Privacy Policy

HuurCheckie is the data controller responsible for the processing of your personal data. We take the privacy of our users very seriously and process your data exclusively in accordance with the General Data Protection Regulation (GDPR).

For questions regarding privacy and your data, you can contact our Data Protection Officer at privacy@huurcheckie.nl.

We process the following categories of personal data based on the following legal grounds:

• Account information (Name, Email address, Password hash): Necessary for the performance of the contract (providing the HuurCheckie service).
• Document data (Content of uploaded contracts, including names, addresses, or rental prices mentioned therein): Processed exclusively for the performance of the analysis service at your request.
• Payment data (Transaction IDs via Mollie, Order history): Necessary for the performance of the contract and compliance with legal (fiscal) retention obligations.
• Technical data (IP address, Browser metadata): Necessary for security purposes, fraud prevention (legitimate interest), and rate limiting.
• Advertising and conversion data (public page visited, check started or completed, and amount paid): Processed for advertising measurement and retargeting only after you have given consent.
• Partner attribution (which affiliate partner referred you, recorded at registration or purchase): Legitimate interest in the performance of our partner agreements. We do not build an advertising profile of you from this; it is used solely to credit the right commission to the right partner.

To provide our services, we use external service providers (sub-processors). We have concluded data processing agreements with these parties to safeguard the security of your data.

• Google Gemini API (Google Ireland Limited): Your rental contracts are sent to Google servers in the EU or US for AI analysis. Important: In accordance with Google Cloud API terms, data submitted through our service (including personal data in contracts) is not used by Google to train their underlying AI models. Once the analysis is completed, this data is no longer retained by Google.
• Supabase: Used for our database, authentication, and secure file storage. The database is located in secured infrastructure (Europe).
• Vercel: For hosting the website and serverless functions. Vercel may process technical traffic data in doing so.
• Mollie: For processing secure payment transactions. We do not store credit card data ourselves.
• Xel: Our domain/email provider, through whose SMTP mail server we send transactional emails such as password resets and purchase confirmations.
• PostHog (EU): For product analytics, heatmaps and session recordings. In recordings all text and input is masked and uploaded documents are not captured. Linked to your account after login to understand how the service is used, only with your consent to analytics cookies. EU-hosted, data is not resold to third parties.
• Google Analytics 4 (Google Ireland Limited): For website statistics, only with your consent to analytics cookies. Google may process this data on servers outside the EU. We do not use Google Analytics for advertising or remarketing; Google's advertising signals stay off even with marketing consent.
• Meta Pixel (Meta Platforms Ireland Limited): For advertising measurement and retargeting, only with your consent to marketing cookies (separate from consent to analytics cookies). We do not use advanced matching or send contact details, addresses, contract content, report numbers or payment references to Meta.
• Google (sign in with Google): If you sign in with your Google account, we verify the login token Google issued and receive your email address and name.
• Resend: Backup sender for transactional email when our own mail server is unreachable. Resend is based in the United States; an email address and the message content are transferred in that case.
• Trustpilot: For showing reviews. This script loads only after you allow marketing cookies.

We do not retain data longer than necessary for the purposes for which it was collected:

• Analyzed Reports: Reports and converted contract text are deleted by default 30 days after the report is created. You can delete them sooner. A separate active choice keeps them for 90 days from that choice. The deadline is visible; extending again requires a new active choice. Keeping them longer is independent of consent to reuse contract data. If we cannot reach you at your email address, we keep your reports for up to 12 months after the regular retention period and delete them after that.
• Account information: Retained as long as your account is active. Upon account deletion (via the dashboard), your account, reports and letters are deleted immediately. We do not delete your purchases, because the statutory retention obligation does not allow it: for each purchase we keep the package, the amount, the date and the Mollie transaction ID, detached from your account and without your name or email address. If a purchase came through a partner link, the same applies to that record. As payment service, Mollie keeps its own data about the transaction under Mollie's own terms.
• Audit logs & Security logs: Up to a maximum of 12 months for detecting and analyzing security incidents.
• Payment data: 7 years. Due to the legal retention obligation of the Tax Authority, we are required to maintain financial records for this period.

Under European privacy legislation, you have the following rights regarding your data:

• Right of access & Data portability: You can request a complete, machine-readable export of all your data, contracts, letters, and purchase history at any time in your account settings ('Download my data').
• Right to erasure (right to be forgotten): Via the "Delete Account" button in your dashboard, you can directly and permanently delete your account and all related documents. Only purchase records are kept, detached from your account, for as long as the tax retention obligation requires (see Retention Periods).
• Right to rectification: You can modify your profile information via the settings in your dashboard.
• Right to object & restriction: You have the right to object to the processing of your personal data or to restrict processing.

Do you have a question or request regarding your rights? Email privacy@huurcheckie.nl. You also have the right to file a formal complaint with the Dutch Data Protection Authority (AP) if you believe we are processing your data unlawfully.

We use PostHog, an EU-hosted product analytics tool, to understand how our service is used and where it can be improved. PostHog stores this data in both a cookie and localStorage in your browser. With PostHog we also create heatmaps and session recordings of clicks, scrolling and mouse movements; in these all text and input is masked and uploaded documents are not captured. We also use Google Analytics 4 for website statistics. Both happen only if you allow analytics cookies via the cookie banner; we never sell this data and do not use it for advertising. Only if you also, or separately, allow marketing cookies do we use Meta Pixel to attribute started, completed and paid checks to advertisements and for retargeting; we do not send contact details, addresses, contract content, report numbers or payment references to Meta.

Functional session and security cookies are set for session management, rate limiting, and CSRF protection. You can determine which non-essential cookies we may set via the Cookie banner or in your browser settings.

See our dedicated Cookie Policy for a detailed overview.