Privacy

Privacy Policy

HouseControl.at is a Software-as-a-Service platform for digital property management. This privacy policy explains what personal data is processed when visiting, registering for, and using the platform. It applies to the website, the web app, and connected mobile use.

Status: July 2026

1. Controller

2. Roles in data protection

For data collected by property management companies, owners, tenants, or service providers in a building context, the respective property management company or customer is regularly responsible for the legality of the processing. HouseControl.at technically processes this data as a platform operator within the scope of providing the software.

For its own website, billing, support, security, and administration processes, HouseControl.at processes data as the controller.

3. Processed data

Depending on usage, the following data may be processed in particular:

• Account data: Name, email address, password hash, language, role, user ID, MFA status.
• Building and administrative data: Properties, floors, units, assignments, invitations, and roles.
• Communication data: messages, comments, support requests, email notifications, and attachments.
• Functional data: Surveys, votes, signatures of official votes, calendar appointments, documents, house rules, operating costs, and orders.
• Payment and subscription data: Stripe customer number, subscription status, plan, number of units, payment and invoice status.
• Technical data: IP address, browser data, session/cookie data, log data, security events, and audit logs.
• Test mode data: activation time, expiration time, confirmed condition version, IP address, browser identifier, and content created in test mode.
• Support and administration context: support tickets, attachments, processing status, technical context data, active building/unit assignment, and identification of developer simulations.
• Affiliate/Referral data: Partner code, time of call, linked registration, subscription conversion, and hashed IP/browser identifiers for abuse checking.

4. Purposes and legal bases

• Provision of the platform and user accounts: Contract fulfillment or pre-contractual measures.
• Building, role, and communication functions: Contract fulfillment and legitimate interest in secure digital administration.
• Payment processing, invoices, and accounting: Contract fulfillment and legal obligations.
• Security, abuse protection, MFA, audit logs, and error analysis: legitimate interest and legal obligations.
• Notifications, support, and service communication: Contract fulfillment and legitimate interest.
• Optional features such as Google Login, push notifications, or AI/translation functions: depending on configuration, consent, contract fulfillment, or legitimate interest.
• Affiliate/Referral Tracking: Consent for persistent partner cookies; session assignment upon registration during the same visit for contract fulfillment or pre-contractual assignment.

5. Cookies and local storage

The platform uses technically necessary cookies for login, session, security, and cookie settings. Optional analysis or marketing cookies are only used if activated and legally permissible. Browsers can block cookies; technically necessary functions may be restricted as a result.

If a user accesses HouseControl.at via a partner or referral code, a referral cookie may be set after consenting to the “Marketing” category. This cookie contains no payment data, but rather a partner assignment, and serves to trace a later registration or subscription conversion back to a partner. IP address and browser identifier are not stored in clear text but are hashed for this purpose. Without marketing consent, the assignment remains limited to the current visit.

6. Payment processing with Stripe

Payments, subscriptions, and the customer portal are handled via Stripe. Payment, customer, invoice, and transaction data are transmitted to or processed by Stripe. HouseControl.at does not store full credit card data. Changes to subscriptions are synchronized within the platform via signed Stripe webhooks.

Further information: stripe.com/at/privacy

7. Google Login, Push and optional external services

If Google Login is used, HouseControl.at processes the profile data transmitted by Google, in particular email address, name, and Google ID, for login and account linking.

For push notifications, push tokens and technical device identifiers may be processed. If Firebase Cloud Messaging or similar services are activated, data may be transmitted to the respective provider.

AI or translation functions, for example for text suggestions or translations, may transmit content to connected service providers such as Google/Gemini or DeepL. Such functions should only be used for content whose transmission is legally permissible.

To protect public forms from automated abuse, Cloudflare Turnstile may be used. Cloudflare processes technical information about the request to distinguish between legitimate use and bot access.

8. Hosting, logs and backups

The platform is operated on servers within the deployed hosting infrastructure. Server and application logs may contain IP address, timestamp, accessed URL, technical errors, and security-relevant events. Logs serve security, error analysis, and operational stability.

Backups are created to restore the service and deleted according to a defined retention concept. Data deleted in regular systems may technically remain in backups until the backup retention period expires.

9. Recipients and processors

Personal data may be transferred to technical service providers as far as this is necessary for operation, security, payment, communication, or support. This may include, in particular, hosting providers, mail providers, Stripe, Google, Cloudflare, push services, monitoring/error analysis services, and translation or AI services.

Where necessary, agreements according to Art. 28 GDPR are concluded with processors. For transfers to third countries, appropriate safeguards such as adequacy decisions or standard contractual clauses are taken into account.

10. Storage duration

Data is only stored for as long as it is necessary for the stated purposes or legal retention obligations exist. Contract, payment, and accounting data may be stored longer in accordance with legal deadlines. Test mode data is automatically purged after the test period, unless there are legal or security-related reasons to the contrary.

11. Data subject rights

Affected persons have rights under the GDPR to information, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of granted consents. Inquiries can be sent to stephan@landsteiner.info be directed.

12. Right to lodge a complaint

Affected persons can complain to a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority: www.dsb.gv.at.

13. Amendments

This Privacy Policy may be adapted if functions, service providers, legal bases, or technical processes change.