Legal
Privacy Policy.
Last updated:
We collect the information needed to run Leasemble for property businesses. We do not sell personal data. Landlords and property managers control the tenant and guest records they keep in Leasemble, and we process those records on their behalf.
1. Who we are and what this policy covers
This Privacy Policy explains how Leasemble (“Leasemble”, “we”, “us”) handles personal data in connection with our website at leasemble.com (the “Website”), our property management application at app.leasemble.com and related services (together, the “Service”), and our sales, support and marketing communications.
The Service is intended for businesses. Our customers are landlords, property managers and operators (“Customers”) and the people they authorise to use the Service (“Users”).
2. Our role: controller and processor
Where we act as a controller. We decide how and why personal data is used for Website visitors, prospective customers, Customer account administrators and Users when we manage accounts, billing, security, support and communications. This policy describes that processing.
Where we act as a processor. Customers use the Service to store and manage information about their own tenants, guests, leads, staff, suppliers and other contacts (“Customer Data”). For Customer Data, the Customer is the controller and we process it on the Customer’s behalf and under their instructions, as set out in our agreement with them. Terms such as “service provider” under US state laws have a similar meaning.
If you are a tenant, guest or other person whose details were entered into Leasemble by a landlord or property manager, please read that business’s privacy notice and contact them first to exercise your rights. We will assist the Customer in responding to your request.
3. Personal data we collect
Information you provide
- Account and profile data: name, email address, phone number, password (stored only as a one-way hash), profile photo, job role and, where you choose to add them, date of birth, address and identity document details.
- Business information: company name, properties managed, team size and similar details you share with us.
- Communications: the content of emails, support requests, feedback and meeting notes.
- Commercial information: the plan you use, invoices and payment records. We do not store payment card numbers.
Customer Data we process on behalf of Customers
Depending on how a Customer uses the Service, Customer Data may include: names and contact details of tenants, guests, leads and emergency contacts; dates of birth, gender and nationality; identity card or passport numbers and images; current and permanent addresses; occupation and workplace; bank account details provided for refunds or payments; vehicle details and licence plate images; contracts, handover records, invoices, payments, deposits and meter readings; electronic signature images and signing records; booking and check-in details; and files, photos and comments attached to records. Customers decide what Customer Data to collect and are responsible for having a lawful basis to do so.
Information collected automatically
- Log and device data: IP address, browser and device type, operating system, pages and features used, request details and timestamps. For changes made in the application, we keep an activity log that records which User made the change and when, with sensitive fields such as passwords masked.
- Device tokens: if you enable push notifications, a token that lets us deliver them to your device.
- Browser storage: see “Cookies and similar technologies” below.
Information from third parties
- Sign-in and messaging services: if you sign in through Telegram, we receive your Telegram user identifier and the basic profile details Telegram shares.
- Connected services: if a Customer connects a listing platform calendar (iCal) or its own email server, we receive the booking and delivery information those connections provide.
- Your organisation: an administrator may create an account for you and provide your name, email address, phone number and role.
4. How we use personal data and our legal bases
Where laws such as the EU or UK General Data Protection Regulation (GDPR) apply, we rely on the following legal bases.
| Purpose | Legal basis |
|---|---|
| Create and manage accounts, provide and maintain the Service, and process Customer Data on Customer instructions | Performance of a contract |
| Send service messages, such as sign-in codes, signature requests, security alerts and notifications you configure | Performance of a contract |
| Provide support and respond to enquiries | Performance of a contract; legitimate interests |
| Keep the Service secure, prevent fraud and abuse, and maintain activity logs | Legitimate interests; legal obligation |
| Understand how the Service is used and improve it | Legitimate interests |
| Send product updates and marketing to business contacts | Legitimate interests or consent, as required by law. You can opt out at any time. |
| Invoicing, accounting, tax and responding to lawful requests | Legal obligation |
| Establish, exercise or defend legal claims | Legitimate interests |
Where we rely on legitimate interests, we balance them against your rights and do not use personal data where those rights override our interests. We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.
5. Cookies and similar technologies
The Website does not use advertising or analytics cookies. Our hosting and security provider may set strictly necessary cookies to protect the Website from abuse.
The application uses your browser’s local storage to keep you signed in and to remember preferences such as language and theme. It may also use Google reCAPTCHA to protect sign-in and registration forms from automated abuse. reCAPTCHA collects hardware and software information and sends it to Google, subject to Google’s Privacy Policy.
