HomeHeardHomeHeard

Privacy Policy

Last updated: 28 July 2026

This policy explains what personal data HomeHeard processes, why, and what rights you have under the GDPR. Data controller: OPSAAS OÜ (Estonia, registry code 16899735), operating homeheard.app — info@homeheard.app.

1. What we collect

  • Account data — email address, display name, hashed password. Needed to provide the service (contract).
  • Reviews & ratings — the content you publish, linked to your account. You control whether your name or "Anonymous resident" is displayed (profile setting).
  • Verification documents — optional uploads (rental contract, utility bill) used only to confirm your address relationship. They are never published, are visible only to moderators, and the file is deleted immediately after the decision (at most 30 days). Only the outcome (verified yes/no) is kept.
  • Technical data — IP address and request logs for security, rate limiting and abuse prevention (legitimate interest), retained briefly.
  • Cookies/storage — we only use local storage for your login session. No advertising or cross-site tracking cookies.

2. What we do NOT do

  • We do not sell your data.
  • We do not show apartment/unit numbers publicly.
  • We do not display your exact residency dates — only month precision.

3. Processors we rely on

Hosting on Hetzner (Germany/EU); DNS, CAPTCHA (Turnstile) and email routing by Cloudflare; transactional email via Resend; address data from the public Dutch BAG registry (Kadaster/PDOK). These parties process data on our behalf under their respective data processing agreements.

4. How long we keep data

  • Account data: until you delete your account.
  • Verification documents: deleted on decision, 30 days at most.
  • Published reviews: as long as they remain published; deleting your account anonymizes the link between you and your reviews.
  • Limited moderation/audit records may be retained where required for legal protection.

5. Your rights

You can access and update your data in your profile, choose anonymous publishing, and delete your account yourself (Profile → Delete account) — this removes your email, name and password immediately. For data export, objection, or any other GDPR request, email info@homeheard.app. You may also lodge a complaint with the Dutch DPA (Autoriteit Persoonsgegevens).

6. Changes

We will announce material changes to this policy on the site. Continued use after changes means you accept the updated policy.