Privacy Policy

Data Controller: LeverRent Email: privacy@leverrent.com

We collect the following personal data: • Identification data: name, surnames, NIF/NIE, email, phone number. • Economic and financial data: property information, rental contracts, receivables, expenses, mortgages, bank details (through PSD2 connection). • Tax data: IRPF information, assets, employment income, and other income sources. • Browsing data: IP address, browser type, pages visited, session duration. • Account data: access credentials (password is stored encrypted).

The processing of your personal data is based on: • Performance of a contract (Art. 6.1.b GDPR): processing is necessary for the provision of the contracted service. • Consent (Art. 6.1.a GDPR): for sending commercial communications and using non-essential cookies. • Legitimate interest (Art. 6.1.f GDPR): for fraud prevention, platform security, and service improvement. • Legal obligation (Art. 6.1.c GDPR): for compliance with tax and data retention obligations.

Your data will be processed for the following purposes: • Management of your user account and provision of the SaaS service. • Property, contract, receivable, expense, and tax management. • Payment processing and invoicing. • Generation of indicative tax reports. • Sending operational service notifications. • Platform improvement and personalization. • Compliance with legal obligations.

Your data may be shared with the following third parties, exclusively for service provision: • Stripe, Inc. (USA): payment processing. Privacy policy: stripe.com/privacy. • Resend, Inc. (USA): transactional email delivery. • Anthropic, PBC (USA): AI assistant (copilot) queries and invoice scanner processing. Data is anonymized when possible. • Twilio, Inc. (USA): WhatsApp and SMS messaging. • Salt Edge, Inc. (Canada): PSD2 bank connection for transaction synchronization. • Cloudflare, Inc. (USA): document storage (R2). • Vercel, Inc. (USA): frontend hosting. • Sentry (Functional Software, Inc., USA): error monitoring. Your data will not be sold or transferred to third parties for advertising purposes.

Some of the providers mentioned are based in the United States and Canada. These transfers are protected by: • Standard Contractual Clauses (SCC) approved by the European Commission. • The EU-U.S. Data Privacy Framework, where the provider is certified. You may request a copy of the applicable safeguards by writing to privacy@leverrent.com.

Your data will be retained for: • Account data: as long as your account remains active, and up to 30 days after a deletion request. • Economic and tax data: a minimum of 6 years (Art. 30 Spanish Commercial Code) from the last corresponding fiscal year. • Billing data: 4 years (statute of limitations for tax obligations). • Audit records: 5 years. • Session cookies: until logout or token expiration (maximum 7 days).

You have the right to: • Access: know what personal data we process about you. • Rectification: correct inaccurate or incomplete data. • Erasure: request deletion of your data when no longer necessary. • Portability: receive your data in a structured, machine-readable format. • Objection: object to the processing of your data on legitimate grounds. • Restriction: request the restriction of processing in certain cases. • Withdrawal of consent: at any time, without retroactive effect. To exercise these rights, send an email to privacy@leverrent.com indicating the right you wish to exercise and attaching a copy of your ID.

If you consider that the processing of your data does not comply with regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan 6, 28001 Madrid (www.aepd.es).