Privacy policy

Who controls the data

The system is used by a landlord or property manager (the client). The client is the controller of their tenants' data. AxiRent is a processor: we handle data on the client's instructions and only to make the product work.

What we handle

Account data: name, email, role, language and format preferences, and a cryptographic hash of the password (we never store the password itself and cannot recover it).

Property and tenant data: addresses, tenancy terms, tenant contacts, meter readings, invoices and payment states.

Content you upload: property photos, handover files, fault photos and videos, tenancy documents.

Technical records: an audit log of significant actions, the IP address on security-relevant events, and error logs.

At sign-up and sign-in: the IP address, a browser fingerprint (a summary of the browser's and screen's properties) and a random device mark in a cookie. They are used only to protect the service from abuse, for example so that a blocked person cannot open a new account. Legal basis: legitimate interest (GDPR Article 6(1)(f)).

On the sign-up form, Cloudflare Turnstile (Cloudflare, Inc.) checks that a person, not an automated program, is filling it in. For that it receives technical signals: the IP address, the TLS fingerprint, the browser's User-Agent and our site's address. Cloudflare processes them on our behalf to tell people from bots, and as an independent controller to improve its check (Cloudflare Turnstile privacy notice: https://www.cloudflare.com/turnstile-privacy-policy/). Legal basis: the same legitimate interest in protecting the service.

Where it is stored

The database is Supabase (PostgreSQL) in an EU region. Files live in Supabase Storage or Cloudflare R2 and are reachable only through short-lived signed URLs; nothing is publicly linkable.

The application runs on Vercel. Email is sent through our email delivery provider.

When data leaves the system

By email. Invoices, reminders and notices, to the addresses the client specifies.

AI features (meter-photo reading, invoice import, the help assistant) send only the content that action needs to the Google Gemini API. The help assistant answers from the help articles and a short summary of your own account (for example how many properties, unpaid invoices or expiring tenancies there are), so that it can answer about your case and not a generic one. It never sees another client's data. Conversations with the assistant are stored, and our support team may review them to see where the assistant did not help and to follow up in person. When a user is deleted, their conversations with the assistant stay without the name or email address: only what was written, so that we can improve the answers.

Translating a problem chat sends only the text being translated to the same AI model the help assistant uses. The translation is stored with that message and deleted with it; the original is never changed.

Voice clips (the microphone in the assistant, the extension and the tradesperson page) and the sound of handover and job videos are turned into text by Groq (Whisper), or by OpenAI when Groq is unavailable. Only that recording is sent. We do not keep a microphone clip after it is transcribed.

When you ask for a person from our support team, your conversation with the assistant is passed to our team through Slack.

We do not sell or rent the data in the app, and we use it for advertising only with your consent, as described under “Website visitors”. The app has no advertising trackers. Traffic is measured with Vercel Web Analytics - cookieless, no device fingerprinting, aggregated page statistics only (see the cookie declaration). We also count how often and how long each screen of the app is open: in total by day and role, and for the landlord side the time of each account by hour and screen. For people on the landlord side (not tenants) we also record visits: when the person started and stopped using the app (to the minute), how long it was open and in which screens the most. We do not identify the device. This helps us understand how the app is used and offer help in time. This data is kept for 13 months.

Website visitors: analytics and advertising, only with consent

On the axirent.com website, while advertising campaigns run, we may use Google Analytics 4, Google Ads and the Meta Pixel. They are switched on only when you agree in the consent banner. Until you do, no request is sent to Google or Meta.

What they receive: which pages of the website you opened, where you came from (for example, which ad), your browser, device, approximate location from your IP address, and whether you clicked the sign-up link. The content of the app (properties, tenants, invoices) is never passed to them.

If you came from a Google or Meta ad and agreed to advertising cookies, after you sign up we tell that ad platform so: the ad click's identifier, the date you signed up, and whether the account started using the service or paid for it (once paid, the amount too). We do not pass your name, email or any other data from the app. This is how we measure which ads bring customers. The click identifier is kept with the account and deleted with it. If you want us to stop reporting on your account, write to us at the email at the bottom of this page.

Legal basis: your consent (GDPR Article 6(1)(a)). Recipients: Google Ireland Limited and Meta Platforms Ireland Limited. Data may be transferred to the United States under the EU-US Data Privacy Framework. For the data collected through the Meta Pixel, we are joint controllers with Meta.

Google Analytics data is kept for up to 14 months. How long each cookie lasts is listed in the cookie declaration.

You can withdraw consent at any time, as easily as you gave it: click “Cookie settings” at the bottom of the website. Withdrawing deletes these tags' cookies.

Axibot: the question box on the website

A question typed into “Ask Axibot” on the website, and Axibot's answer, are kept for 30 days so that we can improve the answers and the help articles. Nothing that shows who asked is kept with them: no IP address, no account, no cookie. Please do not type personal data into this box.

To prepare the answer, the question is sent to the Google Gemini API, as the help assistant's questions are. Legal basis: our legitimate interest in improving the service (GDPR Article 6(1)(f)).

How long we keep it

Accounting data (invoices, readings, tenancies) is kept while the client uses the system and for as long as accounting and tax law requires.

Copies of sent emails (without their links and sign-in codes) are kept for 90 days, so we can answer whether a letter went out, and then deleted automatically. Only the record that a message was sent remains.

Audit-log and API-usage rows are deleted automatically after 18 months.

Your rights

You may access, correct, export and request deletion of your data. A complete export (Settings → Data export) produces your organisation's full contents as an .xlsx workbook.

A tenant should contact their landlord first; the landlord is the controller. If a request is for us as processor, write to the address at the foot of this page and we will act within 30 days.

Security

Passwords are stored as bcrypt hashes. Sign-in is rate limited: five failed attempts lock the account for 15 minutes. Two-factor authentication is available by authenticator app or emailed code.

Every query is bounded by organisation. One client's data is not reachable from another. Files are served only through short-lived signed URLs.

No system is perfectly secure. If you find a vulnerability, tell us; we will respond and fix it.

Cookies

The app uses only strictly necessary cookies, which is why it shows no consent banner: necessary cookies do not require one. On the axirent.com website, analytics and advertising cookies are used only with your consent. The cookie declaration lists every cookie, with its purpose and how long it lasts.