Data processing agreement
How we process your tenants’ and suppliers’ data on your behalf. Last updated: 8 Nov 2026.
This is a translation: if it differs from the original, the Spanish version prevails.
1. Who is who
When you store other people’s data in the app (your tenants, their guarantors, your suppliers, your invited people), you are the data controller and Company name: pending is your data processor. This contract complies with article 28 of the General Data Protection Regulation (GDPR) and you accept it when you create your account.
2. What we process on your behalf
- Purpose: storing, organising and showing you the data and documents of your rentals, reading the invoices you scan with AI, preparing summaries and sharing them with whoever you decide.
- Which data: identification and contact details (name, ID card, NIE or tax ID, email, phone), financial data (rent, deposits, payments, payslips, annual accounts, creditworthiness), contractual data (contracts and their paperwork) and supplier details.
- Whose: tenants and their guarantors, co-owners, suppliers, accountants and invited people.
- How long: for as long as you have the account.
Don’t upload health data or other special categories of data: the app doesn’t need them.
3. What we commit to
- Process the data only to provide the service and following your instructions, which are the ones you give by using the app.
- Ensure that anyone working with it keeps it confidential, also afterwards.
- Protect it (art. 32 GDPR): encryption in transit and at rest, servers in the European Union, access by person and by property, links that expire and a log of changes.
- Help you respond to those people’s rights (access, rectification, erasure…) and, if needed, with the impact assessment.
- Tell you without delay, and within 48 hours at most, if there is a security breach affecting your data.
- Give you the information you need to show that we comply, and allow reasonable audits with prior notice.
- When it ends, let you download the data and delete it within 30 days, except what the law requires us to keep.
4. Sub-processors
You authorise us to use these companies, which sign the same obligations with us. If we add or change any, we give you 30 days’ notice; if you don’t agree, you can close your account.
| Company | Purpose | Where |
|---|---|---|
| Supabase, Inc. | Database, account access and files | European Union (Paris). US company: standard contractual clauses |
| Vercel, Inc. | Hosting the app | European Union (Paris) and global delivery network. US company: EU-US Data Privacy Framework and standard contractual clauses |
| Anthropic, PBC | AI reading of the invoices and receipts you scan. It does not use the data to train its models | United States: standard contractual clauses |
| Functional Software, Inc. (Sentry) | Error reports from the app, without your personal data | European Union (Frankfurt) |
| Stripe Payments Europe, Ltd. | Charging for plansOnce payments are switched on | Ireland |
| Resend (Plus Five Five, Inc.) | Sending emails: sign-in codes, invitations and remindersOnce our own email is set up | United States: standard contractual clauses |
5. What is up to you
- Have a legal basis for storing that data (usually, the tenancy agreement).
- Tell those people that you use this app; you can link to our privacy policy.
- Store only what is necessary and choose carefully who you invite.
6. Contact
For anything about this contract, Contact email: pending.