Privacy Notice
Version 2026-09-12
1. Who we are
Hermit Homes is a property rental management service operated by Hermit Homes Ltd, company registration number C 115955, registered office 15/2, Triq il-Katlan, Attard, ATD 2753, Malta.
For privacy questions and to exercise any of the rights in section 8, write to [COMPANY EMAIL — REQUIRED BEFORE LAUNCH].
2. Controller or processor — which we are depends on the data
We are the controller for the data of people who sign up: your account details, your subscription and billing records, security events on your account, and how you use the service.
We are a processor for the tenant and lease information a landlord enters about other people — tenant names, contact details, lease terms and the documents attached to them. There the landlord is the controller: it is their record about their tenant, and we process it only to run the service for them. A data processing agreement covering that role (Article 28 GDPR) is available to account holders on request from [COMPANY EMAIL — REQUIRED BEFORE LAUNCH].
This matters for where you send a request. If you are a tenant asking about the details your landlord holds on you, your landlord answers that — we will help them, and we will pass your request on if you send it to us by mistake.
3. What we collect
- Account: name, email address, phone number, and a hash of your password. If you turn on two-factor authentication, the secret behind it.
- Property: addresses, descriptions, photos, MTA licence and registration numbers, amenities.
- Tenancy: the names, contact details and lease terms a landlord enters for their tenants, and any documents they attach.
- Financial: rent amounts, expenses, deposits, meter readings, invoices. We do not collect or store card numbers or bank credentials.
- Enquiries and viewings: the name, email, phone and message of anyone who contacts a landlord through a public listing or books a viewing.
- Files: whatever you upload — leases, insurance, bills, photos.
- Usage and security: listing view counts with a hashed visitor address, failed sign-in counters, and error diagnostics. No third-party analytics, advertising networks or tracking pixels are used.
4. Why we process it, and on what legal basis
- Performance of a contract — running the service you signed up for: your account, your properties, your tenancies, your invoices.
- Legitimate interests — keeping the service secure and available: two-factor authentication, rate limiting on failed sign-ins, error diagnostics, and preventing abuse of public forms. We have considered the effect on you and limited what is kept to what those purposes need.
- Legal obligation — keeping financial records for the period Maltese law requires.
- Consent — optional marketing email, and nothing else. It is offered unticked, it is never a condition of using the service, and you can withdraw it at any time in your settings. Accepting the Terms and acknowledging this notice at sign-up is not consent under GDPR and is not used as a legal basis for anything.
5. Who else processes it
We do not sell personal data. It reaches others only in these cases:
- Cloudflare — hosting, database and file storage. The database is configured in Cloudflare's Western Europe region. Their privacy policy.
- Resend — sending transactional email. Receives the recipient address and the message content. Their privacy policy.
- Google — the page fonts (Inter and Plus Jakarta Sans) are served from Google Fonts, so your browser’s IP address reaches Google when a page loads. No cookie is set and no account is needed. Their privacy policy.
- Video-tour providers — when a landlord adds a virtual tour, the listing page embeds it from YouTube’s no-cookie domain, Vimeo or Matterport. That provider receives your IP address, and if you play the tour it may set its own storage. It loads only on a listing that has a tour. YouTube’s privacy policy.
- The landlord you contacted — if you enquire about a listing or ask for tenant portal access, your details go to that landlord. That is the point of the form, and it is stated on the form itself.
- Anyone, for what you choose to publish — a property listing you publish shows the locality and the property details. It does not show your full address or your personal contact details.
- Where the law requires it — a valid legal obligation or court order in Malta.
The current list, with what each one processes, is at Subprocessors. No payment provider is listed because none has been selected or activated — nothing can currently be paid through the platform.
6. How it is protected
- In transit: HTTPS/TLS.
- Passwords: hashed with PBKDF2-SHA256 at 100,000 iterations and a 256-bit derived key. They are never stored in a form we can reverse.
- Sensitive fields: designated columns — tenant names and contact details, identity document numbers, expense and payment notes, notification text — are encrypted with AES-256-GCM before they are written. The service decrypts them to show them to people authorised to see them, so this protects the stored data rather than making it unreadable to us.
- Sessions: a signed token in an httpOnly cookie, sent only over HTTPS.
- Files: held in Cloudflare R2, which encrypts objects at rest.
More detail is on the security page, including what we do not claim.
7. How long we keep it
The table below is generated from the retention rules the service actually runs each night, not written separately — so a period here is a period the system applies.
