Privacy Policy
Last updated: 2026-06-15
1. Data controller
UAB „Tobuli“, Lithuania. Company code: 303338202. VAT code: LT100011894910. Address: Beržų g. 70, Ramučių k., LT-54468 Kauno r. Email: [email protected]. Phone: +370 653 58281.
2. What data we process
- Account data: name, email, password hash.
- Rental activity data: properties, tenants, contracts, meter readings, invoices.
- Payment data: subscription status (handled by Stripe; we do not store card details).
- Technical data: IP address, browser type, usage statistics (analytics — only with your consent).
- Solvency check data (only when a solvency check is ordered and only with the candidate's explicit consent): identity confirmation, an income and obligations overview from the bank account (Open Banking), credit history and debtor-register entries. The candidate is a separate data subject; the landlord sees only a minimised assessment (verdict, score, bands) — no exact figures and no personal code.
3. Purposes and legal basis
- Providing the service and performing the contract (GDPR Art. 6(1)(b)).
- Compliance with legal obligations, e.g. accounting (Art. 6(1)(c)).
- Analytics and service improvement — on the basis of your consent (Art. 6(1)(a)).
- Solvency checks — with the candidate's explicit consent (GDPR Art. 6(1)(a) and Art. 22(2)(c)); the assessment is decision support, and the candidate has the right to human review and to contest the result.
4. Data processors
We rely on trusted service providers with whom data processing agreements are in place:
| Processor | Purpose |
|---|---|
| Hetzner (Frankfurt, EU) | Server hosting, data storage |
| Stripe | Payments and subscriptions |
| Resend | Sending emails |
| Anthropic (Claude AI) | Reading invoice emails (personal codes/IBANs are masked) |
| Kontus.lt | Accounting synchronisation (if connected) |
| Google Analytics, Microsoft Clarity | Website analytics (only with consent) |
| SK ID Solutions (Smart-ID) | Candidate identity confirmation in solvency checks (planned) |
| Open Banking AISP (licensed provider) | Income and obligations overview in solvency checks, read-only access (planned) |
| Creditinfo Lietuva | Credit history and rating in solvency checks (planned) |
The recipient of a solvency report is the landlord who ordered the check — upon receiving the report they become an independent controller of its data and may use it only for the tenancy decision.
5. Retention periods
- Incoming supplier emails are automatically deleted after 90 days.
- When an account is closed, all data is deleted within 30 days.
- The solvency report and the underlying source data are retained for 90 days, then deleted; the candidate may withdraw consent at any time.
- Accounting documents are retained for as long as Lithuanian law requires.
6. Your rights (GDPR)
You have the right to access your data, rectify it, erase it, restrict processing, to data portability and to withdraw consent. To exercise these rights, contact [email protected]. You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).
7. Cookies
Our use of cookies is described separately — in the cookie policy.
8. Changes
If we update this policy, we will publish the new version on this page together with the update date.