Only essential cookies. Anonymous analytics without cookies. Privacy

GuidesPricing
Log inGet startedStart

Calculators

Language

Home

This translation is provided for convenience. The Greek version is the legally binding text. Read the Greek version

Legal

Privacy Policy

What data we collect, for what purpose, on what legal basis, who we share it with and what rights you have. Written under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019.

Version 4 Oct 2026 · Last updated: October 2026

A. Who we are

1. Data controller

The controller of the data described here is the operator of PROPERWISE (“we” or “the Service”). PROPERWISE is operated by a natural person. Their full name, address and tax number (AFM) have not been published yet. They will be published on the “About us” page; until then, for any personal data matter, write to privacy@properwise.gr.

For any matter about your personal data, or to exercise your rights, write to us at privacy@properwise.gr. Where your data is stored and who processes it is also set out on the “About us” page.

We have not appointed a Data Protection Officer (DPO). Article 37 GDPR requires one where the core activity consists of large-scale systematic monitoring or the processing of special categories of data, and neither describes the Service. If that changes, we will appoint a DPO and publish their details here. Until then, the point of contact for any personal data matter is privacy@properwise.gr.

B. What we collect and why

2. What data we collect

We collect the data needed to provide the Service, in the following categories:

  • Account details: email address, full name and password in encrypted (hashed) form, through the authentication provider Supabase Auth. We never see your password in plain text.
  • Property data you enter: property details (address, floor area, value), expenses, bills, tenant details, leases, and documents and photos you upload. Some of these (e.g. a tenant’s tax number (AFM), lease details) may concern third parties; see the section “Third-party data you enter”.
  • Billing details in your Account, optional: document type, country, full name, business name, tax number (AFM) or EU VAT number, and phone. They are used to show the VAT treatment that applies to you and to prefill the owner’s details when you add a property. The details for the subscription receipt are given at checkout.
  • Subscription payment details: Card details are handled exclusively by Creem and never pass through our servers: payment takes place in its own environment and we receive only the confirmation.
  • Data you give to Noa, the app’s artificial intelligence: the questions you type or dictate and the documents or photos you scan, so that you get an answer or an automatic entry (see the section “Artificial intelligence (AI)”).
  • Notification details: your browser’s notification subscription (a device identifier), if you turn on “Notifications on this device”.
  • Security activity log: password changes, enabling two-step verification, sign-outs, changes to team members. You can see it yourself in your Account.
  • Contribution to community data: only if you turn it on yourself under “Account” · “Data and privacy”, basic figures about your properties (area, type, floor area, price) contribute anonymously to aggregate market statistics. The switch is off by default; we record when you turned it on, so that consent can be demonstrated (Article 7(1) GDPR), and you can turn it off whenever you like.
  • Technical and usage data: the sign-in session cookies (Supabase), preferences kept in your browser’s local storage (localStorage) and basic technical logs for security and stability (see the section “Cookies and similar technologies”).

3. Which details are mandatory

Article 13(2)(e) GDPR requires that you know which data you must provide and what happens if you don’t. Mandatory, in the sense that the contract cannot be performed without them, are only your email address and password: without them there is no account.

Everything else you provide because it serves you, and declining has no consequence beyond the corresponding feature having nothing to work with: without a property there is no yield, without a lease there are no reminders, without a question there is no answer from Noa. Your account stays active and your data accessible in every case.

5. Third-party data you enter

When you enter details of third parties (e.g. tenants or partners), you act as the party responsible for collecting them lawfully. You must have a legal basis and, where required, have informed those persons. We process this data solely on your behalf, so that the Service works. The terms of this processing are the “Processing agreement for third-party data” in the Terms of use, which you accept before the first time you save a tenant’s details.

