Privacy policy

Last updated: 13 August 2026

1. Data controller identity

The data controller for personal data collected through Laubja is CONSORCES (SAS), registered at 72 Impasse de Mondon, 33420 Saint-Jean-de-Blaignac, France (SIREN 993 340 645).

The Data Protection Officer (DPO) is Mr. Alexis Boeglin, reachable at: dpo@laubja.com.

2. Data collected

As part of using the service, Laubja collects the following data:

  • Identification data: name, surname, email address, password (encrypted);
  • Property data: address, surface area, characteristics, diagnostics (EPC);
  • Tenant data: name, surname, date of birth, contact details, guarantor information;
  • Financial data: rent amounts, payment history, receipts;
  • Technical data: IP address, browser type, connection data, error logs.

3. Legal basis (GDPR)

Data processing is based on the following legal grounds:

  • Contract performance (Art. 6.1.b GDPR): processing is necessary for providing the property management service;
  • Legitimate interest (Art. 6.1.f GDPR): service improvement, security, fraud prevention;
  • Legal obligation (Art. 6.1.c GDPR): retention of lease-related documents under French law.

4. Processing purposes

Your personal data is processed for the following purposes:

  • User account management and authentication;
  • Generation of leases, receipts, and property management documents;
  • Payment tracking and financial report generation;
  • Service improvement and technical incident resolution.

5. Data retention

Retention periods vary depending on the type of data:

  • Active leases: for the duration of the lease and the service;
  • Terminated leases: 3 years after lease termination (civil statute of limitations);
  • Payment data and receipts: 10 years (accounting and tax obligations, Art. L.123-22 French Commercial Code);
  • Account data (after deletion): 3 years (legal obligation to retain rental documents);
  • Technical and audit logs: 12 months;
  • After expiration of retention periods, data is anonymized or permanently deleted.

6. User rights

Under the GDPR, you have the following rights over your personal data:

  • Right of access: obtain confirmation of data processing and receive a copy;
  • Right to rectification: have inaccurate or incomplete data corrected;
  • Right to erasure: request deletion of your data (subject to legal obligations);
  • Right to data portability: receive your data in a structured, machine-readable format;
  • Right to restriction: request limitation of processing in certain cases;
  • Right to object: object to data processing on legitimate grounds.

7. Cookies

Laubja only uses cookies strictly necessary for the operation of the service: session cookie (authentication), theme preference cookie (light/dark), language cookie.

No tracking or advertising cookies are used. No additional consent is therefore required for these essential cookies (Art. 82 of the French Data Protection Act).

8. Data processors

Laubja uses the following data processors to provide the service:

  • Supabase (database and authentication) — hosted in EU region (AWS eu-west);
  • Brevo (transactional emails: receipts, notifications) — hosted in France/EU;
  • Sentry (error monitoring) — anonymized data, limited to technical logs — US servers, Standard Contractual Clauses (SCCs);
  • OVH (application server hosting) — data centers in France;
  • Cloudflare (CDN, DDoS protection, DNS) — global network, transit data only.

9. Transfers outside the EU

Data is primarily hosted in the European Union: Supabase (EU region, AWS eu-west), OVH (France), Brevo (France/EU).

Some processors operate from the United States:

  • Sentry (monitoring) — Standard Contractual Clauses (SCCs) approved by the European Commission;
  • GitHub (CI/CD, source code hosting) — Standard Contractual Clauses (SCCs);
  • Cloudflare (CDN) — transit data only, no permanent storage.

10. Data security

Laubja implements appropriate technical and organizational measures to protect your data: encryption in transit (TLS) and at rest, secure authentication (JWT), role-based access control (Row Level Security), regular backups, incident monitoring.

11. DPO contact

To exercise your rights, send your request to dpo@laubja.com with a copy of an identity document.

You also have the right to lodge a complaint with the CNIL (French Data Protection Authority): https://www.cnil.fr.