Politique de confidentialité

2. Our Role (Data Controller vs. Data Processor)

Under the General Data Protection Regulation (GDPR) and similar global privacy frameworks, the distinction between a Data Controller and a Data Processor is crucial:

• Landager as a Data Controller: We act as a Data Controller for the direct account information you (the landlord/user) provide to us to create your account and bill you for our services.
• Landager as a Data Processor: You act as the Data Controller for all tenant and property data you input into our platform. Landager acts strictly as a Data Processor for this information. You decide what tenant data to collect, and we process it only according to your instructions (by storing it and surfacing it in your dashboard).

Landlord Responsibility: As the Data Controller of your tenants' data, you are legally responsible for ensuring you have a lawful basis (such as consent or legitimate interest) to collect their Personal Identifiable Information (PII) and enter it into the Landager platform.

3. Information We Collect

We collect information dynamically based on how you use our platform:

A. Information you provide to us directly (Controller Data)

• Account Data: Name, email address, a password hash (bcrypt), and your profile image if you sign in with Google.
• Billing Data: Processed securely via our Merchant of Record, Lemon Squeezy. Landager does not natively store your full credit card numbers.
• Communications: Support tickets, feedback, and customer service inquiries.

B. Information you input into the platform (Processor Data)

• Property Data: Property addresses, unit configurations, and property photos.
• Tenant Data (PII): Tenant names, email addresses, phone numbers, and emergency contact details.
• Financial & Contractual Data: Lease agreements (PDFs), rent amounts, payment records, expense receipts, and maintenance requests.

C. Information collected automatically

• Device & Usage Data (Analytics): Aħna nkejlu t-traffiku tas-sit bl-analitika tagħna stess mingħajr cookies, li nospitaw aħna stess. Tirreġistra l-paġni miżjura, il-paġna ta' referenza, it-tip ta' browser u apparat, u settings bħal-lingwa u ż-żona tal-ħin, mingħajr cookies u mingħajr ma nsegwuk fuq siti oħra. Ma nużawx Google Analytics jew trackers tar-reklamar.
• Audit Log: To keep accounts secure and to show you what happened in yours, we record sign-ins (including failed attempts), changes to your account and records (with the values before and after), billing events, data exports, emails we send, and every action our staff take on your account. Each entry has the time, who did it, and the IP address and browser it came from. Passwords, sign-in codes and full ID numbers are never recorded. You can see your account's entries in Settings → Activity, and they are included in your data export.
• Essential Cookies & Local Storage: We use strictly necessary cookies/tokens required for authentication (Auth.js) and local storage to save your UI preferences and language selection. Because these are required to provide the core service, they cannot be disabled.

4. AI Features & Data Processing

Landager includes an AI chat assistant. When you send it a message, your message and the portfolio details needed to answer it (for example property names, tenant names and amounts due) are sent to our AI provider, Google (Gemini API), to generate the answer. Tenant email addresses and phone numbers are not sent.

5. How We Use Your Information

We use the collected information strictly to operate and improve our SaaS product:

• To provide, secure, and maintain the Landager dashboard.
• To process subscriptions and send transactional emails (receipts, password resets).
• To authenticate users and prevent fraudulent activity.
• To power AI Chat insights based on your portfolio data.
• To respond to your support requests and legal obligations.

6. Data Sharing & Subprocessors

We do not sell, rent, or trade your personal or tenant data. We share information only with the service providers ("subprocessors") we need to run Landager:

• Hetzner Online GmbH (Germany): servers and the database that hold your account, property, tenant and financial data.
• Cloudflare: DNS and network protection, private storage for uploaded files (R2), bot protection on public forms (Turnstile), and access control for our admin tools.
• Resend: delivery of transactional emails such as sign-in codes, reminders and receipts.
• Google: the Gemini API for AI chat, Google Sign-In if you choose it, and off-site storage (Google Drive) for database backups, which are encrypted before they leave our servers.
• Lemon Squeezy: payment processing and subscription management as our merchant of record.

Each provider processes data under its own data processing terms. Website analytics are cookieless and run on our own infrastructure; no third-party analytics or advertising service receives your data. Our Data Processing Agreement for customers is published at landager.com/dpa.

7. Data Retention & Security

Security: All connections use HTTPS/TLS. Uploaded files are stored privately and opened only through short-lived signed links. Passwords are hashed with bcrypt. Database backups are encrypted and copied off-site every day. Our admin tools sit behind an access gate (Cloudflare Access) and require two-factor authentication. More detail is on our security page.

Retention: We keep your account data for as long as your account is active. When you delete your account (Settings → Data & privacy, or by emailing us), it is erased 30 days later, including every uploaded file; you can cancel within those 30 days. Billing records that we must keep for tax or legal reasons are kept by our payment provider. Backups age out on their normal rotation schedule. We also delete on a schedule: screening applications from applicants who did not become tenants, with their documents, 12 months after the decision.

Audit log: Audit log entries are kept online for 24 months, then moved to archive storage and deleted once they are 7 years old. They are kept for that period even after an account is deleted, because they are our record of who did what, which we need for security, fraud prevention and legal claims (our legitimate interest). They contain account identifiers, names of records, the values that changed, IP addresses and browser details; they do not contain your documents or files. Nobody, including us, can edit or remove an individual entry.

8. Compliance Alert Subscriptions

On our property compliance documentation pages, we offer optional email alert subscriptions to notify you when landlord-tenant laws change in your selected jurisdiction.

Data Collected: When you subscribe, we collect your email address, selected country and region, content language preference, IP address (for abuse prevention and legal basis evidence), and the source of subscription (popup or inline form).

Legal Basis: Explicit opt-in consent (Article 6(1)(a) GDPR). The consent checkbox is unchecked by default and must be actively selected.

Double Opt-In (EU/EEA/UK): If your selected jurisdiction is within the EU, EEA, or United Kingdom, we require email confirmation (double opt-in) before activating your subscription. A verification email will be sent to the address you provide.

How We Use This Data: Solely to email you about updates to the compliance guides for your selected jurisdiction. We do not use this data for marketing or advertising, and we do not share it with third parties other than our email delivery provider.

Unsubscribe: Chaque e-mail d'alerte comprend un lien de désabonnement en un clic. Vous pouvez également nous contacter à [email protected] pour demander la suppression.

Retention: Subscription data is kept until you unsubscribe. When you unsubscribe, your record is marked inactive and no further emails are sent; email us to have it deleted entirely.

9. International Data Transfers

Our servers are in Germany (European Union). Some of the providers listed above (Google, Cloudflare, Resend and Lemon Squeezy) may process data in the United States and other countries. Where data leaves the EEA or UK, those providers rely on Standard Contractual Clauses or another approved transfer mechanism.

10. Your Privacy Rights (GDPR & CCPA/CPRA)

Depending on where you reside, you possess specific rights regarding your personal data:

• Right to Access: You can view all your data within the dashboard.
• Right to Rectification: You can edit and update any inaccurate data.
• Right to Erasure ("Right to be Forgotten"): Tista' titlobna nħassru l-kont tiegħek u d-data kollha tiegħu billi tibgħat email lil [email protected]. Aħna nlestu t-tħassir fi żmien 30 jum.
• Right to Data Portability: You may export reports representing your data.
• CCPA Specifics: California residents have the right to know categories of data collected and request deletion. Landager does not sell or share your personal information for targeted cross-context behavioral advertising.

If a tenant contacts us directly to exercise their rights regarding data you uploaded, we will forward that request to you, the Data Controller, for resolution.

11. Contact Us & Data Protection

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to contact our Data Protection Officer, please email us directly at:

[email protected]