Privacy Policy

Last updated: 16 August 2026

This policy explains how HuurFlow (huurflow.be) handles personal data under the EU General Data Protection Regulation (GDPR). HuurFlow is operated from Antwerp, Belgium. Contact for all privacy matters: idoshimoni@gmail.com.

1. Two roles: controller and processor

For your account data (name, email, billing details, usage), HuurFlow is the data controller. For the data you enter about your properties and tenants (names, contact details, lease and payment records, documents), you are the controller and HuurFlow acts as your processor: we process that data only on your instructions, to provide the service, and this section serves as the core of our data processing commitment to you.

2. What we collect and why

Account data: email, name, and authentication data, to operate your account (legal basis: contract). Billing data: subscription status and invoicing details, processed via Stripe (legal basis: contract and legal obligations). Content data: the property, tenant, lease, financial, and document records you create (processed on your instructions). Technical data: logs needed for security and reliability (legal basis: legitimate interest). We do not sell personal data and we do not use your data for advertising.

3. Where data lives and who touches it

Application data is stored with Supabase in the EU (AWS eu-west-1, Ireland). Payments are processed by Stripe; HuurFlow never stores card numbers. Hosting is provided by Vercel. These subprocessors are bound by their own GDPR commitments and data processing agreements. We share data with no one else, except where the law requires it.

4. Security

Data is isolated per account with database-level row security, encrypted in transit, and encrypted at rest by our infrastructure providers. Access to production systems is limited to what is needed to operate the service.

5. Retention

Your data is kept while your account is active. After account deletion we remove your data within 30 days, except where longer retention is legally required (for example invoicing records). Backups roll off on a fixed schedule.

6. Your rights

You can access, correct, export, or delete your personal data, object to or restrict processing, and withdraw consent where processing is based on it. Email idoshimoni@gmail.com and we will respond within 30 days. If you are a tenant whose data was entered by a landlord, we will refer your request to that landlord as controller and assist them in fulfilling it. You can lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

7. Cookies

HuurFlow uses only functional cookies needed to keep you signed in. No advertising or cross-site tracking cookies are used.

8. Changes

We will announce material changes to this policy in the app or by email before they take effect.