Privacy Policy

1. Controller

Maksym Kogin, acting as an individual, is the data controller for the processing described here.

Contact for anything in this document, including exercising your rights: contact@zeroproble.me.

Data Protection Officer: we have not appointed one. Our processing does not fall within Article 37(1) GDPR: it is not large-scale systematic monitoring, and it does not involve special-category data.

2. Our position in one paragraph

You are entrusting us with a picture of your personal wealth. We treat that as the sensitive thing it is, even though the law does not classify financial data as a “special category”. We collect the minimum needed to run the product, we do not sell it, we do not use it to train models, and we do not send it to advertisers. Where we send data to a third party, it is because the product cannot run otherwise, and that party is listed in section 8.

3. What we collect — identity and account

Email address, at sign-up or sign-in; Google account identifier if you sign in with Google. Account creation date and last-seen date, generated by the Service, used to show “what changed since your last visit”. Display currency and interface language, which you choose.

Password. If you sign in with Google, your Google password is never sent to us. If you create a password for Zéro problème, it travels over an encrypted connection (HTTPS) to our authentication provider, Supabase, which records only a non-reversible fingerprint of it (bcrypt): it is kept in plain text nowhere and no one can read it back, neither we nor Supabase. A one-time code sent to your address confirms it at sign-up and lets you choose a new password.

Demonstration sessions. A session opened without an account carries no identity data at all: no email address, no name, no identifier from any provider. The Service generates an internal identifier and a technical address in the reserved domain demo.invalid, which can receive no mail and belongs to no one.

Email preferences. Your choices (reminders before your deadlines; product news and requests for feedback) and the date on which you agreed to the latter. None of these emails is sent before 24 November 2026. News and requests for feedback will only be sent with that consent, which you can withdraw at any time in Account; every email will carry an unsubscribe link.

Account emails. The code confirming your address, the code for choosing a new password and the notice that your password has changed; from 24 November 2026, the notice that account deletion has been requested and the notice that it has been carried out. They are necessary to perform the contract and to keep the account secure (Article 6(1)(b) GDPR) and are sent whatever your reminder and news choices.

4. What we collect — property and financial data

This is the substance of what you entrust to us: property name, type, address, postcode, area and status; purchase date and price, current value and valuation history; income and expense entries with dates, categories and notes; loan amount, rate, term, monthly payment and dates; inventory items and warranty dates; tasks and due dates; energy performance class (DPE) and its validity; goals you set (target net worth or monthly income; for a next property: type, area, département or commune, planned monthly loan payment and term).

Warning about third parties. If you record a tenant’s name in a note, you are entering someone else’s personal data. For that data you are the controller and we are your processor. Only enter what you need, and make sure you have a legal basis for it.

Tenant’s email address (receipts by email). If you choose to send rent receipts to your tenant by email, we store, for that lease, the tenant’s email address and the date on which you confirmed having the tenant’s express agreement (article 21 of the French law of 6 July 1989). Names entered on the receipt are used to compose the message and are not kept. For this data you are the controller and we act as your processor (article 28 of the GDPR, terms §6). The address is deleted when you remove it, when the lease is deleted and with your account. Available from 24 November 2026.

Rent revision reminder (no account). If you ask, from the IRL revision calculator, to be reminded before your lease anniversary, we store your email address, that anniversary date and the page language. Legal basis: your consent (article 6(1)(a) of the GDPR), confirmed through a link sent to that address. We email you once, 30 days before the date, then the address is erased; without confirmation it is erased after 7 days. You can cancel at any time through the link you received. Nothing else is sent. Available from 24 November 2026.

5. What we collect — documents

Files you upload (PDF, JPEG or PNG only — verified by reading the file’s actual signature, not its name), with filename, size, type, document category and expiry date.

Documents are held in a private storage bucket and are served back to you through short-lived signed links. They are never published, and they are erased on your instruction or together with your account.

6. What we collect — technical data

Session cookies (Supabase Auth), kept for the duration of your session. IP address inside a rate-limiting counter, kept for a maximum of 24 hours, to prevent brute force and abuse. Error reports (Sentry), kept 90 days. Sharing-link access counters, kept 30 days, so you can see how often your link was opened.

On error reports specifically. Sentry is configured with sendDefaultPii disabled and a custom scrubber that strips cookies, request bodies, headers, and everything matching password / secret / token / authorization patterns before transmission. Of the user object, only the identifier is sent — no email, no IP address. Session Replay is deliberately off.

Calendar link. While the calendar feed is enabled, the Service stores one random token and the date it was issued. The calendar application you choose fetches the file directly from us; we send nothing and add no recipient. Revoking deletes the token.

