1. Data Controller
The data controller responsible for your personal data is:
During the beta, Mietto is run by Ilias Syrmanoglou as a private individual, not yet as a registered company. The Impressum carries the same details.
2. Personal Data We Collect
Depending on how you use Mietto, we may process the following categories of personal data:
Account data
Name, email address, hashed password, account type (landlord / tenant), preferred language, registration date, and how you found Mietto: your answer to the optional question on the signup form, and the marketing tag of the link you signed up through, if it had one.
Property & tenancy data
Rental property address, monthly rent amount, tenancy start/end dates, tenancy status.
Payment records
Month and year of payment, amount, payment status (pending / approved / rejected), rejection reason if applicable, uploaded proof-of-payment files (PDF, JPG, PNG).
Technical & usage data
Browser timezone (kept with your login session on our server, so times show in your local time), session data, and server-side access logs.
Communications
In-app notifications and transactional emails (invitation, payment confirmation, rent reminders, account alerts). We do not send marketing emails.
The free tools, the rent receipt generator and the yearly rental income summary, need no account. What you type into them, and a signature you draw in the receipt generator, is used to make your PDF and is not stored.
3. How and Why We Use Your Data
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the rent management service | A, B, C | Art. 6(1)(b) — performance of a contract |
| Sending transactional emails & notifications | A, E | Art. 6(1)(b) — performance of a contract |
| Keeping the records of a shared lease as the other person's proof of payment, after you delete your account | B, C | Art. 6(1)(f) — legitimate interests |
| Understanding which channels bring people to Mietto | A | Art. 6(1)(f) — legitimate interests |
| Security, fraud prevention & abuse detection | A, D | Art. 6(1)(f) — legitimate interests |
| Generating PDF reports & payment statements | A, B, C | Art. 6(1)(b) — performance of a contract |
4. Data Retention
- ▸Your account — kept for as long as you use Mietto. You can delete it at any time under Settings, with your password, except while a lease is still active. Deletion takes effect immediately.
- ▸If you never shared a lease with another Mietto user — everything is deleted permanently the moment you delete your account: your properties, leases, payment records, notifications, any offline tenants you added, and every uploaded receipt and contract.
- ▸If you shared a lease with another user — your name, username, email address and notifications are erased immediately, and other people's notifications show you as a deleted user. The records of that lease (the property, its payments, the uploaded receipts and the contract) stay in the other person's history as their proof of payment; receipts and contracts stay exactly as they were uploaded. Those records are deleted permanently as soon as the other person deletes their account too.
- ▸Email verification links — stop working 24 hours after they are sent.
- ▸Invitation links — stop working 7 days after they are sent.
- ▸Server logs — kept by our hosting provider for 3 days.
- ▸Backups — Mietto keeps no backups, so deleted data cannot be restored.
5. Sharing Your Data
We do not sell your personal data. We share data only in the following limited circumstances:
- ▸Between landlord and tenant — when a landlord invites a tenant or a tenant submits a payment, relevant data (name, email, payment status) is visible to both parties as part of the service.
- ▸Email delivery provider — transactional emails are sent via an SMTP/email service provider. Only the recipient's email address and message content are transmitted.
- ▸Hosting infrastructure — your data is stored on servers located within the European Economic Area (EEA).
- ▸Cloudflare (network and security) — every request to mietto.app and www.mietto.app passes through Cloudflare, Inc., which delivers the site, protects it against attacks and automated bots, and compiles aggregated traffic statistics. To do this it processes your IP address and technical details of each request, such as the page requested, your browser type and the time. We rely on our legitimate interest in a secure and reliable service (Art. 6(1)(f)). Cloudflare may process this data outside the EEA, including in the United States; it is certified under the EU–U.S. Data Privacy Framework, and its data processing terms include the EU Standard Contractual Clauses. See Cloudflare's privacy policy.
- ▸Legal obligation — we may disclose data if required to do so by law, court order, or competent authority.
6. Cookies & Local Storage
Mietto uses the following browser storage mechanisms:
Session cookie (essential)
Required to keep you logged in. Deleted when you close the browser or log out.
Security cookie (essential)
csrftoken protects the forms on Mietto against cross-site request forgery. It is set when a page contains a form, and contains no personal identifier.
localStorage (functional)
Remembers your dark/light mode choice (theme) and which notices you have dismissed, such as the beta and cookie notices. It is written only when you use that control, and stays in your browser until you clear it.
Cloudflare security cookie (essential)
Cloudflare may set a short-lived cookie such as cf_clearance when it checks that a visitor is a person and not an automated bot. It is used only to protect the site, not to track you.
We do not use advertising cookies, tracking pixels, or any third-party analytics scripts.
7. Your Rights Under GDPR
As a data subject, you have the following rights. To exercise any of them, contact us at [email protected]. We will respond within 30 days.
Right of access (Art. 15)
Request a copy of all personal data we hold about you.
Right to rectification (Art. 16)
Ask us to correct inaccurate or incomplete data.
Right to erasure (Art. 17)
"Right to be forgotten": delete your account under Settings, or ask us to. Section 4 explains what is deleted at once and what a shared lease keeps for the other person, and until when.
Right to restriction (Art. 18)
Ask us to suspend processing while a dispute is resolved.
Right to portability (Art. 20)
Receive your data in a machine-readable format (CSV export is available for payment records directly in the dashboard).
Right to object (Art. 21)
Object to processing based on our legitimate interests.
8. Complaints
If you believe we are not handling your data in accordance with GDPR, you have the right to lodge a complaint with your national supervisory authority:
- ▸Austria, where Mietto is run: Austrian Data Protection Authority (Datenschutzbehörde) — www.dsb.gv.at
- ▸Greece: Hellenic Data Protection Authority (HDPA) — www.dpa.gr
- ▸Germany: Federal Commissioner for Data Protection (BfDI) — www.bfdi.bund.de
- ▸Other EU/EEA countries: Find your authority at edpb.europa.eu
We would, however, always appreciate the opportunity to resolve any concern directly — please contact us first at [email protected].
9. Changes to This Policy
We may update this policy as the service evolves. If we make a material change (e.g. processing data for a new purpose), we will notify registered users by email at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.