You can clear local storage and block cookies in your browser settings. Some parts of the Service may not work without them.
6. How we share personal data
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share personal data only as follows:
- Service providers (sub-processors) that help us run the Service under contracts requiring them to protect the data and use it only on our instructions. These include cloud hosting and infrastructure, file storage and content delivery, email delivery, push notifications (Google Firebase Cloud Messaging), bot protection (Google reCAPTCHA) and, where a Customer enables it, messaging through Telegram. A current list of sub-processors is available on request.
- At a Customer’s direction: for example, when a Customer sends a contract or invoice to a tenant, connects its own email server or syncs a calendar with a listing platform.
- Within your organisation: information in a Customer workspace is visible to that Customer’s authorised Users according to the roles and permissions the Customer sets.
- For legal reasons: when we believe disclosure is required by law, regulation or valid legal process, or is necessary to protect the rights, property or safety of Leasemble, our Customers or others.
- Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy’s protections.
- With your consent or at your direction.
7. International data transfers
We and our service providers operate in several countries. Your personal data may therefore be stored and processed outside the country where you live, including in countries whose data protection laws differ from yours.
When we transfer personal data internationally, we take steps required by applicable law to protect it. For transfers from the European Economic Area, the United Kingdom or Switzerland, this includes the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or another recognised transfer mechanism. Customers can request information about where their data is hosted and the safeguards in place.
8. How long we keep personal data
We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, accounting and reporting requirements.
- Account data is kept while the account is active and for a limited period after it is closed, unless a longer period is required by law.
- Customer Data is kept for the duration of the Customer’s agreement. After the agreement ends, we delete or anonymise it in line with that agreement, except where we are required by law to keep it. Customers can export their data before the agreement ends.
- Logs and security records are generally kept for no longer than 12 months, unless needed to investigate an incident.
- Invoices and financial records are kept for the period required by tax and accounting law.
Deleted data may remain in backups for a limited time until those backups are overwritten.
9. How we protect personal data
We use technical and organisational measures designed to protect personal data, including encrypted connections (HTTPS) between your browser and our servers, one-way hashing of passwords, role-based access controls that Customers can configure, and logging of changes made in the application.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that affects you or a Customer, we will notify you, the Customer and regulators as required by law. You can help by keeping your password confidential and signing out of shared devices. Please report suspected security issues to hello@leasemble.com.
10. Your privacy rights
Depending on where you live, you may have some or all of the following rights over your personal data:
- to access it and receive a copy;
- to correct inaccurate or incomplete data;
- to delete it;
- to restrict or object to certain processing, including direct marketing;
- to data portability, meaning a copy in a structured, machine-readable format;
- to withdraw consent at any time, where we rely on consent; and
- to lodge a complaint with your data protection authority.
European Economic Area, United Kingdom and Switzerland
You have the rights listed above under the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection. You can contact your local supervisory authority, although we would appreciate the chance to address your concern first.
United States
If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share personal information as those terms are defined, and we do not use or disclose sensitive personal information for purposes that would require an opt-out. We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request on your behalf. If we deny your request, you may appeal by replying to our decision.
In the past 12 months, we have collected the categories of personal information described in “Personal data we collect”, including identifiers, commercial information, internet or network activity and professional information, for the business purposes described in this policy, and disclosed them to the service providers described in “How we share personal data”.
Other regions
If you live in a country with its own data protection law, such as Vietnam, Singapore, Japan, Australia, Canada, Brazil or South Korea, you have the rights that law provides. Where local law requires consent for a particular processing activity, we will ask for it.
How to exercise your rights
Email hello@leasemble.com with the subject “Privacy request”. We may need to verify your identity before acting on your request, and we will respond within the time required by applicable law. If your request concerns Customer Data, we will refer it to the relevant Customer and support them in responding.
11. Children
The Service is designed for businesses and is not directed to children. We do not knowingly collect personal data from children under 16 for our own purposes. If you believe a child has provided personal data to us, please contact us and we will delete it. Customers are responsible for any information about minors that they choose to include in Customer Data.
12. Third-party websites and services
The Service may link to or integrate with websites and services we do not control, such as listing platforms, messaging apps and email providers. Their privacy practices are governed by their own policies, and we encourage you to read them.
13. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date. If a change is material, we will give Customers reasonable advance notice by email or in the Service.
14. Contact us
For questions about this policy or our privacy practices, email hello@leasemble.com with the subject “Privacy”.