1. General Information

This web application ("Eloora") processes personal data exclusively in accordance with applicable data protection laws, in particular the GDPR. This privacy policy explains what data is processed for what purpose and what rights you have.

2. Data We Collect

Registration & Login

To use the app, registration with an email address and password is required. This data is used exclusively for managing your user account.

Passwords are stored encrypted (via Supabase Auth with bcrypt).

Rental Administration Data

As a landlord using Eloora, you enter information about your legal entities, sites, garages, tenants (including names, contact details, and IBANs), leases, and payment history. This data is processed on your behalf to provide the administration features of the app.

Bank Data

You can connect your legal entities' bank accounts to Eloora. Signing in to your bank and approving the access happen only in BANKSapi's form. Eloora never sees your online banking credentials and stores neither a password nor an access key for your bank accounts. From the connected accounts we store the transactions in both directions (booking and value date, amount, the counterparty's name and IBAN, remittance information, and the bank's references and transaction code), but not the bank's posting text. We also store one booked balance per account and day, a log of every retrieval (period, counts and, for a failure, its kind), and for which days an account's transactions are complete. We use this data to match payments to leases, confirm payouts, reconcile accounts, and show it to you. The transactions also contain third parties' data, such as your tenants' names, IBANs and remittance information. We process this data on your behalf as well.

For the steps you trigger yourself (connecting an account, refreshing its data, disconnecting, sending a transfer), we pass your public IP address to BANKSapi, because the banks require it as proof. We do not store it for this, and neither does BANKSapi. The automatic retrievals, hourly during the day, send no IP address.

Documents

Eloora creates and stores documents for your leases, for example lease agreements and cover letters, signed copies you upload, handover protocols, dunning letters, termination letters, and receipts. These files are processed on your behalf (Art. 6 para. 1 lit. b GDPR) and stored encrypted at rest with our storage provider Supabase in Frankfurt am Main (AES-256 encryption). Only the members of your organization can open them, through the app.

AI Assistance

Eloora uses AI in four places: in the chat with Eloora, when you read in a document of your own as a template, when you upload an invoice and when you upload a photo for a listing. In the chat we send your messages, attached files and the data of your organization that Eloora reads for its answer (tenant data included) to Anthropic, PBC (USA), which processes them with its Claude model. Anthropic does not use this data to train its models. We store your chats in our database at Supabase in Frankfurt am Main. Only you can see them, not even other members of your organization. We store attached files with the chat, so that Eloora can still read them in later messages, and delete them with the chat or your account. When you read in a document of your own as a template and have placeholders suggested, we send its text once to Anthropic, including any names and addresses in it, so that Claude suggests where placeholders belong. The file itself never leaves your device, and we do not store the text. When you upload an invoice, we send the file once to Anthropic so that Claude reads the supplier, IBAN, amount, invoice number, invoice date, due date and addressee. You check these details before anything is paid. We store the invoice and its details in your organization at Supabase in Frankfurt am Main. Anthropic does not use this data to train its models either. When you upload a photo for a listing, we send it once to Anthropic so that Claude describes what it shows. The phone assistant reads that description to callers who ask about the photos. Claude does not describe people, licence plates or names. We store the description in your organization at Supabase in Frankfurt am Main and delete it with the photo. Matching your bank transactions to leases works without AI.

Voice input in the chat

When you dictate a message in the chat, your browser records your voice after you allow microphone access. When you confirm the dictation or the recording ends on its own, we send it through our server to Mistral AI, where Voxtral turns it into text. Recording also ends after ten minutes, when you put the app in the background or when the microphone is interrupted. Discard cancels the recording or transcription. The text goes into your input field for you to review and edit. It becomes a chat message only when you send it. We do not store an audio file in Eloora or write the recording or recognized text to server logs. If transcription fails, the recording stays temporarily in your browser's memory so you can try again. We release that copy after successful transcription, when you discard it or when you leave the chat.

Feedback

When you write to us through “Feedback”, we email your message and your attachments to our inbox, together with your name, your email address, your organization with your role and plan, details about your device (type, operating system, browser, window and screen size, language, time zone) and the page you were on. A confirmation goes to your address. We store none of it in Eloora itself.

Notifications on your device

If you turn on notifications for a device under Settings › Notifications, we store for that device the address its browser's push service assigns, the keys that belong to it, the app's language and your browser's identifier (user agent). So that we notify you only when you left the app while Eloora was answering, the page reports during an answer whether it is visible; we delete this information after one day at the latest. A notification carries only the chat's title and a fixed sentence, never the content of the answer, and is encrypted for your device. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with the switch.

Eloora's Tools (MCP Server)

Eloora reads and changes your organization's data through our own MCP server, always on behalf of the signed-in member. Eloora carries out a change only after you agree in the chat. The server runs on Railway in the Netherlands and accepts requests from the Eloora app only. You cannot connect an AI assistant of your own, such as Claude, at the moment.

Server Logs

The hosting provider Vercel may collect technical data (for example, IP address, browser type, access time) to ensure the operation of the app.

Error Reports

When an error occurs in the app or the MCP server, we send an error report to Sentry: the error message, the technical trace, browser and operating system, the address called without parameters, and a pseudonymous user and organization ID. Your IP address, form contents, cookies and local variables are not included. IBANs, email addresses, IP addresses and access keys in error messages are replaced with placeholders before sending.