6. Public portals (tenant, guest, accountant)

The Service provides “portal” links that need no account, which you create and share yourself:

  • Tenant portal: a link you give your tenant, with a PIN if you set one. The tenant sees the rent due and the payment method you set, reports a payment and sends a maintenance request, with photos if they wish. Only you see what they send. You are the controller towards them; we act on your behalf.
  • Guest pre-arrival portal (pre-check-in): your guest fills in their stay details (full name, ID card or passport number, nationality, date of birth) and, if they wish, phone and email. The details the law requires for the stay declaration are requested by you as host, to fulfil your legal obligation (Article 6(1)(c) GDPR). Phone and email are optional and are given with the guest’s consent (Article 6(1)(a)), for communication about the booking. Their confirmation is recorded with a timestamp and only you see the details. You are the controller towards the guest; we act on your behalf.
  • Accountant portal: a read-only link you give your accountant. It shows, by property and by year, itemised expenses (category, amount, date), stays (dates, nights, turnover), the current monthly rent, the address and the ATAK property number. It does not expose names or contact details of tenants, clients or guests.
  • Calendar link: a private address you add yourself to the calendar on your phone or computer. It shows, read-only, the deadlines of your properties (events, bills falling due, rent instalments, pending items). Anyone with the address sees these deadlines, without being able to change anything.
  • You can revoke the accountant link and the calendar link at any time from within the app; the old one stops working immediately. Each link also expires automatically: tenant portal 365 days, guest check-in 90 days, accountant 180 days; the calendar link also expires automatically, after a longer period. To revoke a check-in or tenant portal link immediately, write to us.

Each link has a unique code that cannot be guessed and shows only the data for its purpose, nothing from other accounts.

7. Invitation program (referrals)

The Service offers an optional invitation program. You get a personal link and code and, if you wish, share it with other owners or with your clients. You only share a link: you do not give us, and we do not store, third parties’ contact details on your behalf.

  • When someone signs up through your link, we record the “who referred whom” relationship and when the new account was activated (added a property and scanned a document), so that the reward is credited correctly and abuse is prevented.
  • As the referrer, you see only an anonymous progress view: how many of your invitations are pending and how many were activated. You do not see a name or email, or whether a specific person became a paying subscriber or a professional. Any detailed figures are shown only in aggregate, with no link to a specific person.
  • Legal basis: performance of a contract for crediting the reward (Article 6(1)(b)) and legitimate interest in preventing abuse (Article 6(1)(f)). The legitimate interest assessment is documented in the record of processing activities we keep.
  • You can export your own referral data to an Excel sheet from the program’s tab. Deleting your account deletes it too; if the account of the person who referred you is deleted, the link to you is disconnected.

Rewards are subscription months or extra property slots without charge, not an automated decision with legal effects (Article 22 GDPR). The QR code for your link is generated locally on your device, with no external call or data transfer.

8. Access requests from an accountant or other professional

A professional with an account on the Service (usually an accountant) can send, through the Service, a request for access to the property file of people they know, by entering their email address. If you received such a message, the following applies:

  • What we keep: the email address the sender entered, who entered it, when, and the status of the request (pending, accepted, “No”, withdrawn). Nothing else about you. The sender does not learn whether you have an account and sees none of your data before you accept.
  • Purpose and legal basis: sending the request and keeping your answer, based on the sender’s legitimate interest in contacting you about your property file (Article 6(1)(f)).
  • Retention: if you do not reply, your address is erased from invitations after 90 days. If you answer “No” from an account, we keep it so that you do not receive another request from the same sender, until you delete your account.
  • Objection without an account (Article 21): reply to the message or write to support@properwise.gr or privacy@properwise.gr. From then on you will not receive a request from any sender. Your address is erased from invitations and the message queue, and we keep only a cryptographic fingerprint of it (SHA-⁠256). The fingerprint is pseudonymised personal data (not anonymous) and we keep it indefinitely as proof of your objection, so that we can honour it (Articles 17(3) and 21).
  • If you accept: the sender sees your file read-only, as with the accountant link above, and you can revoke access whenever you like.

