Effective date: 01.12.2025

This Privacy Policy explains how RentsApp (“Service”, “Platform”) collects, processes, stores, and protects personal data. The Service is operated by:

WIKTOR WINIARSKI NEX DEVELOPMENT
42A, 96-200 Niwna, Poland
NIP (Tax ID): 8351622346
Email: info @ rentsapp.eu

By using the Platform, you consent to the practices described in this Privacy Policy.

1. Data Controller

The data controller (“Administrator”) responsible for processing your personal data is: WIKTOR WINIARSKI NEX DEVELOPMENT.

For all inquiries regarding data protection, please contact: info @ rentsapp.eu

2. Categories of Personal Data We Collect

2.1. Account Data

• — First and last name
• — Email address
• — Password (encrypted)
• — Business details (company name, NIP/VAT, address)

2.2. Data Entered by the User into the Platform

• — Tenant data (names, contact details, rental records)
• — Property information
• — Lease details, documents, notes
• — Payment history and rent tracking data

These data are controlled by the User, and RentsApp acts as a data processor under GDPR Article 28 for this category.

2.3. Technical and Usage Data

• — IP address
• — Browser type and version
• — Operating system
• — Log files and timestamps
• — Session identifiers

2.4. Payment Data

Payment-related data is processed exclusively by Stripe Payments Europe Ltd. The Platform does not store card numbers or sensitive payment data.

3. Legal Bases for Processing

We process personal data based on the following legal grounds:

• — Performance of a contract (Art. 6(1)(b) GDPR): to provide access to RentsApp.
• — Legitimate interest (Art. 6(1)(f) GDPR): security, analytics, fraud prevention.
• — Legal obligation (Art. 6(1)(c) GDPR): invoicing, taxes, accounting.
• — Consent (Art. 6(1)(a) GDPR): cookies, marketing communications (if enabled).

4. Purposes of Data Processing

• — Creating and managing User Accounts
• — Providing access to the Platform and its features
• — Hosting and storing User data
• — Processing payments and subscriptions (via Stripe)
• — Ensuring security and fraud prevention
• — Providing technical support
• — Generating anonymized statistics to improve the Platform

5. Data Hosting (Supabase)

All Platform data—including User data and tenant/property data—are stored using the infrastructure provided by Supabase, Inc..

The data is hosted exclusively in the EU Central (Frankfurt) region, ensuring compliance with GDPR data localization requirements.

Supabase acts as a data processor and processes data only on documented instructions from the Administrator.

6. Payment Processing (Stripe)

Payment data is handled by:
Stripe Payments Europe Ltd.

Stripe acts as an independent data controller for payment information. RentsApp does not store credit card numbers or other sensitive payment details.

7. Sharing Personal Data

We may share data with the following categories of recipients:

• — Hosting and cloud service providers (Supabase)
• — Payment processor (Stripe)
• — Accounting and tax service providers
• — Legal or regulatory authorities (only when required by law)
• — Email and communication tools

We never sell personal data to third parties.

8. Data Retention

We retain personal data for the following periods:

• — Account data: for the duration of the subscription + legal retention period
• — Tenant/property data: until deleted by the User
• — Payment and invoicing data: minimum 5 years (legal requirement)
• — Technical logs: up to 12 months

9. User Rights (GDPR)

You have the right to:

• — Access your data
• — Correct inaccurate data
• — Request deletion (“right to be forgotten”)
• — Restrict processing
• — Data portability
• — Object to processing
• — Withdraw consent at any time

To exercise your rights, contact: info@rentsapp.eu

10. Cookies

The Platform uses cookies and similar technologies. Details are provided in the separate Cookie Policy.

11. Security Measures

We implement organizational and technical safeguards, including:

• — Encryption (HTTPS/SSL)
• — Secure password hashing
• — Access control and authentication
• — Encrypted storage of data at rest and in transit
• — Regular backups

12. Data Transfers Outside the EU

Data processed via Supabase remains within the Frankfurt (EU) region. If any data is transferred outside the EEA (e.g., for email delivery or analytics), it is protected using:

• — Standard Contractual Clauses (SCC)
• — Additional security measures where required

13. Children’s Data

The Platform is not intended for individuals under 16. We do not knowingly collect personal data of children.

14. Changes to the Privacy Policy

The Administrator may update this Privacy Policy. Updates will be published within the Platform, and continued use of the Service constitutes acceptance of the revised Policy.

15. Contact

For questions, requests, or complaints regarding personal data, contact:
Email: info @ rentsapp.eu