Privacy policy

Crestlet is run by Xaura Technologies, a company in India. We decide how the personal data in Crestlet is used, which makes us its controller under data protection laws such as the GDPR. You can reach us at [email protected].

• Your account. Your email address and password. The password goes to Google Firebase, which handles sign-in for us. We never see it.
• Your profile. Your name, phone number, country and the currency you work in.
• What you record. For a landlord: properties and their addresses, units, the tenants you add (their name, phone number and email address), leases, rent and other charges, invoices, and deposits with any deductions and the notes you add to them. For a tenant: the unit you joined and the records your landlord keeps about your tenancy.
• Technical data. When your browser asks our servers for a page, they record its IP address, the time, the address asked for and the browser's description of itself. We use these logs to keep the service running and secure.
• On your device. Crestlet keeps a few things in your browser: that you are signed in (kept by Firebase), the light or dark theme you chose, whether the side menu is collapsed, and the role you last signed in with. None of them is used to follow you around the web. There are no advertising or analytics cookies.

• To provide Crestlet: create your account, sign you in, and keep and show the records you add. This is necessary to carry out our agreement with you, the terms of service.
• To link a tenant to the right records. When a tenant joins a unit with its code, and their phone number matches the one the landlord entered, the two records are joined.
• To email you about your account and your tenancy: a welcome when you sign up, an invitation when a landlord adds you, and a notice when a bill is issued, a lease starts, changes or ends, or a deposit is recorded or returned. These emails are part of the service, not marketing, and go only to the email address on your account or the one your landlord gave for you. Mailjet tells us whether each email was delivered, bounced or marked as spam, and we keep that record so that we know when an address does not work.
• To keep the service secure and working, and to prevent abuse. This is our legitimate interest.
• To answer you when you write to us.
• To meet our legal obligations.

We do not sell personal data, use it for advertising, or make decisions about you by automated means.

When a landlord adds a tenant's details, the tenant's name, phone number and email address are held in the landlord's records. Once the tenant has joined the unit, the landlord and the tenant see the same lease, invoices and deposit. A landlord who adds someone's details is responsible for having the right to do so.

• Google, which provides sign-in through Firebase Authentication.
• Mailjet, part of Sinch, which delivers the emails Crestlet sends. It receives the recipient's name and email address and what each email says.
• The providers that host our servers in the European Union, which store the data on our behalf.
• Within a tenancy, the landlord and the tenant linked to a unit, who see the records of that tenancy.
• Public authorities, where the law requires it.
• A buyer or successor, if Crestlet or Xaura Technologies is sold or merged. You will be told before your data becomes subject to a different policy.

The data in Crestlet is stored on servers in the European Union. Firebase is operated by Google, which may process sign-in data in the United States and other countries under its own safeguards for such transfers, including the European Commission's standard contractual clauses. Mailjet stores the emails it delivers in the European Union, in Germany and Belgium. Xaura Technologies, which runs the service, is in India.

For as long as your account exists. When you ask us to delete your account, we delete your personal data within one month, unless the law requires us to keep part of it for longer. The records a landlord keeps about a tenancy belong to the landlord's account. Server logs are kept for a short time, for security, and then deleted.

Depending on where you live, you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, or ask for it in a form you can take elsewhere. Write to [email protected] from the email address on your account, and we will answer within one month.

If you are in the European Union or the United Kingdom, you can also complain to your data protection authority. In India, you can raise a grievance with us at the same address.

Connections to Crestlet are encrypted. Passwords are handled by Firebase and are never stored by us. Access to the servers is limited to the people who run the service.

Crestlet is for adults. You must be 18 or over to create an account, and we do not knowingly collect data about children.

When this policy changes, the date at the top changes with it. If a change affects how your data is used, we will tell you before it applies.

Questions about this policy or your data: [email protected].