9. Artificial intelligence (AI)

When you use Noa or automatic document reading, we send the AI provider (Anthropic, United States):

  • your question
  • the financial and technical details of your properties, itemised expenses and rents
  • up to 50 of your clients or guests, with full name, stay history, revenue, damage, budget, needs and the note from the last stay
  • the name and trade of up to 60 of your contacts (technicians, providers)
  • the documents and photos you scan

The myAADE import reads the PDF file only on your device. The file is not sent and not stored. We keep only the details you confirm (properties and the ENFIA amount). The tax number (AFM) on the assessment is not stored. To support undo and the daily limit, we keep the fact that the import happened, with nothing from the file’s content.

The phone numbers and tax numbers (AFM) of your clients and contacts are not sent to the AI provider; the provider sees only whether they exist. If you type a number in your question yourself, it goes with the question, and the app sends only the name of the person it matches. This is also third-party data; if you do not want it transferred, do not use Noa or document scanning.

We do not use your data to train models. The AI provider is contractually bound not to train models.

AI answers are supportive and indicative. No automated decisions producing legal effects for you, within the meaning of Article 22 GDPR, are made; every action stays under your control and you can correct it.

Each subscription includes a set number of questions to Noa per day and per month, in line with the subscription; the no-subscription plan does not include them and accounts on trial have a lower limit. Document scans are counted separately: 5 a month on the no-subscription plan, 30 a month on the trial and in months without charge (months from the invitation program, partner status), with no monthly limit on paid subscriptions. When the limit runs out, the app tells you and questions renew in the next cycle. Depending on the question, a different model from the same provider is used: the choice concerns speed and cost, not which data is transferred.

C. Where it goes, how long it stays, how it is protected

10. Recipients and processors

We do not sell your data. We share it only with the providers below, and the role of each is stated. A processor acts only on our behalf and on our instructions. An independent controller decides for itself about the data it receives, and its own privacy policy applies to that data.

  • Supabase (European Union, Frankfurt), processor. Legal entity: Supabase Pte. Ltd (Singapore). The database, authentication and the files you upload. The Service’s system of record.
  • Vercel (United States, global network), processor. Legal entity: Vercel Inc. Hosting and delivering the app on the internet, and cookie-free traffic measurement (Vercel Web Analytics).
  • Resend (United States), processor. Legal entity: Plus Five Five, Inc. Sending all email messages: transactional, obligation reminders, monthly statements containing tenant names and amounts, newsletters. Receiving email: what you forward to your account’s receiving address, so that it can be suggested as expenses; and what you send to our contact addresses.
  • Anthropic (United States), processor. Legal entity: Anthropic Ireland, Limited (for EEA customers). Noa and document reading: your question, property details, expenses and rents, names and history of up to 50 clients and 60 contacts (without phone numbers or tax numbers) and any document or photo you scan.
  • GitHub (United States), processor. Legal entity: GitHub, Inc. The code and the encrypted database backup.
  • Sentry (United States or European Union), processor. Recording app errors.
  • Browser notifications (Google / Apple / Mozilla / Microsoft) (United States and European Union), processor. Browsers’ notification services. They deliver the notification to your device, only if you have asked for it. The text travels encrypted with keys generated by your own browser: they deliver a sealed envelope and do not read the content.
  • Google (United States), independent controller. Legal entity: Google LLC. Signing in with a Google account, if you choose it. Your IP address becomes known there. The map in the contact file opens in Google Maps only when you tap it. The fonts of printable reports are hosted by us and are not sent to Google.
  • Creem (United States and European Union), independent controller for the payment and the tax details, processor for everything else. Charging subscriptions as merchant of record: it sells the subscription in its own name, issues the receipt and remits the VAT. Card details are handled exclusively by Creem and never pass through our servers.
  • Planned but not active today, meaning they process no data: Mobile messaging (Viber / WhatsApp / Apple Messages).
  • No external service for QR codes: every QR (payment link, contact card, inventory label) is generated locally on your device.