3. Purpose of Data Processing

• Providing the administration features (legal entities, sites, garages, tenants, leases, payments, documents)
• User account management and authentication
• Retrieving the transactions of connected bank accounts, matching payments to leases, confirming payouts, and reconciling accounts
• AI support in the chat with Eloora, including turning your dictation into text, in suggesting placeholders for a document of your own that you read in as a template, and in reading uploaded invoices
• Sending emails: notifications about your account and letters you send to your tenants through Eloora
• Handling your enquiries and feedback
• System security, bot protection, and error analysis

4. Legal Basis

Processing is based on Art. 6 para. 1 lit. b GDPR (contract fulfillment) and Art. 6 para. 1 lit. f GDPR (legitimate interest in operating and securing the app).

5. Data Recipients

• Supabase Inc. (authentication, database and file storage; data centre in Frankfurt am Main)
• Vercel Inc. (hosting the app and its server functions, including PDF generation, and aggregate web analytics; server functions in Frankfurt am Main)
• BANKSapi Technology GmbH, Munich (retrieving the transactions and balances of your connected bank accounts and initiating the transfers you confirm with your bank; noris network data centres in Germany, ISO 27001 certified, no transfer to third countries)
• Anthropic, PBC, USA (AI processing through the Anthropic API, for the chat with Eloora, for suggesting placeholders in documents you read in, for reading uploaded invoices, for describing listing photos and for matching the columns of an imported list, which needs only the column names and the shape of each column)
• Apple Inc., Google LLC, Mozilla Corporation or Microsoft Corporation, USA, depending on your browser, only if you turn on notifications (delivery through their push services; they see the device address, the time and the size, not the content)
• Resend (sending emails: notifications about your account, your feedback to us and our confirmation, the newsletter if you subscribed to it, and letters you send to your tenants through Eloora, for example dunning letters)
• Functional Software, Inc. (Sentry, error monitoring for the app and the MCP server; EU data region)
• Railway Corporation (hosting the MCP server in the Netherlands)
• Tally BV, Belgium (contact form)
• Cloudflare, Inc. (bot protection on the signup form via the Turnstile service). When you open the signup form, Cloudflare receives technical signals from your browser (such as IP address, user agent, and interaction metadata) to distinguish humans from automated abuse. See the Cloudflare Turnstile Privacy Addendum for details.

These service providers act as data processors within the meaning of the GDPR, some with headquarters in the USA. GDPR-compliant contracts (standard contractual clauses) exist.

For optional voice input in the chat, Mistral AI receives your voice recording to turn it into text. We use Mistral's EU endpoint for this: model processing takes place in data centres in EU and EFTA countries. This regional commitment does not cover all operational metadata, such as account management, billing and usage analytics.

Acting under its own responsibility, not on our behalf, is BANKSapi as the account information service and, for transfers, as the payment initiation service. BANKSapi holds a licence for this under the German Payment Services Supervision Act (ZAG) and is supervised by BaFin. Signing in to your bank and approving the access follow BANKSapi's terms, which you accept in its form.

6. Data Retention

• User account data: stored as long as your account exists
• Rental administration data (legal entities, sites, garages, tenants, leases, payments): stored as long as your organization exists
• Bank data (transactions, balances, retrieval logs): stored as long as your organization exists. When you disconnect a bank connection, we delete the access at BANKSapi and retrieve nothing more. Transactions already stored remain, because payments and bookings rest on them.
• Lease documents: stored as long as your organization exists. There is currently no automatic deletion after retention periods.
• Chats with Eloora: stored until you delete the chat, at the latest until your account or your organization is deleted
• Dictation: no audio files stored in Eloora; the copy in your browser's memory remains only until successful transcription, until you discard it or until you leave the chat. Text you send then belongs to your chat.
• Devices for notifications: until you turn notifications off, sign out on the device or the push service no longer knows the device, at the latest until your account is deleted
• Server logs by Vercel: according to the provider, maximum 30 days

Deleted data may remain in our database provider's backups until those backups rotate out on their regular schedule. Backups are not used to restore deleted personal data.

7. Your Rights

You have the right at any time to:

• Information about your stored data
• Correction of incorrect data
• Deletion of your data ("right to be forgotten")
• Restriction of processing
• Data portability
• Object to processing

You can delete your account yourself in the account settings (Art. 17 GDPR). This deletes the organizations you own, with all data and files stored in them. If such an organization has other members, you must hand it over or remove the members first. Before that, we have BANKSapi delete all bank accesses and bank data of these organizations, and the technical user through which Eloora retrieves them. If that fails, your account stays.

Please contact us at: team@eloora.io

8. SSL Encryption

The connection to this web app is made via a secure HTTPS connection.

9. Cookies & Tracking Technologies

Eloora uses two categories of cookies and tracking technologies. A full inventory, including vendor, purpose, and retention, is available on the cookies page.

Strictly necessary

We use a Supabase authentication cookie to keep you signed in, the Cloudflare Turnstile bot-protection signal on the signup form, and a localStorage entry that remembers your cookie preferences on this device. These cannot be turned off because the app would not function without them. Legal basis: Art. 6 para. 1 lit. b and lit. f GDPR.

Measurement (legitimate interest, opt-out available)

We use Vercel Analytics to count page views and measure performance in aggregate. No advertising profile is built, no cross-site identifier is set, and no personal data is shared with third parties. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in understanding how the product is used). We have balanced this interest against your privacy rights and concluded that aggregate measurement without personal identifiers is proportionate. You can opt out at any time on the cookies page; opting out stops the beacons being sent.

If we add further measurement tools in the future, they will be added under the same category and gated by your consent.

10. Changes

This privacy policy may be updated as needed. The current version is always available on the website.

Legal Notice (Impressum)

Information according to § 5 TMG:

Janik Dietz
Wolframstraße 25
86161 Augsburg
Germany
Email: team@eloora.io

Responsible for content according to § 55 para. 2 RStV:
Janik Dietz