Privacy Policy

Last updated: November 2, 2026

This policy describes how Plinthos processes the personal data of users of the mobile app, the web app and the plinthos.app website, under Regulation (EU) 2016/679 ("GDPR").

1. Data controller

The data controller is Scalise Partecipazioni S.r.l., registered office at Via Spagna snc, Condominio C.da Cutura, 87036 Rende (CS), Italy, VAT number IT04024040786, certified email (PEC) scalisepartecipazioni@pec.it.

For any request regarding the processing of personal data, you can contact the controller at support@plinthos.app.

2. Categories of data collected

2.1 Registration and profile data

• Email address (required)
• First and last name
• Phone number (optional)
• Tax code (Landlords only, optional)
• Profile photo (optional)
• Role (Landlord or Tenant) and country of operation

2.2 Authentication data

• Password (stored encrypted via bcrypt — the controller has no access to it)
• For Google sign-in: Google identifier and associated email address
• Session and refresh tokens

2.3 App usage data (Landlords)

• Managed apartment data (name, city, address, size)
• Room and bed data
• Tenant data entered by the Landlord (name, phone, email, optional tax code, contract dates, rent, deposit)
• Payment history and uploaded receipts
• Bill data (amounts, periods, photos)
• Messages sent in chats
• Uploaded and shared documents
• Deadlines entered

For the tenant data they enter, the Landlord is an independent controller and is accountable to their tenants; Plinthos processes that data on the Landlord's behalf, as a processor (Art. 28 GDPR), solely to provide the service.

2.3-bis WhatsApp reminders

If the Landlord turns on WhatsApp reminders, we send service messages (rent due or late, bill share, payment confirmation) to tenants who have not linked a Plinthos account, at the phone number entered by the Landlord. The message contains the tenant's and the Landlord's names, the month or the bill type, the amount and the due date. We record the delivery outcome and, if the number cannot be reached on WhatsApp, we stop writing to it. A tenant can ask to stop receiving these messages by writing to support@plinthos.app or to the Landlord.

2.4 App usage data (Tenants)

• Association to a room via invite code
• Payment history for rent and bill shares
• Uploaded payment receipts
• Messages sent in chats

2.5 Payment data

Plinthos does NOT collect or store credit-card details. Subscriptions bought from the mobile app are handled through Apple's App Store and the Google Play Store, using RevenueCat to validate transactions. Subscriptions bought from the web app are handled by Paddle.com Market Limited as Merchant of Record. Plinthos receives only the subscription status (active, expired, trial) and limited transaction metadata.

2.6 Technical and notification data

• Push notification tokens (Expo Push Token / FCM)
• Device identifier (for trial anti-fraud)
• Device language and notification preferences
• App and operating-system version
• Entry page on plinthos.app (e.g. the blog article where your visit started), stored in your browser for up to 90 days solely to understand which content leads to a signup. It contains no personal identifiers and is not shared with third parties.

2.7 Usage and diagnostic data

To understand where the service needs to be improved, we record how the web app and the mobile app are used:

• Web app (PostHog, EU servers): the pages opened and the steps completed, for example signup, initial setup, creating a property or a tenant, sending an invitation, opening the subscription page and the outcome of the payment. We do not include names, addresses, email addresses, rent amounts, messages or documents in the events, and we strip codes and parameters from page addresses. After login, events are linked to the internal ID of your account, not to your name or email address. We do not use cookies or store anything on your device for this purpose, and your IP address is not retained.
• Session recordings: during the first 14 days after your account is created, we also record how you move around the page (clicks, scrolling, changes of screen) to see where users get stuck. All text and all fields are masked before they leave your browser: the recording shows the structure of the page, not your data.
• Mobile app (Google Firebase Analytics): the screens opened and the main steps (signup, creating properties, rooms and tenancies, invitations, payments marked or confirmed, bills, subscription), linked to the internal ID of your account. Firebase Analytics will be replaced by PostHog, under the same rules as the web app.
• Error diagnostics (Sentry): in the event of an error, the internal account ID, the page and the technical data needed to fix it.

You may object at any time by switching off “Usage data” in the Settings of the web app, or by writing to support@plinthos.app: from that moment we no longer record events or sessions for your account.

