Privacy Notice

Revision dated 19.08.2026.

This Privacy Notice explains how IziRento at https://izirento.com handles personal data. Provider details and the current pre-launch status are stated in the Legal Notice. Contact: [email protected].

This Notice must be read with the Terms of Service, the Data Processing Addendum (“DPA”), Cookie Notice and Sub-processors page.

1. Two different roles — read this first

1.1. Customer Content role. When an Owner uses IziRento to store information about properties, leases, tenants, applicants, payments, meters, inspections or documents, that Owner is the data controller of that personal data. We process it only as a data processor / service provider to provide the software, on the Owner’s instructions. We do not decide why the Owner collects tenant data, and we do not use Customer Content for our own marketing.

1.2. Account & website role. For data about you as a user of the website/account (registration, login, security, support, cookies/analytics with consent, subscription records), we act as an independent controller.

1.3. The Customer—not IziRento—decides what tenant/applicant data to collect, why to collect it, whom to invite, how long to keep it, and what decisions to make. Customer is responsible for privacy notices, lawful bases, accuracy, minimisation, retention and Data Subject requests.

1.4. We cannot lawfully disclaim every privacy obligation: as Processor we remain responsible for our direct processor duties and security obligations; as Controller we remain responsible for Account Data. The contractual allocation does not remove rights that Data Subjects have under mandatory law.

2. Data we process as controller (Account & website)

Identifiers and profile: name/display name, email, language/region preferences, avatar if provided by an identity provider.
Authentication: session tokens, identity-provider identifiers (for example Google, Apple or Microsoft sign-in, where offered), security events and login metadata.
Commercial: selected plan, entitlement and subscription status. Paid services and a payment provider are not enabled during pre-launch; if enabled later, the provider will handle payment-card data under its own notice.
Technical and security: IP address, timestamps, device/browser/OS, user agent, approximate country/city derived from network headers, login method, session and security events, VPN/proxy/hosting indicators, diagnostic and audit logs.
Communications and feedback: support messages, survey score and free-text feedback, notification preferences and delivery identifiers.
Cookie and similar technology data as described in the Cookie Policy.

3. Customer Content we process as processor

3.1. Categories depend entirely on what the Owner (or a Tenant User acting within Owner-granted access) enters or imports. This may include names, contacts, addresses, lease terms, payment and arrears records, utility bills, meter readings, inspection media, repair requests, identity or income documents, and free-text notes.

3.2. Customer Content may contain high-risk data such as identity documents, payment evidence, photographs of homes, communications, household information or data about children. The Service does not require unrestricted submission of such data. Customer must ensure it is strictly necessary and lawful and must not place secrets or financial credentials in free-text fields.

3.3. We do not independently verify Customer Content and do not use it for advertising, tenant scoring or our own unrelated purposes.

3.4. Processor purposes: hosting, organising, searching, displaying and transmitting data to Customer-authorised users; notifications; support; backup; security; and optional import/OCR/AI processing deliberately initiated by Customer.

4. Sources of Account Data

Directly from you when you create or use an account, contact support, set preferences or provide feedback.
From a Customer that invites you as a manager or Tenant User.
From an identity provider you choose, where social sign-in is offered.
Automatically from your browser, device, network, our CDN/security provider and Service logs.
From service providers that help us prevent abuse, deliver messages or diagnose errors.

5. Purposes and legal bases for Account Data

Create, authenticate and administer accounts; provide requested features — performance of contract or steps requested before contract.
Operate pre-launch testing, diagnose errors and improve reliability — our legitimate interests, balanced against user rights.
Protect users, prevent fraud and abuse, investigate security events and enforce Terms — our legitimate interests and, where applicable, legal obligation.
Send essential service, security, invitation and support communications — performance of contract and legitimate interests.
Manage future subscriptions and accounting — contract and legal obligation, only after commercial launch.
Optional analytics or marketing technologies — consent where required; they remain off until the relevant choice is made.
Respond to lawful requests, establish or defend legal claims, and comply with law — legal obligation and legitimate interests.
Other purposes disclosed at collection; where a new purpose is incompatible, we will obtain a new lawful basis.

6. Recipients and disclosures

6.1. Infrastructure and vendors. We disclose only what is reasonably necessary to providers listed on the Sub-processors page, subject to appropriate contractual restrictions.

6.2. Customer-authorised users. Owners control access by managers, Tenant Users and other invitees. Data visible through that access is disclosed on Owner's instructions.

6.3. Customer-authorised third parties. A connected storage, identity, communications or other service receives data only when the relevant connection or action is authorised. The third party's terms and privacy notice apply.

6.4. Legal and safety. We may disclose data where reasonably necessary to comply with law or binding process, enforce agreements, investigate abuse, protect rights and safety, or establish and defend claims.

