Privacy policy

Who we are

HomeWend is operated by SimberTech (KvK 94426392), the data controller for the personal data described in this policy. Questions and requests: [email protected].

What we collect

• Account identity. Your login is handled by Auth0 (EU tenant). We receive your email address, name, and profile picture from your login provider.
• Profile and contact details. Display name, contact email, phone number, viewing availability, and target search areas you enter yourself.
• Your home-buying workspace. Homes you import, bid scenarios, journey progress, viewing requests, valuation and notary preparation data.
• Financing profile. If you choose to fill it in: income range, employment type, and available cash, used to rank mortgage advisors for you. You give explicit consent in the form itself, and matching stays generic without it.
• Uploaded documents. Files you add to the document vault (for example payslips or identity documents). They are encrypted at rest with AES-256 before storage and are only readable through your account. We recommend masking your BSN and photo on identity documents before uploading (KopieID style).
• Payment status. If you buy the Journey Pass, payment is processed by Stripe. We store only the payment reference and your entitlement status, never card details.
• Live chat. What you write in the chat widget, handled by Crisp. When you are signed in it also carries your name, email address and profile picture, so we know who we are talking to. The widget loads for every visitor, because it is how you reach support.
• Usage analytics. How the site and the product are used: pages visited, product events, a masked session replay, and rough location derived from your IP address, which is itself discarded and not stored. Runs for every visitor using one first-party cookie; the cookie policy explains the setup and has the opt-out switch.

Why we process it

• To provide the service (contract): your workspace, documents, matching, and payments.
• With your consent: the financing profile.
• Legitimate interest (art. 6(1)(f) GDPR): product analytics, service security, and maintaining our directory of professional offices (makelaars, advisors, valuators) from public sources. Analytics is configured to keep its impact on your privacy minimal, which is why it runs without a consent banner under the Dutch analytics exemption (art. 11.7a lid 3 sub b Telecommunicatiewet): one first-party cookie, EU processing, IP addresses discarded on arrival, no advertising, and no sharing. You can object at any time with the opt-out switch on the cookie policy page, and Do Not Track or Global Privacy Control disables analytics entirely.
• Legal obligation: keeping our administration, invoices included, for seven years (art. 52 Algemene wet inzake rijksbelastingen).

Where your data goes

This is every service that receives data, and what each one actually gets. The last row is files your browser fetches for itself, rather than anything we send.

Two further services are called only by the scheduled job that builds our directory of professional offices, and never receive anything about you: NVM's public office search (hosted by Algolia) and serper.dev, which returns Google Places ratings for those offices.

How long we keep it

Your workspace is kept while your account is active, and deleting your account (below) erases it immediately. Two records outlive the account on purpose:

• Your invoice and payment record at Stripe: seven years. Dutch tax law obliges us to keep our administration, invoices included, for seven years (art. 52 Algemene wet inzake rijksbelastingen). That is a legal obligation, so for as long as it runs we cannot erase those records on request and will not (art. 17(3)(b) GDPR). They hold the name, billing address and email address you gave at checkout and the amount you paid.
• Our record of each payment message from Stripe: 90 days. One row per message, holding your internal account id and the payment reference. It is what stops the same payment being counted twice, so account deletion leaves it alone; it expires by itself 90 days after it arrives.

Server logs and any database backup age out on a rolling basis, so a record already erased from the live database can still sit in a backup until that backup expires.

Your rights

You have the right to access, correct, export, and erase your data, to object to processing, and to withdraw consent at any time.

• Deletion is self-serve. Go to Account → Delete account. It erases, immediately and permanently: your profile, name and contact details, avatar, viewing availability, target areas, selected team, financing profile and its consent, entitlement and interface preferences; your saved homes and journey progress; bid scenarios; valuation outcomes; viewing and intro requests; your document records and packages together with the stored files themselves; and your audit history. It then removes your Auth0 login, so the sign-in stops existing too. That last step is the one part of the deletion that can be left unfinished, and the app says so rather than reporting success when it is (see below). If a stored file cannot be removed we stop before deleting any database record and tell you how many files went and how many did not; the files already removed are gone for good, everything else is untouched, and running the deletion again finishes the job.
• Export is self-serve. Go to Account → Download my data for a JSON file containing your profile, saved homes, bid scenarios, document records, packages, requests and audit history. The uploaded files themselves are not in that file; download those from your document vault.
• Correction is in-app. Your profile, contact details, viewing availability, search areas and financing profile are all editable where they are shown. Facts imported from a listing come from the source and describe the property rather than you, so use Report an issue on the home to flag one.
• Analytics goes with it, best effort. We ask PostHog to delete the person profile matching your sign-in id, together with its events and any session recordings. That one call is allowed to fail without failing your deletion, because a metrics outage must not block a right you are entitled to. When it fails, the miss is logged and the profile is removed by hand.
• Live chat has to be asked for. Deleting your account does not touch Crisp. Your chat profile and the transcripts of your conversations stay on Crisp's servers until we remove them by hand, which we do on request. Email [email protected] and we will delete them.
• Stripe is not erased, and cannot be while the seven years above run. See "How long we keep it".
• If the sign-in is not removed automatically, whether because the call to Auth0 failed or because that step is not switched on for this server, the app tells you so instead of reporting success: your account data is deleted and the login is queued for removal by hand. Until that is done the old credentials still work, and using them starts a fresh, empty account. Email [email protected] for written confirmation that it has been removed.
• Imported listings and our directories of professional offices are shared records rather than your personal data, so they stay. Anonymous listing fact-issue reports contain no link to you and therefore cannot be individually erased.
• You can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Contact

SimberTech (KvK 94426392) · [email protected]