Before we add a new provider, we notify you by email.

The same list appears on the “About us” page. We may also disclose data where required by law, a competent authority or a court.

11. International transfers

The system of record (database, authentication, files) is inside the European Union, in Frankfurt. Some providers, however, process data in the United States: the encrypted backup, questions to Noa, sending email, and hosting and delivering the app.

Data processing agreements containing the Standard Contractual Clauses (SCCs) of Article 46 GDPR were signed with Supabase, Resend and Anthropic on 23 Sep 2026. A data processing agreement has also been signed with GitHub, where the encrypted backup is kept; the backup key is kept with the same provider. With Vercel, which hosts the app, no data processing agreement has been signed yet: the hosting plan in use today does not provide for one. It is pending, together with the move to a professional hosting plan. Signing in with Google takes place with Google as an independent controller.

Article 13(1)(f) GDPR gives you the right to see the safeguards themselves, not just to learn that they exist. Ask for them at privacy@properwise.gr and we will send you a copy of the Clauses for each provider, redacting only commercial terms that do not concern the protection of your data.

12. Retention

We keep your data only for as long as necessary:

  • Account and property data: for as long as your account exists.
  • An account without an active subscription continues on the no-subscription “Owner” plan and is kept, with its data, until you delete it yourself. It is not deleted automatically for not paying.
  • After your account is deleted: the data is deleted from the database immediately. The encrypted backups that contain it are deleted automatically within 30 days.
  • Guest check-in details: for as long as the property they belong to exists; they are deleted with the property or with your account.
  • Maintenance requests from the tenant portal: for as long as the property exists; they are deleted with it or with your account.
  • Security activity log: at the latest until your account is deleted.
  • Email preferences and unsubscribes: for as long as your account exists, so that we do not send you again what you stopped; they are deleted with it.
  • Tax and accounting documents: kept for as long as tax law requires (as a rule, up to five years).
  • Invitation program data (the “who referred whom” relationship, rewards): for as long as your account exists, and deleted with it.
  • Access requests from a professional: the address of anyone who did not reply is erased after 90 days; the fingerprint of an objection stays as proof of it (see the section “Access requests from an accountant or other professional”).

13. Data security

We apply appropriate technical and organisational measures: encryption in transit (TLS), data isolation through Row Level Security at the level of the database itself, so that each account sees only its own data (and, if you work with a team, only what you have explicitly shared with its members), access control and regular backups. Although no method is completely invulnerable, we work continuously to protect your data.

14. Data breaches

In the event of a breach that poses a risk to your rights and freedoms, we will notify the Hellenic Data Protection Authority (HDPA) within 72 hours and, where required, inform you without undue delay.

D. What you can do

15. Your rights

Under the GDPR you have the following rights:

  • Access: you learn what data we hold about you and how we process it.
  • Rectification: you correct inaccurate or incomplete data yourself. Your full name can be changed once a month, for security reasons; if you need a correction sooner, write to us and we will make it without delay.
  • Erasure (“right to be forgotten”): under the conditions of the law, by permanently deleting your account from within the app.
  • Restriction of processing: write to us at privacy@properwise.gr and we will reply within one month at the latest.
  • Portability: you download all your records in one JSON file at any time from “Account” · “Data and privacy” · “Export everything”. Most tabs also offer an Excel export, and you download uploaded files from the Property File.
  • Objection (Article 21 GDPR): you may object, on grounds relating to your particular situation, to processing based on our legitimate interest (security and improvement of the Service, traffic measurement, backups, preventing abuse of the invitation program, access requests from a professional). Newsletters rely on consent, which you can always withdraw without giving a reason: the unsubscribe link in every message is enough.
  • Withdrawal of consent: where processing relies on it, with no retroactive effect. Contribution to community data is off by default and only you turn it on, with a switch under “Account” · “Data and privacy”, where you can also turn it off whenever you like. We record when you turned it on, so that it can be shown that consent was given by you.

