Privacy Policy

2. Our Role (Data Controller vs. Data Processor)

Under the General Data Protection Regulation (GDPR) and similar global privacy frameworks, the distinction between a Data Controller and a Data Processor is crucial:

• Landager as a Data Controller: We act as a Data Controller for the direct account information you (the landlord/user) provide to us to create your account and bill you for our services.
• Landager as a Data Processor: You act as the Data Controller for all tenant and property data you input into our platform. Landager acts strictly as a Data Processor for this information. You decide what tenant data to collect, and we process it only according to your instructions (by storing it and surfacing it in your dashboard).

Landlord Responsibility: As the Data Controller of your tenants' data, you are legally responsible for ensuring you have a lawful basis (such as consent or legitimate interest) to collect their Personal Identifiable Information (PII) and enter it into the Landager platform.

3. Information We Collect

We collect information dynamically based on how you use our platform:

A. Information you provide to us directly (Controller Data)

• Account Data: Name, email address, a password hash (bcrypt), and your profile image if you sign in with Google.
• Billing Data: Processed securely via our Merchant of Record, Lemon Squeezy. Landager does not natively store your full credit card numbers.
• Communications: Support tickets, feedback, and customer service inquiries.

B. Information you input into the platform (Processor Data)

• Property Data: Property addresses, unit configurations, and property photos.
• Tenant Data (PII): Tenant names, email addresses, phone numbers, and emergency contact details.
• Financial & Contractual Data: Lease agreements (PDFs), rent amounts, payment records, expense receipts, and maintenance requests.

C. Information collected automatically

• Device & Usage Data (Analytics): We measure site traffic with our own cookieless analytics, which we host ourselves. It records the pages visited, the referring page, browser and device type, and settings such as language and time zone, without cookies and without following you across other sites. We do not use Google Analytics or advertising trackers.
• Essential Cookies & Local Storage: We use strictly necessary cookies/tokens required for authentication (Auth.js) and local storage to save your UI preferences and language selection. Because these are required to provide the core service, they cannot be disabled.

4. AI Features & Data Processing

Landager includes an AI chat assistant. When you send it a message, your message and the portfolio details needed to answer it (for example property names, tenant names and amounts due) are sent to our AI provider, Google (Gemini API), to generate the answer. Tenant email addresses and phone numbers are not sent.

5. How We Use Your Information

We use the collected information strictly to operate and improve our SaaS product:

• To provide, secure, and maintain the Landager dashboard.
• To process subscriptions and send transactional emails (receipts, password resets).
• To authenticate users and prevent fraudulent activity.
• To power AI Chat insights based on your portfolio data.
• To respond to your support requests and legal obligations.

6. Data Sharing & Subprocessors

We do not sell, rent, or trade your personal or tenant data. We share information only with the service providers ("subprocessors") we need to run Landager:

• Hetzner Online GmbH (Germany): servers and the database that hold your account, property, tenant and financial data.
• Cloudflare: DNS and network protection, private storage for uploaded files (R2), bot protection on public forms (Turnstile), and access control for our admin tools.
• Resend: delivery of transactional emails such as sign-in codes, reminders and receipts.
• Google: the Gemini API for AI chat, Google Sign-In if you choose it, and off-site storage (Google Drive) for database backups, which are encrypted before they leave our servers.
• Lemon Squeezy: payment processing and subscription management as our merchant of record.

Each provider processes data under its own data processing terms. Website analytics are cookieless and run on our own infrastructure; no third-party analytics or advertising service receives your data. Our Data Processing Agreement for customers is published at landager.com/dpa.

7. Data Retention & Security

Security: All connections use HTTPS/TLS. Uploaded files are stored privately and opened only through short-lived signed links. Passwords are hashed with bcrypt. Database backups are encrypted and copied off-site every day. Our admin tools sit behind an access gate (Cloudflare Access) and require two-factor authentication. More detail is on our security page.

Retention: We keep your account data for as long as your account is active. When you delete your account (Settings → Data & privacy, or by emailing us), it is erased 30 days later, including every uploaded file; you can cancel within those 30 days. Billing records that we must keep for tax or legal reasons are kept by our payment provider. Backups age out on their normal rotation schedule. We also delete on a schedule: sign-in history (IP address and browser) after 90 days, and screening applications from applicants who did not become tenants, with their documents, 12 months after the decision.

8. Compliance Alert Subscriptions

On our property compliance documentation pages, we offer optional email alert subscriptions to notify you when landlord-tenant laws change in your selected jurisdiction.

Data Collected: When you subscribe, we collect your email address, selected country and region, content language preference, IP address (for abuse prevention and legal basis evidence), and the source of subscription (popup or inline form).

Legal Basis: Explicit opt-in consent (Article 6(1)(a) GDPR). The consent checkbox is unchecked by default and must be actively selected.

Double Opt-In (EU/EEA/UK): If your selected jurisdiction is within the EU, EEA, or United Kingdom, we require email confirmation (double opt-in) before activating your subscription. A verification email will be sent to the address you provide.

How We Use This Data: Solely to email you about updates to the compliance guides for your selected jurisdiction. We do not use this data for marketing or advertising, and we do not share it with third parties other than our email delivery provider.

Unsubscribe: Every alert email includes a one-click unsubscribe link. You may also contact us at [email protected] to request removal.

Retention: Subscription data is kept until you unsubscribe. When you unsubscribe, your record is marked inactive and no further emails are sent; email us to have it deleted entirely.

9. International Data Transfers

Our servers are in Germany (European Union). Some of the providers listed above (Google, Cloudflare, Resend and Lemon Squeezy) may process data in the United States and other countries. Where data leaves the EEA or UK, those providers rely on Standard Contractual Clauses or another approved transfer mechanism.

10. Your Privacy Rights (GDPR & CCPA/CPRA)

Depending on where you reside, you possess specific rights regarding your personal data:

• Right to Access: You can view all your data within the dashboard.
• Right to Rectification: You can edit and update any inaccurate data.
• Right to Erasure ("Right to be Forgotten"): You can delete your account yourself in Settings → Data & privacy, or by emailing [email protected]. The account, all of its data and every uploaded file are erased 30 days after you confirm; you can cancel within that time.
• Right to Data Portability: You can download all of your data at any time in Settings → Data & privacy: a ZIP with JSON and CSV files and every file you uploaded.
• CCPA Specifics: California residents have the right to know categories of data collected and request deletion. Landager does not sell or share your personal information for targeted cross-context behavioral advertising.

If a tenant contacts us directly to exercise their rights regarding data you uploaded, we will forward that request to you, the Data Controller, for resolution.

11. Contact Us & Data Protection

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to contact our Data Protection Officer, please email us directly at:

[email protected]