2.8 Newsletter signup data

If you subscribe to the newsletter on plinthos.app, Plinthos collects your email address and browsing language, solely to send you informational and promotional communications. This data is kept until you unsubscribe — possible at any time — and is stored on the Supabase database (EU servers, Frankfurt). It is not shared with third parties.

2.9 Listing-portal application data

When you apply for a room through the Plinthos listing portal, we collect and process the following data:

• First and last name provided in the application
• Age (if provided)
• Occupation (if provided)
• The introduction message attached to the application
• The messages exchanged with the landlord in the chat linked to the application

The controller of this data is the one named in section 1. Your application data is visible to the landlord of the listing you applied to, solely for the purpose of tenant selection. At any time, you can export a copy of all your portal data or request the immediate deletion of your account and related data (right to be forgotten) from your portal account settings — deletion is irreversible and does not require waiting for the retention periods described in section 5.

2.10 Profile shared through a private link

If you have a profile on the listing portal, you can share it with a landlord through a private link, for example by pasting it into the message you send them on another listings site. The link is created only when you ask for it, it is the same for every listing you send it to, and it stays valid for the period you choose (7, 30 or 90 days).

Anyone who opens the link sees your profile as landlords see it when you apply on the portal, including the income band you entered, as well as budget, length of stay, occupation and guarantees, if you provided them. Anyone who receives the link can open it while it is valid: share it only with people you choose.

You can revoke the link at any time from "My applications": from then on the profile is no longer visible and no new conversations can be started from the link. Conversations already started stay open until you close them.

For each link we record only how many times it was opened and the time of the last opening. We do not record the IP address, browser or any other data of the person who opens it. Previews generated by messaging apps (for example WhatsApp or Telegram) are not counted and do not show the profile or the income.

2.11 Landlord replies and email-code accounts

If you receive a profile link and want to reply, we ask for a message and your email address. We send you a code to confirm the address is yours; no password is needed. With the code we create a light Plinthos account for you, used only to let you back into the conversation and to notify you of replies by email.

We process the email address, the name you choose to show (optional: if you leave it empty, the other party sees your email address partially hidden), the conversation messages and the send and read times. To protect the service from abuse we limit code requests per email address and per IP address, keeping this data only in hashed form and for no more than 30 minutes, and we use an anti-bot check (Cloudflare Turnstile).

Phone numbers and email addresses are not allowed in messages: the system blocks them. Each landlord who replies has their own conversation and none can see the others'.

2.12 Publishing on Plinthos a listing that already exists

If you have a listing published elsewhere and want to publish it on Plinthos, you can search for it on the portal and select it: city, area, price and rooms are already filled in, and you add photos and description. We process your account, the listings you selected, the link between them and your new listing, the result of the check and any report you send if a listing turns out to be already linked to another account. To prevent abuse we record the time of each search (at most 30 per minute) and delete it after 10 minutes.

Your listing goes live immediately. The previous version of the listing is removed from the portal only after a manual check by our staff.

3. Purposes and legal bases

• Providing the service (performance of a contract — Art. 6.1.b GDPR): account creation and management; management of apartments, rooms, tenancies, payments, bills, messages.
• Handling listing-portal applications (pre-contractual measures taken at the data subject's request — Art. 6.1.b GDPR): collecting application data and making it available to the landlord, solely for the purpose of tenant selection.
• Sharing your profile through a private link (pre-contractual measures taken at the data subject's request — Art. 6.1.b GDPR): showing your profile to whoever receives the link you chose to create and share.
• Conversations with landlords who reply to the link (pre-contractual measures — Art. 6.1.b GDPR): letting you and the landlord write to each other and be notified of replies.
• Publishing a listing starting from one that already exists (performance of the contract — Art. 6.1.b GDPR): offering you the data of the selected listing and checking the link.
• Abuse prevention on email codes, conversations and searches (legitimate interest in the security of the service — Art. 6.1.f GDPR).
• Accounting and tax obligations (legal obligation — Art. 6.1.c GDPR): retention of payment receipts and contract data within statutory limits.
• Subscription management (performance of a contract — Art. 6.1.b GDPR): via RevenueCat and Paddle to validate purchases and renewals.
• Operational notifications (contract and legitimate interest — Art. 6.1.b and f GDPR): push notifications and transactional emails (e.g. new payment, upcoming deadline).
• Service communications (legitimate interest — Art. 6.1.f GDPR): communications about app usage, including email reminders to complete signup or account setup, trial expiry and payment issues. You can object at any time via the unsubscribe link in every email.
• Product improvement (legitimate interest — Art. 6.1.f GDPR): analysis of the use of the web app and the mobile app, using pseudonymised data and masked recordings (section 2.7), to understand where users get stuck and to improve features and user experience. You may object at any time in Settings (“Usage data”) or by writing to the Controller.
• Security and fraud prevention (legitimate interest — Art. 6.1.f GDPR): protection against trial abuse and malicious use.
• Newsletter and marketing communications (consent — Art. 6.1.a GDPR): sending news, tips and offers to users who give consent, either by subscribing to the newsletter on the website or, in the app, at signup or later from settings. Consent is optional and can be withdrawn at any time from the app settings or via the unsubscribe link in every email.
• Legal compliance (legal obligation — Art. 6.1.c GDPR): responding to requests from competent authorities.

