Privacy Policy

This policy explains how REA — Real Estate Assistant(“REA”, “we”) handles personal data. The data controller is Joseph Khaouly, established in the Netherlands. Questions or requests: info@josephkhaouly.com.

Who is responsible for which data

There are two distinct roles here, and it matters which applies:

• Your account. For the data you provide about yourself — your name, email and the portfolio you build — we are the controller.
• Data about other people. When you enter details of your tenants (names, email addresses, phone numbers) or third-party owners, you are the controller of that data and we act as your processor: we store and process it only to provide the service to you, on your instructions. You are responsible for having a lawful basis to enter it and for informing those people as the law requires.

What we collect

• Account data: your name, email address, and a securely hashed password (we never store your password in readable form).
• Portfolio data: the properties, leases, invoices, payments, expenses and exchange rates you record, including any documents you upload.
• Third-party personal data: tenant and owner names, emails and phone numbers you choose to enter.
• Technical data: a single strictly-necessary session cookie to keep you signed in, and basic server logs. We use no analytics or tracking cookies.

Why we process it, and our legal basis

• To provide the service — performance of our agreement with you (Art. 6(1)(b) GDPR).
• To verify your email and secure your account — our legitimate interest in preventing abuse and protecting accounts (Art. 6(1)(f)).
• To send you essential account emails (verification, password reset) — performance of our agreement with you.

Who we share it with

We do not sell your data or use it for advertising. We share it only with the service providers needed to run REA, each acting as our processor under contract:

• Our hosting provider, which stores the database and uploaded files within the European Union.
• Resend, which delivers our account emails (it receives the recipient address and message content of those emails only).

Where it is stored

Your data is stored on servers located in the European Union. We do not transfer it outside the EU/EEA in the ordinary course of providing the service.

How long we keep it

We keep your data for as long as your account is active. When you delete your account, or ask us to, we erase it immediately from our live systems. Residual copies may remain in encrypted backups for up to 30 days, after which they are overwritten.

Your rights

Under the GDPR you have the right to:

• Access the data we hold about you — use “Export my data” in Settings for an immediate copy.
• Rectify inaccurate data — edit it directly in the app.
• Erase your data — use “Delete my account” in Settings, which removes everything permanently.
• Port your data — the export is machine-readable JSON.
• Object to or restrict processing, and to withdraw consent where processing relies on it.

To exercise any right you cannot complete in-app, email info@josephkhaouly.com. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

Security

Passwords are hashed with bcrypt. Access requires an authenticated, expiring session. Uploaded documents are private to your account. Data is transmitted over encrypted connections. No system is perfectly secure, but we take reasonable measures appropriate to the data.

Changes

We may update this policy. Material changes will be reflected here with a new “last updated” date.