Privacy Notice

Wesley Baumann, trading as Baumann Property Managment, is the data controller for personal data about our account holders and website visitors — we decide why and how that data is processed. Contact: baumann.property@outlook.com.

For personal data that you upload about your own tenants, owners, vendors and other contacts, you are the controller and we act as a processor on your behalf, processing that data only to provide the service to you and on your instructions.

• Account data (name, email address, hashed login credentials, workspace and role membership) — to create and secure your account, provide the service, and manage workspace permissions. Legal basis: performance of our contract with you.
• Content you enter (properties, units, leases, tenant and owner contact details, payments, expenses, documents, messages, notes) — to deliver the functionality you have asked for. Legal basis: contract performance; for third-party contacts you enter, your own lawful basis as controller.
• Support and contact messages (your message, email address, name) — to answer your enquiries. Legal basis: contract performance and legitimate interests.
• Technical and security data (IP address, device and browser information, timestamps, authentication events, error and audit logs) — to keep accounts secure, detect and prevent fraud or abuse, and diagnose faults. Legal basis: legitimate interests in the security and integrity of the service.
• Usage data (features used, pages viewed, aggregated activity) — to understand how the product is used and improve it. Legal basis: legitimate interests.
• Subscription and entitlement data (plan, status, renewal dates, add-on quantities, subscription identifiers received from our payment provider) — to give you the correct level of access and to manage renewals and cancellations. Legal basis: contract performance and legal obligation.
• Marketing communications, where you have asked to receive them — sent only with your consent, which you can withdraw at any time.

We do not use your data to train third-party machine learning models. Where AI-assisted features are used, the relevant content is sent to our AI provider only to generate the output you requested.

• Service providers / subprocessors — hosting, database, storage, email delivery, error monitoring and support tooling, acting on our instructions under written data processing terms.
• Paddle.com — our Merchant of Record. Paddle handles the sale of our subscriptions, checkout, payments, subscription management, invoicing, tax compliance and refunds, and acts as controller for that payment relationship. Card details are collected and processed by Paddle, never by us.
• Professional advisers — legal, accounting and audit advisers where needed.
• Authorities — where we are required to disclose data by law or to defend legal claims.
• Successors — a buyer or successor entity in a merger, acquisition or reorganisation, subject to this notice.

We do not sell personal data.

We aim to keep data hosted within the EU/EEA. Where a provider processes data outside the EU/EEA or the UK, we rely on an adequacy decision or on Standard Contractual Clauses together with additional technical and organisational safeguards such as encryption in transit and access restrictions.

• Account and workspace content: for as long as your account is active.
• After account closure: deleted or anonymised within 90 days, unless a longer period is required by law or to resolve a dispute.
• Invoices, billing and tax records: retained for the statutory period required in Luxembourg (generally 10 years); these are primarily held by Paddle as Merchant of Record.
• Security, authentication and audit logs: typically up to 12 months.
• Contact and support messages: up to 24 months after the enquiry is resolved.

If you are in the EU/EEA or the UK you have the right to access your personal data, to have inaccurate data corrected, to request erasure, to restrict or object to processing (including processing based on legitimate interests), to data portability, and to withdraw consent where processing is based on consent. You may also lodge a complaint with a supervisory authority — in Luxembourg, the Commission nationale pour la protection des données (CNPD).

To exercise a right, email baumann.property@outlook.com. We will respond within one month; if the request is complex we may extend this and will tell you why. Account holders can also export much of their data directly from the platform, and delete records themselves.

We apply appropriate technical and organisational measures: HTTPS/TLS encryption in transit, encryption at rest by our hosting provider, hashed passwords, per-user authentication with email confirmation, role-based access control, database row-level security so workspaces are isolated from one another, private document storage with time-limited access links, and audit logging. No system is completely secure, so please use a strong unique password and tell us immediately if you suspect a compromise. More detail is available on our Trust & Security page.

We use strictly necessary cookies and browser storage to keep you signed in, remember your active workspace and protect against abuse. These are required for the service to work and are not used for advertising. Our checkout provider Paddle may set its own cookies during a purchase — see Paddle's cookie notice. We do not use advertising or cross-site tracking cookies. You can clear cookies and site storage in your browser settings at any time; doing so will sign you out.

The platform is a business tool and is not intended for children. We do not knowingly collect personal data from anyone under 16 as an account holder.

We will update this notice when our practices change and will revise the "last updated" date. For any privacy question or request, contact Wesley Baumann at baumann.property@outlook.com.