STARTWISE S.à r.l. (“we”), 57 rue des Pommiers, L-2343 Luxembourg, RCS Luxembourg B 280700, is the controller of the personal data collected through the Ownset application (ownset.io). Contact: hello@ownset.io
• Account data: name, email address, password (stored encrypted, never in plain text). • Property data: name and address of the property/properties, location coordinates, photos, detailed characteristics. • Management data: expenses, invoices, contracts, quotes, documents, energy readings, value estimates and loans that you enter or import. • Invited people's data: when you invite a relative or a manager (or, for a manager, when they invite the owner), their email and name (the person issuing the invitation is responsible for having informed them). • Technical data: sign-in logs, IP address, session data. • Subscription data: your plan, its status, the customer identifier at our payment provider (bank details are handled directly by that provider; we do not store them).
• Create and manage your account and authenticate you — performance of the contract. • Provide the property-management service — performance of the contract. • Manage your subscription and billing — performance of the contract and legal obligation. • Send you service communications and support — performance of the contract and legitimate interest. • Ensure the security and proper operation of the application — legitimate interest.
When you import an invoice or a document, its content is sent to our AI provider (Google, via the Gemini API) solely to automatically extract the useful information (amount, date, vendor, etc.). This processing is carried out on demand, to return the extracted information to you; the content is not retained beyond this processing and is not used to train models. You always remain in control of the information that is saved.
We use sub-processors that process data on our behalf: • Supabase — Database hosting, authentication, storage — European Union (Frankfurt) • Cloudflare — Hosting of the application's front end — United States (standard contractual clauses) • Stripe — Payments and subscriptions (Merchant of Record) — European Union and United States (standard contractual clauses) • Google (Gemini API) — AI extraction from invoices and documents — European Union and United States (standard contractual clauses) • OpenStreetMap — Maps and geocoding of addresses — European Union • Kuula / Matterport — Display of 360° tours (loaded at your request) — Depending on the provider
• Account data: for as long as your account is active. • After account deletion: erased within a maximum of 30 days. • Billing data: retained in accordance with legal accounting obligations (up to 10 years). • Technical logs: 12 months.
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability. Most can be exercised directly in the application (viewing, editing, exporting, deleting a property or the account). For any request: hello@ownset.io. You have the right to lodge a complaint with the competent supervisory authority: the Commission Nationale pour la Protection des Données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, Luxembourg — www.cnpd.public.lu.
Some sub-processors (Cloudflare, Stripe, Google) may process data outside the European Union. These transfers are governed by standard contractual clauses approved by the European Commission, ensuring an adequate level of protection.
Data is hosted in the European Union (Supabase, Frankfurt), passwords are encrypted, and access to your data is strictly partitioned: only you and the people you invite can reach it. No one on our team looks at the content of your properties.
Published on 4 September 2026