4. Processing methods

Data is processed with electronic tools and on access-protected servers. Passwords are stored encrypted (bcrypt). Client-server communications use TLS 1.3. Data access is governed by Row Level Security (RLS) at the database level: each user can access only their own data.

5. Retention period

• Active accounts: data is retained for the duration of the contractual relationship.
• Account deletion: on a deletion request, data is immediately soft-deleted; after 30 days it is permanently deleted (hard-delete). Within that period you can request a data export in JSON format.
• Former tenants: after a contract ends, access data stays available for 30 days in read-only mode. After 12 months, identifying personal data (name, phone, email) is anonymised, keeping only accounting data required by tax obligations.
• Listing-portal applications: application data is retained for 12 months after the application is closed (rejection, withdrawal by the applicant, or closure of the listing once all beds are taken). After that period, identifying data and the introduction message are anonymised and the messages in the linked chat are deleted. If the application leads to a tenancy contract, the data continues in the contract file under the retention periods applicable to that relationship.
• Profile links: while valid, then visible to you for 90 days after expiry or revocation; after that the link is deleted together with its open counter.
• Conversations started from a link: same periods as applications (12 months after closing, then anonymisation and deletion of messages). A conversation on a link that is no longer valid and with no messages for 90 days is closed, and the same period runs from then. The income band is not copied into the conversation: it stays visible only on the profile, while the link is valid.
• Accounts created with an email code: if unused for 90 days (no conversation, listing, application, alert, saved listing or other service, and no password set), they are deleted automatically. Otherwise the rules for active accounts apply.
• Listings selected for publishing on Plinthos: selections never used are deleted after 30 days; the others are kept as long as your listing or account exists. Search times are deleted after 10 minutes.
• Accounting and tax data: retained for 10 years as required by Italian law (Art. 2220 of the Civil Code).
• Usage data (PostHog): events for 12 months, session recordings for 30 days.
• Mobile app usage data (Firebase Analytics): 2 months.
• Error diagnostic data (Sentry): 90 days.
• Security logs: 180 days.

6. Recipients and processors

Data is processed solely by the Controller and by the following providers, appointed as data processors under Art. 28 GDPR:

