Privacy Policy

1. Data we process

Account data: name, email address, password (stored only as a salted hash), optional phone number, account type (tenant, owner, property manager) and, for property managers, company name.

Profile data you choose to add: bio, occupation, languages spoken.

Listing data provided by advertisers: property details, photos, address and pricing.

Verification documents uploaded by advertisers: identity document, proof of ownership, rental licence, energy certificate. These may contain sensitive identifiers (e.g. ID-card numbers) and are used solely to verify listings.

Communication and booking data: inquiries, reservation requests, stay dates, agreed rent, and the resulting fee calculations.

Technical data: server logs (IP address, timestamps, requested pages) generated when you use the Platform, kept for security and troubleshooting.

2. Purposes and legal bases

We process personal data:

• to provide the Platform, your account, listings, inquiries and reservations — performance of a contract (Art. 6(1)(b) GDPR);
• to verify advertisers and listings and prevent fraud — legitimate interest (Art. 6(1)(f) GDPR) in a trustworthy marketplace, and where applicable legal obligations (Art. 6(1)(c) GDPR);
• to calculate and invoice reservation fees, including VAT — performance of a contract and legal (tax) obligations;
• to send service emails about your account, inquiries or bookings — performance of a contract;
• to secure and monitor our systems (logs) — legitimate interest in security;
• to respond to requests from authorities where legally required — legal obligation.

We do not use your data for automated decision-making producing legal effects, and we do not sell personal data.

3. Who receives data

When you send an inquiry or reservation request, the advertiser of that listing receives your name, contact details and message; when an advertiser accepts, tenants receive the advertiser’s contact details. Each party must use the other’s data only for the tenancy in question.

We use service providers (processors) bound by data-processing agreements:

• Vercel Inc. — hosting and content delivery (functions pinned to the Frankfurt, Germany region), and file storage for uploads (Vercel Blob);
• Neon Inc. — managed Postgres database hosting our application data.

Where a provider processes data outside the EU/EEA, transfers are safeguarded by EU Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework).

4. Cookies

The Platform uses only cookies that are strictly necessary to operate it: a session cookie for signing in and a "lang" cookie storing your language choice (kept for up to 12 months). We use no advertising or third-party analytics cookies, so no cookie-consent banner is required.

5. Retention

Account and profile data are kept while your account exists and deleted or anonymised after account closure, except where retention is legally required.

Verification documents are kept only as long as needed for verification of the listing and any follow-up obligations, then deleted.

Booking and invoicing records are kept for the statutory commercial and tax retention periods (up to 10 years, depending on country).

Server logs are kept for a short rolling period appropriate to security needs.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure ("right to be forgotten", Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw any consent at any time with future effect (Art. 7(3)).

To exercise these rights, contact support@longtermrent.com. You also have the right to lodge a complaint with a supervisory authority — in Portugal the CNPD (www.cnpd.pt), in Spain the AEPD (www.aepd.es), or the authority of your habitual residence.

7. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted transport (HTTPS), hashed passwords, access controls and audit logging of administrative actions.

8. Changes

We may update this Privacy Policy when the Platform or the law changes. The current version is always available on this page; material changes will be announced on the Platform.