Zéro problème app in ChatGPT. If you use our calculators from ChatGPT, ChatGPT sends us only the values needed for the requested calculation: rent, index quarter, energy class, lease type and date, purchase and sale prices and dates. ChatGPT may add technical information, such as language or approximate location; we do not use it. These values are used for the calculation only: they are neither stored nor linked to an account. Our hosting provider keeps technical logs of the request (time, IP address of OpenAI’s servers). The conversation itself is processed by OpenAI, which is responsible for it under its own privacy policy.

Audience measurement. To know which pages and calculators are used, and whether accounts come back from one month to the next, we record ourselves, without cookies or third-party tools: the page viewed (without parameters or record identifiers), the referring site (domain name only), any campaign parameters, the country, the city, the type of device (mobile, tablet, computer), the browser and operating system in their major version, a screen-width class, the links and buttons clicked (destination address or button name, never what you type), the time spent on the page, how much of the page was scrolled and its load time, and a random identifier specific to the browser tab, erased when it is closed. No session recording. Your IP address is not recorded. In the application, for accounts, we also record certain actions (opening the app, at most once a day; creating a property, a lease or a transaction, an import, enabling the calendar, uploading a document, an export), linked to the account, from 24 November 2026. This data is used only for internal statistics, is not combined with any other data and is shared with no one.

7. What we do NOT do

• We do not sell your data — not to anyone, in any form, aggregated or not.
• We do not use your data to train machine-learning models. Our hosting provider reserves that right under its terms; the option is disabled in our account, and we will say so here if that ever changes.
• We do not advertise and use no advertising trackers or third-party analytics tools. The audience measurement described in section 6 is carried out by us, without cookies.
• We do not profile you within the meaning of Article 22 GDPR, and we take no automated decision producing legal effects for you.
• We do not read your documents. They are stored, served back to you, and deleted on your instruction.

8. Legal bases (Article 6 GDPR)

Providing the Service, storing your data and computing indicators rest on performance of a contract (Article 6(1)(b)). Security, rate limiting, abuse prevention and error monitoring rest on legitimate interest (Article 6(1)(f)). Retaining proof that an erasure request was carried out rests on a legal obligation (Article 6(1)(c)). Any identifier that is not strictly necessary rests on consent (Article 6(1)(a)). Email reminders rest on performance of a contract; product news and requests for feedback rest on your consent (Article 6(1)(a) GDPR and Article L.34-5 of the French Postal and Electronic Communications Code).

Where we rely on legitimate interest, we have balanced it against your rights. You may object at any time (section 12).

Audience measurement is based on our legitimate interest in knowing which features are used and improving the Service (Article 6(1)(f)). It meets the conditions set by the CNIL for exemption from consent: purpose limited to audience measurement on our own behalf, anonymous statistics, no combination with other data, limited retention. You may refuse it at any time (section 13).

9. Retention

Account and portfolio data is kept for the duration of your account. After a deletion request, we keep it 30 days, then erase it irreversibly. Uploaded documents are kept for the duration of the account, then erased with it. A deletion audit record is retained after erasure, containing only your identifier, email and timestamps, as proof of compliance.

On the 30-day delay. Deletion is not immediate, deliberately. It protects you against an account takeover being used to destroy your portfolio, and it fits within the one-month response window of Article 12(3) GDPR. You can cancel during those 30 days by signing in again.

Demonstration sessions. Everything created in a session opened without an account — the account record, the sample portfolio and anything entered during the session — is erased automatically 48 hours after the session is opened, by the same process that carries out deletion requests. The 30-day delay does not apply here: there is no one to notify and no decision to reconsider.

Audience measurement: 13 months, then deleted automatically. Actions linked to an account are erased with it.

10. Recipients and sub-processors

We disclose data to no one else, except where compelled by law. The following providers process data strictly to run the Service:

