Privacy policy

The controller is Lucien Pochon, Lausanne (Switzerland), publisher of Landlo. For any question about data protection, write to privacy@landlo.ch.

Landlo has not appointed a data protection adviser: the Swiss FADP does not require one of private companies, it provides for one optionally.

For your own data — your e-mail address, your name, your language — Landlo is the controller.

For the data about your tenants that you enter, you are the controller: you decide what information to record and why. Landlo acts as processor, and uses it only to run the service — never for its own ends, never for advertising, never to train a model.

In practice: if a tenant asks you what you hold about them, it is for you to answer. The service gives you the means to do so — everything is visible and editable on screen.

Your account. E-mail address, full name if you provide it, interface language, password (never stored in the clear: only a cryptographic hash is kept).

What you enter. Properties and units; tenants — surname, first name, address, e-mail, telephone; leases, rents, deposits, payments and expenses; documents you upload (signed leases, condition reports, receipts), including photos taken from the application.

Technical logs. An audit log of important actions (creating and amending leases, deleting documents) and a log of e-mails sent, with their delivery status. They exist to answer “what happened, and when”.

Public calculator. The reference-rate calculator is used without an account and without collection. If you ask to be alerted at the next publication, your e-mail address is stored for that purpose alone, and every message carries an unsubscribe link.

Your account data and the data you enter are processed to perform the contract between us: without them there is no service. The technical logs rest on the legitimate interest in running, securing and debugging the service. The calculator alert rests on your consent, which you may withdraw at any time. Audience measurement rests on our legitimate interest in knowing which pages are useful (art. 31 para. 2 let. e FADP), with a one-click refusal.

Landlo sells no data, does no profiling, and takes no automated individual decisions about you. The alerts the service shows are observations about your own data, together with their calculation and their source.

Landlo measures the audience of its pages with Vercel Web Analytics: the page viewed, the page you came from, an approximate location (country, region, city), operating system, browser and device type, as aggregated statistics. The part of the address after the "?" is never transmitted. No cookie is set for it, no profile is built, and the technical fingerprint that tells two visits apart is discarded after 24 hours. You can refuse in the banner or under Settings › Cookies. There is no Google Analytics, no pixel, no tag manager.

Five cookies only, all strictly necessary — none set by a third party:

• the session cookie, which keeps you signed in and disappears when you sign out;
• NEXT_LOCALE, which remembers the interface language. One year when you choose it yourself (language switcher, settings, sign-in); for the session only when it is merely inferred from your browser;
• sidebar_state, which remembers whether you collapsed the side menu. Seven days;
• pwd_recovery, set only while a password is being reset. Fifteen minutes;
• landlo-consent, which remembers your choice on audience measurement. One year.

Typefaces are served from our own domain: no request goes to Google from your browser.

Change my choice on audience measurement

Landlo uses four sub-processors, and no others:

• Supabase — database, authentication and document storage. Instance hosted in Zurich (Switzerland). That is where all your data and your tenants' data live.
• Vercel — application hosting. Your data and your tenants' data remain stored with Supabase, in Zurich.
• Resend — sending transactional e-mail (signup confirmation, password reset, calculator alerts) and, since September 2026, the documents a landlord chooses to send their tenant from Landlo: the lease pack and the rent invoice with its QR-bill. It receives the recipient's address, the message content and, for those sends, the attached PDF — which holds the tenant's name and address, the rent and the payment reference. Those sends happen only on the landlord's explicit action, never automatically.
• Anthropic — automatic reading of a lease contract, only when you choose to drop the document in so that Landlo fills the form. Only the file you dropped is passed to it; Anthropic deletes it from its systems within 30 days and is contractually barred from using it to train its models. Nothing there is linked to your account. If you type the lease in yourself, nothing goes through this channel.

Your data and your tenants' data are therefore stored in Switzerland. Vercel, Resend and Anthropic, however, are US companies: the transfers that may follow are described in article 7.

Vercel, Resend and Anthropic are US companies and may, to operate their services, process data in the United States.

Since 15 September 2024, Switzerland recognises adequate protection for US companies certified under the Swiss-U.S. Data Privacy Framework. Vercel states that its certification expressly covers the Swiss FADP. Resend is certified under the EU–US framework and its UK extension; for that channel the transfer rests on the standard contractual clauses agreed with that provider. Anthropic does not rely on that framework: the transfer of the lease file rests on the standard contractual clauses in its data processing addendum.

The distinction is drawn here deliberately rather than smoothed over: the three providers are not covered by the same mechanism.

Your data is kept for as long as your account exists. You control the duration: Landlo erases nothing of its own accord, because a letting history is consulted years later — a dispute over a deposit can concern a lease signed ten years ago.

When you delete your account, the account, properties, leases, tenants, payments, expenses and documents are erased immediately and permanently, including the files in storage. There is no backup to restore from. All that remains is a record that a deletion took place and on what date, with no personal data at all.

You may request access to your data, its correction, its erasure, and object to a processing operation. The essentials can be exercised directly in the application:

• View and correct — all your data is displayed and editable within the service.
• Erase — Settings → Delete account. Deletion is immediate and irreversible.
• Name, e-mail address, language — Settings.

For any other request, write to privacy@landlo.ch. You may also refer the matter to the Federal Data Protection and Information Commissioner (FDPIC), in Bern.

Data travels encrypted (HTTPS) and is encrypted at rest. Isolation between accounts is enforced by the database itself, not by the application alone: one account cannot read another's rows, even if the application got it wrong. Documents sit in private storage, reachable only through signed links of limited duration.

No system is impregnable. In the event of a breach presenting a high risk, you will be informed and the FDPIC notified, as the law requires.

This policy may evolve with the service. The date at the top of the page identifies the latest version. A significant change — a new sub-processor, a new purpose — will be notified to you by e-mail before it takes effect.