You exercise access, portability, rectification, erasure and withdrawal of consent yourself, under “Account” · “Data and privacy”. For anything else write to us: we reply without delay and within one month at the latest, as Article 12(3) GDPR requires.

16. Right to lodge a complaint

If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA): 1-⁠3 Kifisias Avenue, 115 23 Athens, Greece, tel. +30 210 6475600, website www.dpa.gr.

E. Details you should know

17. Cookies and similar technologies

We use only the sign-in session cookies, prefixed “sb-”. They are set by the authentication provider (Supabase), keep you signed in, are deleted when you sign out or the session expires, and are not read by third parties. The session may be split across more than one cookie because of its size, and signing in with Google adds a temporary one, for the security of the return. They are strictly necessary for the service you request, so Article 4(5) of Greek Law 3471/2006 does not require consent: without them you cannot stay signed in.

Your browser’s local storage (localStorage) also holds: display and screen preferences (e.g. light or dark theme), the optional history and memory of your conversations with Noa, recent searches, calculation drafts, which reminders you dismissed, a visit counter for the app install prompt and the indication that you have seen this notice. They do not leave the device. We do not use third-party advertising cookies, analytics cookies or any marketing tracking. That is why the notice you see on your first visit does not ask you to choose: it informs you and closes, because there is nothing to reject.

To know what works and what doesn’t, we measure traffic with Vercel Web Analytics, which works without cookies and without identifying you: it records only aggregate figures (how many views a page had, from which country or device, from which link the visitor arrived), never who you are, never your path across websites, never a personal identifier. Because it neither stores nor reads anything on your device, Article 4(5) of Greek Law 3471/2006 does not require consent; the legal basis is our legitimate interest in improving the Service (Article 6(1)(f) GDPR). Pages with a secret in their address (tenant, accountant or document verification links) are excluded from measurement entirely. From the address, only the page is sent and, where present, the five utm_ campaign parameters (which post the visitor came from); no other parameter. On the sign-up page we additionally keep, in our own database, only daily counters: how many times each sign-up step happened, from which source category (e.g. Instagram, search), from inside an app or not, and from a phone or not. We keep no row per visitor, IP address, identifier or cookie, so no number can be linked to a person.

To know whether the Service is useful, we record in our own database which key steps your account took (e.g. added a property, produced a report) and when you signed in, without amounts, names or other content. We use them only in aggregate, as weekly counts. Legal basis: legitimate interest (Article 6(1)(f) GDPR). They are deleted with your account.

18. Minors

The Service is intended for adult property owners and small offices. The Terms of use require an age of at least 18 and legal capacity, so we do not create accounts for minors.

An exception you should know about: the guest pre-arrival form may record details of minors accompanying the guest, as the stay declaration requires them. The host who created the link is responsible for its lawfulness.

19. Business transfer

If the Service is transferred to another company (through acquisition, merger, demerger or sale of assets), the personal data we hold forms part of the transferred assets and passes to the successor. The legal basis is our legitimate interest in the continuity of the business and of the Service we provide to you (Article 6(1)(f) GDPR).

The successor is bound to comply with this Policy for the data it receives. It may not use the data for a purpose incompatible with the one for which it was collected without informing you again and, where required, obtaining your new consent.

You will be informed before the transfer takes effect in respect of your data, within the app and by message to your address. Until then, and at any time, you can download all your data or permanently delete your account with one button from your Account.

20. Changes to this policy

We may update this Policy. Every change updates the version and the date at the top of this page. For material changes we inform you before they take effect and tell you what changes.

21. Contact

For questions about this Policy or the processing of your data, write to us at privacy@properwise.gr. Your messages are read and answered by a person.

About usTerms of useLast updated: October 2026