6.5. Corporate transaction. Data may transfer to a successor in a merger, financing, reorganisation or asset sale, subject to confidentiality and applicable notice requirements.

6.6. We do not sell personal data for money. We do not share personal data for cross-context behavioural advertising, and do not use Customer Content for advertising.

7. International transfers

Core production infrastructure is intended to be hosted in Germany / the European Union. CDN/security traffic may be processed through a global edge network. Optional providers may process data in other countries identified on the Sub-processors page.

Where EU/UK personal data is transferred to a country without adequacy status, we use an available lawful mechanism such as the EU Standard Contractual Clauses, the UK Addendum and supplementary measures where required. Customer transfers are addressed in the DPA.

8. Retention

Account and profile data — while the account is active, then normally up to 30 days after verified deletion, except data needed for legal claims, fraud prevention or mandatory records.
Customer Content — until Customer deletes it or the account ends; Customer controls its business retention schedule. Residual access-restricted backups may persist until overwritten under the configured backup cycle or longer under a legal hold. A maximum production backup period will be published before commercial launch.
Login history — up to the most recent 40 successful login events per account in the current implementation; particular security records may be retained longer where needed to investigate an incident, prevent abuse or establish a legal claim.
Support correspondence — normally up to 24 months after closure of the request, unless needed for an ongoing relationship or claim.
Feedback survey records — normally up to 24 months or until account deletion, whichever is earlier, unless aggregated/anonymised.
Cookie choices and local preferences — as stated in the Cookie Notice or until browser storage is cleared.
Legal and transaction records — for the period required by applicable tax, accounting, sanctions or limitation laws after commercial launch.

9. Security and incident response

We use measures designed for the nature and risks of a multi-tenant SaaS, including role-based access, tenant isolation, encryption in transit, restricted production access, logging, backups and incident-response procedures. The DPA describes processor commitments.

No internet service is completely secure. Customers must protect credentials and devices, review access lists, verify invite recipients and keep independent exports of critical records. Report suspected security incidents to [email protected].

10. Your privacy rights

10.1. Depending on your jurisdiction and our role, you may have rights to know/access, correct, delete, restrict or object, receive portable data, withdraw consent, opt out of certain uses, and appeal a refused request.

10.2. For Account Data controlled by us, email [email protected]. We may verify identity and authority, request clarification, or deny/limit a request where law permits. Authorised agents must provide proof of authority.

10.3. For tenant/applicant information entered by an Owner, contact that Owner first. We are Processor and ordinarily cannot change or disclose Customer Content without Customer instructions. We will support the Customer as required by the DPA.

10.4. EEA/UK users may complain to their local supervisory authority. UAE residents may exercise rights available under the UAE PDPL. US residents may use the state-specific rights described below. We do not discriminate for exercising privacy rights.

11. United States notice at collection

In the preceding 12 months, the categories we may collect correspond to identifiers; customer records; commercial/account information; internet or electronic network activity; approximate geolocation; professional/role information; user-generated audio/visual content; and inferences limited to security or product diagnostics. Sources, purposes, recipients and retention are described in Sections 2–8.

We do not Sell personal information and do not Share it for cross-context behavioural advertising. We do not knowingly Sell or Share personal information of persons under 16. If these practices change, we will update this Notice and provide legally required opt-outs, including recognition of Global Privacy Control where applicable.

Sensitive personal information in Customer Content is controlled by the Customer. We do not use or disclose sensitive Account Data to infer characteristics or for purposes that trigger a right to limit under California law.

12. AI, OCR and automated decision-making

Optional AI/OCR features process only inputs deliberately submitted to them and return assistive suggestions. Providers and locations are identified on the Sub-processors page. We do not use Customer Content to train our own general-purpose model.

We do not make solely automated decisions about tenants or applicants that produce legal or similarly significant effects. Customers must verify outputs and remain solely responsible for screening, tenancy and property decisions.

13. Children

The Service is for adults and business users and is not directed to children. We do not knowingly create accounts for children. An Owner may include limited information about household members only where necessary and lawful for tenancy administration; the Owner remains responsible for the lawful basis and notice. Contact [email protected] if you believe a child created an account or data was submitted unlawfully.

14. Third-party services and links

Third-party websites, connected accounts and services operate under their own notices. Customer should review them before authorising access. We are not responsible for a third party's independent practices, but remain responsible for sub-processors we engage to the extent required by law and the DPA.

15. Changes and contact

We may update this Notice to reflect product, provider or legal changes. We will change the revision date and provide additional notice for material changes where required.

Controller contact for Account Data and processor/privacy contact for Customer Personal Data: [email protected]. Current provider identity: https://izirento.com/legal-notice.

Because the operating entity has not yet been incorporated, paid services are not offered. The Legal Notice and this Privacy Notice must be updated with complete Controller identity and address before commercial launch.