| What | How long | Then |
|---|---|---|
| Tenant name, contact details and free-text notes on an ended leaseMaltese commercial-records law requires the financial trail to be kept for six years. After that the amounts, dates and lease references stay and the tenant’s personal details are removed. | 6 years after the lease ends | Personal details removed |
| Name, email, phone and message on a rental enquiryAn enquiry that has not become a tenancy in two years has no continuing purpose. The row is kept without contact details so the landlord’s enquiry counts and conversion history stay intact. | 24 months after the enquiry | Personal details removed |
| Visitor name, email, phone and note on a viewing slotA past viewing needs no contact details once the slot is a year behind. | 12 months after the viewing | Personal details removed |
| Contact details on a tenant portal access requestOnce the request has been accepted or rejected the contact details have served their purpose. The outcome is kept. | 12 months after the request is answered | Personal details removed |
| Tenant name, email, phone, property address and note on an unclaimed landlord invite linkA tenant-created invite holds their own contact details so their landlord can claim the tenancy. A link nobody claimed within its 30-day life has served no purpose, and keeping the snapshot afterwards keeps a copy of their details for a tenancy that never existed here. Claimed invites are kept — they are the provenance of a real property and lease. | 90 days after the link expires (links are valid for 30 days) | Deleted |
| Email verification, password-reset and invitation tokensAn expired token cannot be redeemed, so there is nothing left to keep. | 30 days after the token expires | Deleted |
| Records of emails we sent or failed to sendLong enough to investigate a delivery complaint, no longer. | 90 days | Deleted |
| Error diagnostics, including the signed-in user id where there was oneKept only long enough to diagnose a fault after it is reported. | 30 days | Deleted |
| Listing view counters with a hashed visitor addressSupports the view counts shown to landlords for a rolling quarter. | 90 days | Deleted |
| Failed sign-in and abuse countersCleared as soon as the attempt succeeds. The sweep removes counters for identifiers that never come back. | 7 days | Deleted |
| Scheduled-job records, webhook de-duplication keys and device readingsOperational records with no continuing purpose once the window passes. | 30 days to 12 months depending on the record | Deleted |
| Raw notifications received from a payment processorKept long enough to reconcile a disputed or duplicated payment against what the processor says it sent, and to investigate a chargeback. | 180 days | Deleted |
| In-app alert notifications, including the tenant name quoted in the messageAn alert older than a year has served its purpose. The table also feeds the duplicate-suppression checks behind our reminders, so keeping it bounded keeps those fast, and twelve months is well past every alert window. | 12 months | Deleted |
| Security and account audit-log entries, including any email hash or account identifier they carryA forensic record of who changed what is kept long enough to investigate an incident, a disputed change or an account erasure, and no longer. Two years covers those windows comfortably. | 24 months | Deleted |
Signed agreements and attached documents. The periods above remove a tenant's personal details from the tenancy record. Signed tenancy agreements and other documents a landlord attaches to a lease form part of the financial and legal record of the letting — the kind of record landlords are obliged to keep for tax, accounting and housing-authority purposes — so the documents themselves are retained as part of that record and are not erased by the tenant-detail removal above. They are deleted when the account that holds them is deleted (see section 8).
Separately from the table: when you delete your account, your data is removed immediately, not after a waiting period — see section 8.
8. Your rights, and how to use them
Where we are the controller you can:
- Get a copy of your data. Settings → Privacy & data gives you an immediate download: one file containing every row we hold about you, with the encrypted fields decrypted so you can read them, and a section-by-section listing so you can check it is complete.
- Correct it. Most of it you can edit directly in the app. Write to us for anything you cannot reach.
- Delete your account. Settings → Privacy & data. It asks for your password and a typed confirmation, then removes your account and the data attached to it straight away, including your uploaded files. Records we must keep by law, and records belonging to other people, are described in section 7.
- Take your data elsewhere. The export above is machine-readable JSON. Expenses and the tax report also export as CSV.
- Object to, or ask us to restrict, processing that relies on our legitimate interests.
- Withdraw consent for marketing email at any time, in your settings. Withdrawing is as easy as giving it and costs you nothing else.
For anything not self-service, write to [COMPANY EMAIL — REQUIRED BEFORE LAUNCH]. We answer within one month, as GDPR requires, and will tell you if we need longer and why.
9. Cookies and browser storage
This list is generated from the code, and a test fails the build if anything is set that is not listed here.
| Cookie | What it does | Kept |
|---|---|---|
kiri_session | Keeps you signed in.Contains a signed token identifying your account. httpOnly, so page scripts cannot read it, and sent only over HTTPS in production. | 7 days |
kiri_active_account | Remembers which account you are working in when you manage more than one.Holds an account identifier and nothing else. | 30 days |
kiri_active_role | Remembers whether you last used the landlord or the provider side.Holds the word "landlord" or "provider". | 1 year |
kiri_locale | Remembers the language you chose.Set by the language switcher, so it is readable by page scripts. Holds a language code such as "en" or "mt". | 1 year |
We also keep these in your browser's local storage. They never leave your device, are never sent to us, and clearing your site data removes them:
kiri_shortlist— The properties you saved while browsing, so the list survives a reload.kiri_onboarding_dismissed— Remembers that you closed the getting-started panel.kiri_tour_seen— Remembers that the product tour has been offered to you.kiri_tour_done— Remembers that you finished the product tour.kiri_install_dismissed— Remembers that you dismissed the "install this app" prompt.- Service worker cache — Stores the app’s own pages and assets so it loads fast and works offline.
A listing that has a virtual tour embeds it from YouTube’s no-cookie domain, Vimeo or Matterport. Those embeds set nothing until you play the tour; if you do, the provider may store data under its own domain, outside our control. Nothing is embedded on a listing without a tour, and none of it is analytics or advertising.
There is no cookie banner because there is nothing here that needs one: everything above is either strictly necessary to deliver what you asked for, or a preference you set yourself. If that ever changes — if analytics or advertising storage is added — a banner comes with it.
10. Changes to this notice
This notice is versioned. A material change raises the version and you are asked to acknowledge the new one when you next sign in; we will also email account holders at least 14 days before it takes effect. A typo fix does not change the version.
11. Complaints
Please raise a concern with us first at [COMPANY EMAIL — REQUIRED BEFORE LAUNCH] — we would rather fix it. You also have the right to complain to the supervisory authority in Malta, the Information and Data Protection Commissioner (IDPC), whether or not you contact us first.