Privacy Policy

Introduction

Hyrea AB ("Hyrea," "we," "us," or "our") operates a property management platform for landlords, property managers, tenants, and property owners. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website (www.hyrea.se) and services. We are committed to protecting your privacy in compliance with EU General Data Protection Regulation (GDPR), Swedish Data Protection Act (Dataskyddslagen), UK General Data Protection Regulation (UK GDPR), California Consumer Privacy Act (CCPA/CPRA), and UAE Personal Data Protection Law (PDPL).

Data Controller

Information We Collect

Account Information

• Name (first and last)
• Email address
• Phone number (optional)
• Profile picture (optional)

Landlord/Property Manager Information

• Property details (address, type, unit count)
• Portfolio information (name, base currency)
• Bank connection tokens (via Plaid/Lean, read-only access)
• Financial transaction data synced from connected bank accounts

Tenant Information

• Lease assignment details (unit, start date, end date, rent amount)
• Maintenance requests and comments
• Communication messages sent through the platform
• Deposit information

Communication Data

• Messages sent through our platform
• Support requests and correspondence

Information Collected Automatically

Device and Usage Information:

• IP address
• Browser type and version
• Operating system
• Device type (mobile, desktop, tablet)
• Pages visited and features used
• Time spent on pages
• Referring website

Location Information:

• Approximate location derived from IP address (city/country level)
• Used for security purposes (detecting unusual login locations)

Cookies and Similar Technologies

• Essential cookies (authentication, security)
• Analytics cookies (with your consent)

Information from Third Parties

• Bank account information via Plaid (EU/US) or Lean Technologies (UAE/MENA) with your explicit consent
• If you sign in with Google, we receive your name and email address

How We Use Your Information

To Provide Our Services

• Create and manage your account
• Track properties, units, and tenant assignments
• Sync and categorize financial transactions from connected bank accounts
• Generate owner statements and financial reports
• Facilitate communication between landlords, tenants, and property owners
• Track and manage maintenance requests

To Improve and Personalize

• Analyze usage patterns to improve our platform
• Learn from transaction categorization corrections to improve auto-categorization accuracy
• Develop new features based on user needs

To Communicate With You

• Send service-related notifications
• Respond to your inquiries and support requests
• Send important updates about your account or properties
• Marketing communications (with your consent)

For Security and Fraud Prevention

• Detect and prevent fraudulent activity
• Monitor for suspicious login attempts
• Verify user identity
• Protect against unauthorized access

Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and court orders
• Enforce our terms of service

Legal Basis for Processing (GDPR)

We process your personal data based on:

How We Share Your Information

With Other Users

• Tenants can see their own lease details, maintenance requests, and messages
• Property owners can see read-only financial statements and reports for their properties
• Property managers can access all properties and tenants they manage
• Landlords can see tenant assignment details for their properties

With Service Providers

For Legal Reasons

• To comply with legal obligations
• To respond to lawful requests from authorities
• To protect our rights, privacy, safety, or property
• In connection with a merger, acquisition, or sale of assets

We may share information for other purposes with your explicit consent.

International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including United States (Vercel, PostHog US instance, Plaid) and European Union (Supabase EU region). For transfers outside the EU/UK, we ensure appropriate safeguards through Standard Contractual Clauses (SCCs), Adequacy decisions where applicable, and Binding Corporate Rules where applicable.

Data Retention

We retain your data for as long as necessary to provide our services:

Your Rights

For All Users

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete data
• Deletion: Request deletion of your data
• Data Portability: Receive your data in a portable format

Additional Rights (EU/UK - GDPR)

• Restrict Processing: Limit how we use your data
• Object to Processing: Object to processing based on legitimate interest
• Withdraw Consent: Withdraw consent at any time
• Lodge a Complaint: File a complaint with your supervisory authority

Swedish Data Protection Authority (IMY): www.imy.se

Additional Rights (California - CCPA)

• Know: What personal information we collect
• Delete: Request deletion of your data
• Opt-Out: Opt out of sale of personal information (we do not sell data)
• Non-Discrimination: Equal service regardless of privacy choices

How to Exercise Your Rights

Contact us at: support@hyrea.se

Or use the in-app settings: Account Settings > Account > Data Export, Account Settings > Account > Delete Account

We will respond within 30 days (or as required by applicable law).

Cookies and Tracking

Essential Cookies

Required for basic functionality:

• Authentication (keeping you logged in)
• Security (CSRF protection)
• Language preferences

These cookies are always active and do not require consent.

Analytics Cookies (Consent Required)

With your consent, we use:

• PostHog: User behavior analytics (US cloud instance)
• Vercel Analytics: Web performance monitoring
• Vercel Speed Insights: Core Web Vitals measurement

You can manage your cookie preferences via the cookie banner on first visit or via Account Settings → Privacy.

We Do NOT Use

• Marketing/advertising cookies
• Third-party tracking for advertising
• Cross-site tracking

Security

We implement industry-standard security measures:

• Encryption: TLS for data in transit, encryption at rest via Supabase (AWS infrastructure)
• Authentication: Secure password hashing via Supabase Auth, TOTP two-factor authentication
• Access Control: Row-level security policies on every database table, role-based data isolation
• Session Management: Session tracking, login alerts on new devices, remote session revocation
• Banking Security: Bank credentials never stored on our servers; Plaid and Lean handle authentication directly
• Monitoring: Webhook signature verification, provider health tracking

Security Incident Response

In case of a data breach affecting your rights, we will:

• Notify affected users within 72 hours
• Report to relevant supervisory authorities as required
• Take immediate steps to mitigate the breach

Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Email notification
• Prominent notice on our website
• In-app notification

The "Last Updated" date at the top indicates when changes were made.

Contact Us

For privacy-related questions or to exercise your rights:

Email: support@hyrea.se

Postal address available on request via support@hyrea.se