Trust and transparency
Privacy
This policy explains the data RentPal processes to manage early access, accounts, rental profiles, messaging, organizations, support and platform security.
Last updated: 24/09/2026
Controller and contact
The data controller is Sumeria Global, S.L.U. — NIF B93980084 — C/ Bolos, 15, 17800 Olot (Girona). For any privacy question or to exercise your rights, email [email protected].
Data we process
We process email, credentials managed by Supabase, Google identifiers if you choose that sign-in method, role, display name, phone, language, notification preferences and legal acceptance. A tenant profile may include name, age, photo, biography, employment, budget, household, pets, move-in date and drawn zones. We also process saved profiles, views, source and referrer, conversations and messages, reports, support requests (name, email, subject and message), role changes, your referral code and, if you joined through a referral, who referred you, and organization, membership, note and tag data. For security we may process IP address, user agent, a device identifier, hashed identifiers, ban-attempt records and audit logs. For early access we store email, role interest and source page.
Why we use data
We use it to create and authenticate accounts; publish, search and review profiles; display demand and zones; provide saving, messaging and team tools; send welcome, profile-status, new-message and early-access emails; answer support; measure visits and aggregate use; prevent fraud, spam, harassment and ban evasion; moderate content; and comply with or defend legal obligations and claims.
Legal bases
Account registration, profiles, messaging and organization features are processed to provide the requested service or take pre-contractual steps (GDPR art. 6(1)(b)). Early access and optional notices rely on consent (art. 6(1)(a)), which you may withdraw. Security, technical logs, moderation, abuse prevention and cookieless aggregate analytics rely on our legitimate interests (art. 6(1)(f)). Legal obligations rely on art. 6(1)(c). Voluntarily publishing a phone number or email for direct contact requires your express opt-in.
Visibility and recipients inside RentPal
Active profiles show visitors and landlords the published rental information, including the photo and approximate zones. Direct-contact phone or email details are disclosed only when the profile owner enables that option. Conversation participants see their messages. Members of an authorized organization can see its pipeline, notes and tags. Administrators access private data, reports and moderation signals only as needed to operate and protect the service.
Service providers
We use Hetzner in Germany to host the application and backups; Cloudflare for proxying, CDN and protection; Supabase for authentication, database, realtime, functions and photos; Resend for transactional email; Telegram for support and error alerts; self-hosted Plausible at analytics.buenbarrio.com for cookieless aggregate analytics; and OpenFreeMap for maps. Google is involved only if you choose Google sign-in. If you open a WhatsApp, email or social link to contact or share, the chosen service receives the data you decide to send under its own terms.
International transfers
Hetzner hosts the application server in Germany and the Supabase database is configured in the EU. Some providers, including Cloudflare, Supabase, Resend, Google, Telegram or Meta/WhatsApp, may be established in or allow access from outside the EEA. Where required, transfers rely on an adequacy decision, including the EU-US Data Privacy Framework for participating entities, or the European Commission's Standard Contractual Clauses and supplementary measures.
Retention
We keep account, profile, message and organization data while the account is active. When you delete your account, we hide the profile, close your conversations, anonymize account identifiers and delete photos; messages you already sent remain in those closed conversations. Residual profile content and zones are anonymized or deleted by a cleanup that runs 90 days after deletion. Hashes of your email, phone or device are kept for 90 days so that a new profile from the same person can be flagged for manual review (they do not block re-registration) and are deleted in that same 90-day cleanup; ban-evasion attempt logs are deleted after 180 days. Records of moderation bans and the archived profiles linked to them are kept for security and to handle claims, including after a ban is lifted. Early-access sign-ups are no longer collected; existing entries are kept until you ask us to delete them. Support, audit, aggregate analytics and evidence records are kept as long as needed for their purpose and applicable legal periods.
Automated checks
At registration we compare hashes of your email, phone, device and network with active bans and with accounts deleted in the last 90 days. A match with an active ban can automatically prevent registration; a match with a recently deleted account or other unusual activity only flags the case for human review. Profiles are also compared with patterns from banned accounts and moderated before publication. You may request an explanation, human review and an opportunity to state your case by emailing [email protected].
Your rights
You may request access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time without affecting earlier processing. Email [email protected]; we may request the minimum information needed to verify your identity. You may also complain to the Spanish Data Protection Agency at www.aepd.es.