored in Frankfurt, Germany (Sentry’s European region).
• Google — sign-in only — United States, under the EU-US Data Privacy Framework.
• European Central Bank — public reference-rate data, outbound only, no personal data sent — EU.

How to obtain a copy of the safeguards (GDPR art. 13(1)(f)): Vercel's processing terms are published at vercel.com/legal/dpa; Supabase's Data Processing Addendum — supabase.com/legal/dpa; Data Privacy Framework certification can be checked in the official register at dataprivacyframework.gov. On request to maksymkogin@gmail.com we will send you a copy. Our transfer impact assessment is held available for the supervisory authority.

Hosting regions were verified on 10 August 2026 (Supabase in Stockholm, AWS eu-north-1; Sentry in Frankfurt, read from the ingestion endpoint this application actually sends to) and again on 28 August 2026 after a change of hosting provider: server functions now execute in Paris (region cdg1), pinned in the project configuration rather than left at the provider's default. Supabase's Data Processing Addendum (version 1, 1 August 2026) forms part of its Terms of Service and is therefore in force.

11. Security

• Access is controlled in application code: every server action verifies the user and verifies ownership of the object before touching it.
• Row Level Security in Deny-All mode on all database tables, closing the public data API.
• Documents are stored in a private bucket, served only through short-lived signed URLs.
• Strict Content Security Policy, HSTS, and X-Frame-Options: DENY.
• Uploads are validated by file signature, not by declared type; content type is enforced server-side.
• Rate limiting applies to sign-in and to public sharing links.
• Re-authentication with your identity provider is required before an account-deletion request is accepted.
• Error reports are scrubbed of personal data before leaving the server; source maps are removed from the production bundle.

No system is impregnable. In case of a breach affecting your rights, we will notify the CNIL within 72 hours (Article 33 GDPR) and inform you without undue delay where the risk is high (Article 34).

12. Your rights

Under Articles 15 to 22 GDPR you have the right to: access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time.

In practice, without writing to anyone: access and portability — CSV export from your account, at any time; rectification — edit any record directly; erasure — account deletion from the settings page, with a 30-day grace period.

For anything else: maksymkogin@gmail.com. We respond within one month (extendable by two months for complex requests, with notice).

Right to complain. You may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr. You do not need our permission and you do not need to contact us first.

13. Cookies

We use strictly necessary cookies only, for authentication and session security. These do not require consent under Article 82 of the loi Informatique et Libertés.

Error monitoring. Sentry sets a client-side identifier that is not strictly necessary. It is therefore loaded only after you have accepted it in the consent banner shown on your first visit; if you decline, Sentry is never initialised and no identifier is set. Your choice is stored in your browser’s local storage, not in a cookie, and you can reverse it by clearing that storage.

14. Children

The Service is not intended for minors and we do not knowingly collect their data. If you believe a minor has created an account, write to maksymkogin@gmail.com and we will erase it.

15. Changes

Material changes are notified by email 30 days in advance. The version and date at the top of this page always indicate the applicable text.

16. Contact

Maksym Kogin · maksymkogin@gmail.com