• Supabase Pte. Ltd (Singapore) — authentication, database and file storage — data stored in Stockholm, European Union (AWS eu-north-1). Transfers are covered by the EU Standard Contractual Clauses (Module Two), incorporated into Supabase’s Data Processing Addendum.
• Vercel Inc. (United States) — application hosting — server functions execute in Paris, France (region cdg1), pinned in our project configuration, so application code runs inside the European Union. Vercel Inc. is a United States company and its staff may access systems for administration and support. Static files are distributed by a global content delivery network and carry no personal data. Its terms of service (section 10.1) incorporate by reference its Data Processing Addendum, published at vercel.com/legal/dpa; Vercel Inc. is certified under the EU-US Data Privacy Framework.
• Sentry — error monitoring, and only after you have consented — data stored in Frankfurt, Germany (Sentry’s European region).
• Brevo (Sendinblue SAS, France) — sending emails: confirmation and new-password codes, password change notices (receives your email address and the message content); from 24 November 2026: account deletion request and deletion notices (receives your email address and the date); deadline reminders, only if you have turned them on (receives your email address and the reminder content: deadline, property name, date, any amount); receipts you send to your tenant (receives the tenant’s email address, yours in copy and the receipt content); rent revision reminders requested from the IRL calculator (receives the email address and the lease anniversary date) — data stored in the European Union (France, Germany, Belgium).
• Google — sign-in, if you choose it — United States, under the EU-US Data Privacy Framework.
• European Central Bank — public reference-rate data, outbound only, no personal data sent — EU.
• Base Adresse Nationale (French State, adresse.data.gouv.fr) and ADEME — looking up a home’s DPE, in the app or on the public search page: the address you type is sent to the Base Adresse Nationale to locate it, then only the building identifier, or the DPE number, is sent to ADEME. No name, account or email; nothing is kept on our side — France.

How to obtain a copy of the safeguards (GDPR art. 13(1)(f)): Vercel's terms of service (section 10.1) incorporate by reference its Data Processing Addendum, published at vercel.com/legal/dpa; Supabase's Data Processing Addendum — supabase.com/legal/dpa; Data Privacy Framework certification can be checked in the official register at dataprivacyframework.gov. On request to contact@zeroproble.me we will send you a copy. Our transfer impact assessment is held available for the supervisory authority.

Hosting regions were verified on 10 August 2026 (Supabase in Stockholm, AWS eu-north-1; Sentry in Frankfurt, read from the ingestion endpoint this application actually sends to) and again on 28 August 2026 after a change of hosting provider: server functions now execute in Paris (region cdg1), pinned in the project configuration rather than left at the provider's default. Supabase's Data Processing Addendum (version 1, 1 August 2026) forms part of its Terms of Service and is therefore in force.

11. Security

• Access is controlled in application code: every server action verifies the user and verifies ownership of the object before touching it.
• Row Level Security in Deny-All mode on all database tables, closing the public data API.
• Documents are stored in a private bucket, served only through short-lived signed URLs.
• Strict Content Security Policy, HSTS, and X-Frame-Options: DENY.
• Uploads are validated by file signature, not by declared type; content type is enforced server-side.
• Rate limiting applies to sign-in, to public sharing links and to DPE lookups.
• Re-authentication with your identity provider is required before an account-deletion request is accepted.
• Error reports are scrubbed of personal data before leaving the server; source maps are removed from the production bundle.

No system is impregnable. In case of a breach affecting your rights, we will notify the CNIL within 72 hours (Article 33 GDPR) and inform you without undue delay where the risk is high (Article 34).

12. Your rights

Under Articles 15 to 22 GDPR you have the right to: access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time.

In practice, without writing to anyone: access and portability — CSV export from your account, at any time; rectification — edit any record directly; erasure — account deletion from the settings page, with a 30-day grace period.

For anything else: contact@zeroproble.me. We respond within one month (extendable by two months for complex requests, with notice).

Right to complain. You may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr. You do not need our permission and you do not need to contact us first.

13. Cookies

We use strictly necessary cookies only: for authentication, session security and the service you ask for. When you click “Track this lease” under a calculator, the figures from that calculation are kept for two hours at most, while you sign in, then deleted; no name or address. On the “My property” page, the lease you enter is kept in your browser’s storage, on this device only; it is sent to us only if you click “Save to my account”, and you can delete it at any time. These cookies do not require consent under Article 82 of the loi Informatique et Libertés.

Error monitoring. Sentry sets a client-side identifier that is not strictly necessary. It is therefore loaded only after you have accepted it in the consent banner shown on your first visit; if you decline, Sentry is never initialised and no identifier is set. Your choice is stored in your browser’s local storage, not in a cookie, and you can reverse it by clearing that storage.

Audience measurement. It uses no cookies: a random identifier is kept in the tab’s storage (sessionStorage) and disappears when the tab is closed. It is disabled if your browser sends the Global Privacy Control or “Do Not Track” signal, or if you refuse it below.

14. Children

The Service is not intended for minors and we do not knowingly collect their data. If you believe a minor has created an account, write to contact@zeroproble.me and we will erase it.

15. Changes

Material changes are notified by email 30 days in advance. The version and date at the top of this page always indicate the applicable text.

16. Contact

Maksym Kogin · contact@zeroproble.me