• Supabase Inc. (USA, EU servers — Frankfurt) — backend infrastructure, database, authentication, storage and realtime. supabase.com/privacy
• RevenueCat, Inc. (USA) — subscription management and validation. revenuecat.com/privacy
• Paddle.com Market Limited (UK/EU) — Merchant of Record and payment processing for web purchases. paddle.com/legal/privacy
• Apple Inc. (USA / Ireland) — App Store, Apple Sign In, APNS notifications. apple.com/legal/privacy
• Google LLC (USA / Ireland) — Google Play Store, Google Sign In, Firebase Cloud Messaging (FCM) for push notifications, Firebase Analytics for analysis of the use of the mobile app (section 2.7). policies.google.com/privacy
• Google LLC / Google Ireland Ltd. (USA / Ireland) — Google Gemini API for automatic reading of bills uploaded by the landlord (extracting amount, dates and utility type via the "Scan bill" feature). Triggered only by the landlord's action; submitted content is not used to train the models (paid API terms). ai.google.dev/gemini-api/terms
• Meta Platforms Ireland Ltd. (Ireland / USA) — WhatsApp Business Platform (Cloud API) to send the WhatsApp reminders to tenants described in section 2.3-bis. whatsapp.com/legal/business-data-processing-terms
• Expo Inc. (USA) — push-notification delivery service. expo.dev/privacy
• Zoho Corporation B.V. (EU / India) — delivery of service emails and app communications (mail.plinthos.app mailbox). zoho.com/privacy
• Resend (Plus Five Five, Inc.) (USA) — delivery of transactional and recovery emails. resend.com/legal/privacy-policy
• PostHog Inc. (EU servers) — analysis of the use of the web app and masked session recordings (section 2.7). posthog.com/privacy
• Sentry / Functional Software Inc. (USA, EU option) — crash monitoring, if enabled. sentry.io/privacy
• Cloudflare, Inc. (USA) — hosting of plinthos.app, DDoS protection and CDN, anti-bot check (Turnstile) on listing-portal forms. cloudflare.com/privacypolicy
• Google Ireland Ltd. (Ireland / USA) — Google Analytics 4, website usage statistics. Activated only with consent via the cookie banner (Consent Mode v2). policies.google.com/privacy
• Meta Platforms Ireland Ltd. (Ireland / USA) — Meta Pixel, advertising conversion measurement (e.g. completed registration) on the website and web app. Activated only with consent via the cookie banner (website) or upon a deliberate signup (web app). facebook.com/privacy/policy
• Microsoft Ireland Operations Ltd. (Ireland / USA) — Microsoft Clarity, anonymous website usage analysis (heatmaps and aggregated session recordings to improve usability). Sensitive fields are masked automatically. Activated only with consent via the cookie banner. privacy.microsoft.com/privacystatement

If you share your profile through a link, the profile data (including the income band) is visible to anyone who opens the link while it is valid. Plinthos does not know or verify the identity of the person who opens it until they reply to you.

7. Transfers outside the EU

Some providers listed above are based in the United States. Transfers of personal data outside the European Economic Area (EEA) take place under one of the safeguards provided by the GDPR:

• European Commission adequacy decision (e.g. the EU-US Data Privacy Framework for certified providers);
• Standard Contractual Clauses ("SCC") approved by the European Commission;
• Supplementary technical encryption measures.

Structured data (main database, receipts, documents) is stored on servers located in the European Union (Supabase, Frankfurt region).

8. Your rights

At any time you may exercise the rights under Arts. 15-22 GDPR:

• Right of access (Art. 15): obtain confirmation of, and a copy of, the data processed;
• Right to rectification (Art. 16): correction of inaccurate or incomplete data;
• Right to erasure / "right to be forgotten" (Art. 17): deletion of data in the cases provided;
• Right to restriction (Art. 18): restriction of processing in specific cases;
• Right to portability (Art. 20): receive your data in a structured, machine-readable format (JSON) and transmit it to another controller;
• Right to object (Art. 21): object to processing based on legitimate interest;
• Right to withdraw consent: where processing is based on consent, at any time, without affecting the lawfulness of processing carried out before withdrawal.

Plinthos does not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The choice of tenant always remains with the Landlord.

How to exercise your rights

Data export and account deletion are available directly in the app, in the Settings section. You can also exercise your rights at any time by writing to the controller at support@plinthos.app. The controller responds within 30 days of receiving the request.

The data export in the portal settings includes your profile links (without the link code) and, if you are a landlord who replied to a link, the conversations you started. Accounts created with an email code can also export their data and delete the account from the portal settings.

9. Complaint to the supervisory authority

You always have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) under Art. 77 GDPR, or with your local supervisory authority, if you believe your data is processed in breach of the Regulation.

10. Data security

Plinthos adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration:

• Encryption in transit (TLS 1.3) and at rest for sensitive data;
• Row Level Security (RLS) at the database level to isolate data between users;
• Token authentication with expiry and refresh;
• Restricted access to production systems via individual credentials and MFA;
• Audit logging of sensitive operations;
• Security-event monitoring and alerts on anomalous activity.

11. Minors

Plinthos is not intended for individuals under 16 and does not knowingly collect their personal data. If a parent or guardian becomes aware that a minor has provided personal data, please contact the controller for deletion.

12. Changes to this policy

The controller may amend this policy at any time, giving notice to users via in-app notification or publication on plinthos.app/en/privacy. Material changes will be communicated with reasonable notice. The last-updated date is shown at the top of this document.

13. Contact

For any information or request regarding this policy, write to support@plinthos.app.