Trust

About us

Version 4 Oct 2026 · Last updated: October 2026

We ask for your tax number, your leases and your income. There is no reason to trust us with them unless you know who we are, where they go and what we don’t do with them. Here we say it as openly as we can, with no small print, including the exceptions that don’t flatter us.

1. A. Who we are

Our details

Operator details
Trade name	PROPERWISE
Support	support@properwise.gr

PROPERWISE is operated by a natural person. Their full name, address and tax number (AFM) have not been published yet. They will be added here once finalized. Until then, write to support@properwise.gr about anything.

2. B. Where it goes

Where your data is stored

The system of record (the database, sign-in credentials and the files you upload) sits on servers in the European Union, in Frankfurt. Traffic to and from the app is encrypted with TLS. Encryption at rest is provided by the hosting provider’s infrastructure (Supabase): we don’t control it and we don’t present it to you as our own guarantee.

One exception to TLS, because you choose it: if you connect a booking calendar (iCal) that its provider serves over http://, syncing happens as that provider serves it, unencrypted. And not everything stays in the EU; we would rather you read it here than discover it:

The encrypted backup is kept on US infrastructure (GitHub). It is encrypted with AES-⁠256 and can’t be read without the key. You should also know this: the key is kept as a secret with the same provider, so the encryption doesn’t keep the backup closed to the provider itself.
Your questions to Noa, together with a summary of your property, tenant, client and contact data (names and history, without phone numbers or tax numbers), and any document or photo you upload to be read (Anthropic: contract with Anthropic Ireland, Limited, processing in the US).
The emails the service sends (reminders, notifications, monthly statements). They contain tenant names and amounts and pass through the sending provider (Resend, US).
The app itself is served from a global network (Vercel, US), so each of your requests passes through it on the way to the database.

3. How it is protected

How it is protected

You see your own data, and only what you choose to share

Every row in the database is governed by access rules at the level of the database itself (Row Level Security), not only by the app. Even if someone sent a request by hand, the database would return only what belongs to them. Your data is accessible only to people you choose: your team members, if you work with a team, and anyone with a portal link you created.

Your documents in a private space, with one exception we tell you about

Leases, documents and receipts you upload sit in a private, isolated space per user. The exception: your avatar, logo and inventory photos are stored in a public space; only you can upload or delete them, but anyone with the link can view them without signing in. Don’t upload anything there you wouldn’t show.

Daily backup

The process runs every day and encrypts the backup with AES-⁠256 before it is stored. It is designed to fail rather than upload an unencrypted file: an encrypted backup or none. A second automated check confirms every day that the backup really happened and really is encrypted, because a backup that stopped silently is as good as none.

Two-step verification

You can turn on two-step verification (TOTP) from your Account, with any authenticator app.

Security activity log

Actions that affect your account’s security (password change, turning two-step verification on or off, signing out of all devices, team membership changes) are logged and you can see them yourself in your Account.

4. Who touches it

Who else is involved

These providers process data with us. “Processors” act on our behalf; “independent controllers” decide for themselves about the data they receive. Each one’s role is set out in the Privacy Policy.

Data processing agreements containing the Standard Contractual Clauses (SCCs) of Article 46 GDPR were signed with Supabase, Resend and Anthropic on 23 Sep 2026. A data processing agreement has also been signed with GitHub, where the encrypted backup is kept; the backup key is kept with the same provider. With Vercel, which hosts the app, no data processing agreement has been signed yet: the hosting plan in use today does not provide for one. It is pending, together with the move to a professional hosting plan. Signing in with Google takes place with Google as an independent controller.

Before we add a new provider, we tell you by email.

Providers that process data
Provider	What it does	Where
SupabaseSupabase Pte. Ltd (Singapore)	The database, authentication and the files you upload. The Service’s system of record.	European Union, Frankfurt
VercelVercel Inc.	Hosting and delivering the app on the internet, and cookie-free traffic measurement (Vercel Web Analytics).	United States, global network
ResendPlus Five Five, Inc.	Sending all email messages: transactional, obligation reminders, monthly statements containing tenant names and amounts, newsletters. Receiving email: what you forward to your account’s receiving address, so that it can be suggested as expenses; and what you send to our contact addresses.	United States
AnthropicAnthropic Ireland, Limited (for EEA customers)	Noa and document reading: your question, property details, expenses and rents, names and history of up to 50 clients and 60 contacts (without phone numbers or tax numbers) and any document or photo you scan.	United States
GitHubGitHub, Inc.	The code and the encrypted database backup.	United States
GoogleGoogle LLC	Signing in with a Google account, if you choose it. Your IP address becomes known there. The map in the contact file opens in Google Maps only when you tap it. The fonts of printable reports are hosted by us and are not sent to Google.	United States
Sentry	Recording app errors.	United States or European Union
Creem	Charging subscriptions as merchant of record: it sells the subscription in its own name, issues the receipt and remits the VAT. Card details are handled exclusively by Creem and never pass through our servers.	United States and European Union
Browser notifications (Google / Apple / Mozilla / Microsoft)	Browsers’ notification services. They deliver the notification to your device, only if you have asked for it. The text travels encrypted with keys generated by your own browser: they deliver a sealed envelope and do not read the content.	United States and European Union
Planned, not active today
Mobile messaging (Viber / WhatsApp / Apple Messages)	Notifications on mobile. Not switched on.	To be set per provider before activation

