Privacy Policy

1. Who we are

DomusGraph ("we", "us") is the data controller for personal data processed through domusgraph.com. Contact: privacy@domusgraph.com

2. What we collect

Depending on how you use DomusGraph, we collect:

• Account data: your email address, used to sign in via a magic link (we never see or store a password).
• Contribution data: reviews, maintenance issue reports, and property claims you submit, including any ratings, free-text descriptions, and the property they relate to.
• Claim/contact data: if you claim a property as a landlord or property manager, or sign up as a manager, the name, email, and business details you provide.
• Onboarding and feedback answers: free-text answers you give during onboarding or in response to feedback prompts.
• Technical data: IP address (used only for rate limiting to prevent abuse, not stored long-term against your identity), browser/device information, and error reports if the app crashes.

3. Why we process it

• To provide the service — creating your account, publishing your contributions after moderation, showing you your dashboard.
• To moderate content — reviewing pending submissions before they're public, and to investigate disputes.
• To communicate with you — sign-in links, and notifying you when your submission is approved or rejected.
• To prevent abuse — rate limiting and fraud/spam prevention.
• To fix bugs — error monitoring when something goes wrong.

Our legal basis is performance of a contract (providing the service you signed up for) and legitimate interest (moderation, abuse prevention, and keeping the service running).

4. Who we share it with

We use the following processors to run DomusGraph. None of them are permitted to use your data for their own purposes.

• Supabase — database hosting and authentication.
• Resend — sends sign-in links and notification emails on our behalf.
• Sentry — error monitoring, so we can find and fix bugs. Sentry may receive technical details about the error (e.g. a stack trace) but we do not send review or issue content to it.
• Vercel — hosts and serves the application.

We do not sell your data, and we do not share it with advertisers. Some of these processors operate infrastructure outside the UK/EEA; where that's the case, they provide contractual safeguards (such as Standard Contractual Clauses) for the transfer.

5. How long we keep it

We keep account and contribution data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we need to keep a record for legal, dispute-resolution, or fraud-prevention purposes. Rate-limiting data (IP addresses) is held only in short-lived memory and is not retained.

6. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data

To exercise any of these, email privacy@domusgraph.com.

7. Cookies

We use one essential cookie to keep you signed in (set by our authentication provider, Supabase). We don't use advertising or third-party tracking cookies.

8. Children

DomusGraph is intended for adults making housing decisions and isn't directed at children.

9. Security

We restrict database access with row-level security and role-based permissions, and connections to DomusGraph are encrypted in transit. No system is completely secure, but we take reasonable steps to protect your data.

10. Changes

We'll update the date at the top of this page when this policy changes materially.