Privacy Policy

Account Information

Name, email address, and authentication credentials (password hash or Google OAuth profile data). This data is required to create and maintain your account.

Property Portfolio Data

Asset details you provide, including property names, locations, purchase prices, currencies, purchase dates, and property descriptions. This data is necessary to deliver the core portfolio management functionality.

Uploaded Documents

Files you upload to the Document Vault, such as Sales Purchase Agreements (SPAs), Title Deeds, passports, and visa documents. These documents may contain sensitive personal and financial information.

Mobility & Residency Data

Visa and residency records, presence day logs, and associated compliance data that you voluntarily enter to track your global mobility status.

Usage Data

Technical data generated during your use of the application, including IP addresses (for brute-force protection), timestamps of login attempts, and session metadata.

Authentication & Session Security

User passwords are hashed using bcrypt with random salts and are never stored in plain text. Sessions are managed via JSON Web Tokens (JWT) signed with the HS256 algorithm and a server-side secret. Access tokens are short-lived (1 hour); refresh tokens (7 days) are stored server-side and rotate on every use, with reuse-detection that revokes the entire token family on any anomaly. Both cookies are httpOnly, Secure, and SameSite=Lax. Brute-force protection locks accounts after 5 failed attempts for 15 minutes.

Document Vault — Encryption at Rest

Documents uploaded to the Vault are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) on our backend before they leave the server. Only the ciphertext is transmitted to and stored in our object-storage provider (Cloudflare R2, EU jurisdiction). Decryption happens transiently in memory when you download or preview a file, and the plaintext is never persisted anywhere. The encryption key lives only in our backend environment configuration and is never transmitted to clients or third parties.

In addition, all file uploads pass server-side magic-byte (MIME) validation to reject mismatched or malicious binaries, and file size is capped at 10 MB per document. Access to stored files is mediated exclusively through authenticated backend API endpoints — no direct storage URLs are exposed to the client. Each file is stored under a non-guessable path scoped to the owning user.

Transport Encryption

All communication between your browser and our servers is encrypted using HTTPS with TLS 1.2+. API credentials, session tokens, and document payloads are transmitted exclusively over encrypted channels.

Our primary application database is MongoDB Atlas (M10 cluster) deployed in the eu-central-1 (Frankfurt) region. All personal data, portfolio records, residency entries, and authentication metadata are stored here. The cluster uses SCRAM-SHA-256 authentication, TLS 1.3 in transit, encryption at rest, and is firewalled to our backend's egress IP only. MongoDB Privacy Notice.

Uploaded documents are stored in a Cloudflare R2 bucket configured with EU jurisdictional restriction (data physically remains in EU data centres). As described in § 5, all files are Fernet-encrypted on our backend before upload, so Cloudflare only ever sees opaque ciphertext. Access uses a bucket-scoped API token (no master credentials). Cloudflare Privacy Policy.

We use Resend to deliver transactional emails: password reset links, visa-expiry reminders, payment-milestone reminders, account-deletion confirmations, and account-exists notices. Your email address and the email body are transmitted to Resend solely to deliver the message. Resend does not use your data for marketing. Resend Privacy Policy.

We use Sentry (EU region: ingest.de.sentry.io) to monitor application errors and a small sampled fraction of performance traces. Captured data includes the user ID, the user email, error stack traces, request paths, and masked browser session replays. Request bodies and document contents are never sent to Sentry. PII redaction (send_default_pii=False) is enabled. Sentry Privacy Policy.

We use the ExchangeRate-API service to retrieve live foreign exchange rates (EUR, AED, GBP, TRY, USD) for portfolio valuation and currency conversion. No personal data is transmitted — only currency-pair requests. Rates are cached locally and stored as daily snapshots for historical arbitrage calculations.

If you choose to sign in with Google, authentication is processed through Emergent's managed OAuth service, which then exchanges credentials with Google. We receive only your name, email address, and profile picture. We never receive or store your Google password.

Right of Access (Art. 15 GDPR)

You have the right to request confirmation of whether your personal data is being processed and, if so, to receive a copy of that data along with information about the purposes of processing, categories of data, and recipients.

Right to Rectification (Art. 16 GDPR)

You have the right to request correction of inaccurate personal data or completion of incomplete data. You can update most information directly within the application.

Right to Erasure (Art. 17 GDPR)

You have the right to request deletion of your personal data. You can delete your account yourself directly in the app via Settings → Delete my account. This schedules permanent deletion in 30 days; during that window you can sign back in and cancel the request. After 30 days all your data — including encrypted documents stored in Cloudflare R2 — is irreversibly purged. You can also delete individual documents and assets at any time from within the app.

Right to Data Portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, machine-readable format. You can export your data yourself directly in the app via Settings → Export my data. The export is delivered as a ZIP archive containing your account info, full portfolio (assets + deals), residencies, presence logs, calendar events, payment-reminder log, and your uploaded documents (decrypted to their original form). Up to 5 exports per hour.

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request restriction of processing in certain circumstances, such as when the accuracy of data is contested or processing is unlawful but you oppose erasure.

Right to Object (Art. 21 GDPR)

You have the right to object to processing based on legitimate interests. Where you object, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or the place of the alleged infringement. The competent supervisory authority for our company is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.