Supabase
Supabase Pte. Ltd (Singapore)
What it does
The database, authentication and the files you upload. The Service’s system of record.
Where
European Union, Frankfurt
Vercel
Vercel Inc.
What it does
Hosting and delivering the app on the internet, and cookie-free traffic measurement (Vercel Web Analytics).
Where
United States, global network
Resend
Plus Five Five, Inc.
What it does
Sending all email messages: transactional, obligation reminders, monthly statements containing tenant names and amounts, newsletters. Receiving email: what you forward to your account’s receiving address, so that it can be suggested as expenses; and what you send to our contact addresses.
Where
United States
Anthropic
Anthropic Ireland, Limited (for EEA customers)
What it does
Noa and document reading: your question, property details, expenses and rents, names and history of up to 50 clients and 60 contacts (without phone numbers or tax numbers) and any document or photo you scan.
Where
United States
GitHub
GitHub, Inc.
What it does
The code and the encrypted database backup.
Where
United States
Google
Google LLC
What it does
Signing in with a Google account, if you choose it. Your IP address becomes known there. The map in the contact file opens in Google Maps only when you tap it. The fonts of printable reports are hosted by us and are not sent to Google.
Where
United States
Sentry
What it does
Recording app errors.
Where
United States or European Union
Creem
What it does
Charging subscriptions as merchant of record: it sells the subscription in its own name, issues the receipt and remits the VAT. Card details are handled exclusively by Creem and never pass through our servers.
Where
United States and European Union
Browser notifications (Google / Apple / Mozilla / Microsoft)
What it does
Browsers’ notification services. They deliver the notification to your device, only if you have asked for it. The text travels encrypted with keys generated by your own browser: they deliver a sealed envelope and do not read the content.
Where
United States and European Union

Planned, not active today (1)

Mobile messaging (Viber / WhatsApp / Apple Messages)
What it does
Notifications on mobile. Not switched on.
Where
To be set per provider before activation

5. C. What we don’t do

What we never do

We don’t sell your data. We don’t rent it out or give it to advertising networks. Our revenue comes from subscriptions.

We don’t store card details. Card details are handled exclusively by Creem and never pass through our servers: payment takes place in its own environment and we receive only the confirmation.

We don’t open your files. There is no internal tool for browsing customer data. Access happens only at your own support request or where the law requires it.

We don’t send your whole database to Noa. We do send quite a lot, and we would rather you know: a summary of your properties, tenant, clients and contacts (names and history; phone numbers and tax numbers stay in our database and are not sent to the AI provider, unless you type them into your question), and any document or photo you upload to be read. This is also other people’s data; if you don’t want that, don’t use Noa or document scanning.

We don’t train models on your data. The AI provider is contractually bound not to train models on it.

We don’t lock you in. You download all your records as one JSON file with a single button, download uploaded files separately from the Property File, and delete your account without having to write to us.

6. What you can do

Your rights, in practice

You exercise most GDPR rights yourself from Account · Data and privacy; for the rest, write to privacy@properwise.gr.

Access and portability: you download all your records as a JSON file any program can read. Documents you uploaded are downloaded from the Property File.
Correction: you correct every field yourself, without a request. The only exception is your full name, which can change once a month for security reasons; if you need it corrected sooner, write to us and we do it without delay.
Erasure: permanent deletion of your account and data, from the app itself.
Withdrawing consent: “Contribute to community data” is off by default; only you turn it on, with one switch, and turn it off whenever you like.
Objection and restriction: write to us and we reply within one month at the latest.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

7. How to reach us

How to reach us

A person reads and answers your messages. If something doesn’t work, or something here seems unclear, write to us.

Contact addresses
Support	support@properwise.gr
Personal data	privacy@properwise.gr
Security vulnerability reports	security@properwise.gr

Found a security gap? Write to us and give us 90 days before you make it public. We confirm receipt within 3 business days, reply with an assessment within 10, keep you updated every 14 days while it is open and credit you by name once it is fixed, if you wish. We commit not to take legal action against a researcher who acts in good faith and doesn’t access other people’s data. The full terms, including what is in and out of scope, are in our vulnerability disclosure policy.