Privacy Policy

This Privacy Policy explains how L&S Intelligence Works V.O.F. ("Company", "we", "us") processes personal data when you use the Rentrise platform ("Service").

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch law.

L&S Intelligence Works V.O.F. is the data controller responsible for the processing of your personal data.

We may collect and process the following categories of personal data:

3.1 Account Information

• Name
• Email address
• Authentication data (via Google or Apple login)

3.2 Usage Data

• Interaction with the platform
• Preferences (filters for rental listings)
• Activity logs

3.3 Device & Technical Data

• IP address
• Device identifiers
• Browser type and version

3.4 Payment Information

Payments are processed via Stripe. We do not store full payment details.

3.5 Communication Data

• Emails sent via the platform
• Customer support inquiries

3.6 Notification Data

• Email notification preferences
• Push notification tokens (if enabled)

We process personal data for the following purposes:

• To provide and operate the Service
• To send rental notifications based on user preferences
• To manage user accounts
• To process payments and subscriptions
• To improve and analyze the Service
• To communicate with users
• To comply with legal obligations

We rely on the following legal bases under GDPR:

• Performance of a contract (Article 6(1)(b))
• Legal obligation (Article 6(1)(c))
• Legitimate interests (Article 6(1)(f)), such as improving the Service
• Consent (Article 6(1)(a)), where required (e.g. cookies, marketing)

We use trusted third-party providers ("processors") to operate our Service.

Infrastructure

DigitalOcean (EU – Amsterdam): hosting, databases, Redis, image storage

Authentication & Communication

Google LLC (OAuth login) – United States: name, email

Apple Inc. (OAuth login) – United States: name, email

Mailgun Technologies – EU: transactional emails (email address)

Firebase / Google FCM (planned) – United States: push notifications (device token)

Payments

Stripe Inc. – EU / United States: payment data processing

Analytics & Monitoring

Google Analytics – United States: visitor analytics (IP address, behavior)

PostHog – EU: product analytics (user behavior)

Sentry – EU region: error monitoring (technical logs)

Consent Management

Cookiebot (Cybot A/S) (under consideration) – EU: cookie consent management

Advertising

Meta Platforms, Inc. (Facebook/Instagram) – United States: hashed email, ad click ID, campaign data (conversion tracking)

Google LLC – United States: hashed email, ad click ID, campaign data (conversion tracking)

TikTok Inc. – United States: hashed email, ad click ID, campaign data (conversion tracking)

Some of our service providers are located outside the European Economic Area (EEA), including the United States.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable

We retain personal data only as long as necessary:

• Account data: until account deletion
• After deletion: data is removed within 1 month, unless required for legal obligations
• Financial data: retained as required by Dutch tax law (typically 7 years)

Under GDPR, you have the following rights:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use cookies and similar browser storage technologies on the Rentrise platform. This section explains what we use, why, and how you can control it.

10.1 What are cookies?

Cookies are small text files placed on your device by a website. We also use local storage for session state. You can control cookies through the cookie preferences panel (accessible via "Cookie settings" in the footer) or through your browser settings.

10.2 Strictly necessary

These are always active and cannot be disabled. The platform cannot function without them.

• Authentication token — keeps you logged in during and between sessions
• Cookie consent preferences — remembers the choices you make in the cookie preferences panel (12 months)
• Stripe session state — required to complete a subscription checkout (session)

Legal basis: legitimate interest / contractual necessity (Article 6(1)(b) GDPR).

10.3 Functional — Maps & search

Off by default. Only loaded after you give consent.

When enabled, Google Maps and Google Places are loaded to display rental listing locations on a map and to power the city and area search. When these services load, your IP address and interaction data are shared with Google LLC in accordance with their privacy policy (policies.google.com/privacy).

If you do not consent, the map view and city search autocomplete are disabled. All other features remain fully available.

Legal basis: consent (Article 6(1)(a) GDPR).

10.4 Analytics — product usage & error monitoring

Off by default. Only loaded after you give consent.

When enabled, we use PostHog (EU region) for product analytics — understanding how the platform is used (pages viewed, features used, events such as signup or saving a listing) so we can improve it. Visitors stay anonymous until you sign in, after which activity is linked to your account. PostHog is not used for advertising. Data is processed within the EU.

PostHog's privacy policy: posthog.com/privacy

We also use Sentry (EU region) to capture anonymous crash and error reports. This helps us detect and fix technical problems. Sentry does not collect your name, email address, or any identifier. Data is processed within the EU. Sentry is not used for marketing or user profiling.

Sentry's privacy policy: sentry.io/privacy

Legal basis: consent (Article 6(1)(a) GDPR).

10.5 Managing your preferences

You can review and change your cookie choices at any time via "Cookie settings" in the footer. You can also block or delete cookies through your browser settings, but note that blocking strictly necessary cookies will prevent the platform from working correctly.

10.6 Advertising — conversion tracking

Off by default. Only loaded after you give consent.

When enabled, we share conversion data with our advertising partners — Meta (Facebook/Instagram), Google, and TikTok — to measure which ad led to a paid subscription and to optimize ad delivery. This is separate from the analytics described in 10.4.

The data shared includes: your email address (hashed using SHA-256 before sending — we never send your email in plain text), ad click identifiers (such as fbclid, gclid, ttclid), campaign UTM tags, and the subscription value and currency.

This data is processed by Meta, Google, and TikTok in the United States. We rely on Standard Contractual Clauses (SCCs) and/or adequacy decisions as the transfer safeguard — see Section 7.

Conversion data is only sent for users who have opted into the advertising cookie category. You can withdraw consent at any time via "Cookie settings" in the footer; new conversions will no longer be sent from that point on.

Provider privacy policies:

• Meta: https://www.facebook.com/privacy/policy/
• Google: https://policies.google.com/privacy
• TikTok: https://www.tiktok.com/legal/privacy-policy

Legal basis: consent (Article 6(1)(a) GDPR).

We take appropriate technical and organizational measures to protect personal data, including:

• Secure hosting within the EU
• Access controls
• Encryption where applicable
• Monitoring and logging

Our Service may link to third-party websites. We are not responsible for the privacy practices of those websites.

Users should review the privacy policies of third parties separately.

We may update this Privacy Policy from time to time. Users will be informed of significant changes where required.