Privacy policy

1. Who is responsible

StoffWare, Belgium, VAT BE 1040.174.154, contact@stoffrent.com, is the controller for the data of its customers and of visitors to the site.

For the data a landlord enters about tenants and other third parties, the landlord is the controller and we act as processor on their instructions. See our data processing agreement, and section 10 below if you are a tenant.

2. What we process

• Account: first and last name, email address, password (stored only as a hash), preferred language, two-factor settings, and the dates of your sessions.
• Portfolio content: your properties, tenants, landlords, leases, indexations, contacts, reminders, documents and photos — whatever you choose to put in.
• Billing: the plan, its status and periods, invoices, and the identifiers Stripe gives us. Card numbers are handled by Stripe and never reach us.
• Free trial: to allow one free trial per payment card, a one-way hash of the reference Stripe gives each card (its "fingerprint", not the card number), with the date. It is not linked to your account.
• Support: the messages you send us, with the screenshot and the page context you choose to attach.
• Technical: IP address, browser type, and timestamps of requests and errors, kept in server logs for security and debugging.
• Audience measurement: if you accept it in the banner, Google Analytics records the pages of our public site you visit, with a cookie identifier, your browser and device type, an approximate location derived from your IP address, and the site that sent you. Nothing is measured inside the application.
• Advertising attribution: when you reach our site through an ad or a tagged link, the campaign it names (source, medium, campaign, ad, keyword), the ad network's click identifier if there is one, the referring site and the first page you saw. Your browser keeps this for up to 90 days; if you create an account, it is recorded with it. A visit from a campaign is also counted anonymously, with no identifier.

3. Why, and on what legal basis

• To provide the service you signed up for, including sending the emails it needs (confirmation, password reset, invitations, notices about your trial or subscription) — performance of our contract.
• To take payment, issue invoices and keep our accounts — legal obligation, and performance of the contract.
• To keep the service secure, prevent abuse and fix faults — our legitimate interest in a service that works and is not abused.
• To understand which pages of our public site people visit — your consent, given in the banner and withdrawable at any time through the Cookies link at the bottom of every public page.
• To know which of our advertising brings customers and what it costs — our legitimate interest in spending our marketing budget sensibly. Only our own staff see it; it is not shared with the ad networks.
• To send you anything promotional — only if you have asked for it, and you can stop at any time.

4. Who else processes it

We use a small number of suppliers, each with a written agreement and access to no more than their job requires:

• Microsoft (Azure) — hosting of the application, the database and the files, in European data centres.
• Vercel — delivery of the web interface; it processes technical connection data such as IP addresses.
• Stripe Payments Europe, Ltd. (Ireland) — subscriptions, payments and invoices. Stripe is also a controller in its own right for fraud prevention and its legal obligations.
• Postmark (ActiveCampaign, LLC, United States) — sending the service emails.
• Plausible Analytics — cookieless audience measurement on the public pages, when it is switched on.
• Google Ireland Limited (Google Analytics) — audience measurement on the public pages, only with your consent. Advertising features and Google signals are switched off.

We keep this list current. Customers who want to be told before a supplier changes should read the sub-processor clause of the data processing agreement.

5. Transfers outside the European Union

The application, its database and your files are hosted in the European Union.

Three suppliers are established in the United States or belong to a group that is: Postmark, which sends our emails, Vercel, which serves the web interface, and Google, whose audience measurement data may be processed in the United States. Those transfers rest on the European Commission's standard contractual clauses and, where the supplier is certified, on the EU–US Data Privacy Framework.

6. How long we keep it

• Portfolio content: as long as the account exists. After an account is closed, it is deleted within 90 days.
• Invoices and accounting records: for the period Belgian law requires, currently ten years.
• Support conversations: up to two years after the request is closed.
• Server logs: a short period, no longer than what security and debugging need.
• Audience measurement: Google Analytics cookies last 13 months at most, and the data in Google Analytics is kept 14 months. Your choice in the banner is remembered for 13 months, after which we ask again.
• Advertising attribution: in your browser, 90 days at most. With an account, as long as the account exists; the ad network's click identifier is erased after 90 days, and when the account is deleted only the campaign name remains, no longer linked to anyone.
• The hash of a card that started a free trial: without time limit, even after the account is closed, since its only purpose is to stop that card from getting a second trial. It identifies neither you nor the card.
• Backups: rotated continuously; a deleted item disappears from backups within a few weeks at most.

7. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to a processing, and to receive it in a portable format. The export in the application already gives you the portable copy, immediately and without asking.

Write to contact@stoffrent.com. We answer within one month. If our answer does not satisfy you, you can complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (autoriteprotectiondonnees.be), or to the authority of the country you live in.

8. Cookies

We use only what the service cannot work without: a cookie that keeps you signed in, and local storage for your language, your light or dark theme and your choice about audience measurement. There are no advertising cookies.

One exception: when you arrive through an ad or a tagged link, local storage keeps the name of that campaign (and the ad network's click identifier) for up to 90 days, so that an account created later can be credited to it. It contains no identifier of you and is never read by anyone but us. If your browser sends the Global Privacy Control signal, it is not stored at all; you can also clear it with your browser's site data.

On the public pages, and only if you accept it in the banner, Google Analytics sets its cookies (_ga and _ga_…) to measure audience. Refusing is as easy as accepting and changes nothing about the site. You can change your mind at any time through the Cookies link at the bottom of every public page; withdrawing deletes those cookies. If your browser sends the Global Privacy Control signal, we treat it as a refusal and do not ask.

9. Security

Traffic is encrypted. Passwords are hashed, never stored in readable form. Two-factor authentication is available and can be made compulsory for a portfolio. Each portfolio is isolated in the database, and that isolation is enforced by the code and checked by automated tests on every change. Secrets such as two-factor keys are encrypted with keys held separately from the database. Backups are taken regularly.

No system is perfect. If a breach affects your personal data and is likely to put you at risk, we will tell you and the supervisory authority as the law requires.

10. If you are a tenant

Your landlord may use StoffRent to manage their properties. In that case your landlord decides what is stored about you and why: they are your point of contact for access, correction or deletion.

If you write to us instead, we will pass your request to the landlord concerned and help them answer it. We cannot give you access to their portfolio ourselves.

11. Changes and contact

When this policy changes, we update the date at the top of the page, and we tell customers by email if the change matters to them.

Any question about this policy: contact@stoffrent.com.