Privacy policy

Who is the controller

The controller is Eric Tabacaru, trading as Homebound ("Homebound", "we"), reachable at www.homebound.app.

You can contact us, inspect your data or lodge a complaint through the feedback option in your Homebound account. We respond within one month.

Homebound does not currently publish a postal address or a general email address that we read. We are establishing a public contact channel and will complete this notice as soon as one is available.

What personal data we process

Depending on what you use, we process the following data:

• Account data: your email address, password hash, account ID, and the date you accepted the terms.
• Profile data: the answers you save yourself, such as your rental preferences, income indication and situation.
• Search and saved data: your saved searches, filters, saved homes and alerts.
• Application data: your applications, progress, generated letters and the choices you make per application.
• Technical data: IP address, device and browser type, and security and error logs we keep to run the service safely.
• Payment data: your plan and status, the date up to which you have paid, whether a cancellation has been scheduled, the Dodo Payments identifiers tied to your purchase, such as your customer, subscription and checkout ids, and the billing notifications Dodo sends us. The card number and the security code are processed by Dodo Payments and never stored by us. We also keep the notification Dodo itself sent us about each billing event, with its contents determined by Dodo.

Why we process and on what basis

We only process your data for clearly defined purposes. To create and use your account and your applications, the legal basis is the performance of the contract (Article 6(1)(b) GDPR). Consent is not the right basis here, because those data are needed to deliver the service.

For security, troubleshooting and improving the service we rely on our legitimate interests (Article 6(1)(f) GDPR). Analytics, session replay, the AI letter assistant and the browser extension are processed only on the basis of your explicit consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

Cookies and your privacy choices

We only place functional cookies that are needed to make your account work. Analytics and session replay are off until you actively opt in. All details are in our cookie notice, and you can manage your choices at any time via the privacy settings.

Analytics and session replay

If you agree to analytics, we measure how the service is used with PostHog, hosted in the EU. No analytics event or session recording starts until you have explicitly agreed. Analytics and session replay are two separate choices.

We only measure anonymous usage data, such as which pages and steps are used. We do not record email addresses, names, profile answers, search terms, addresses or letter text. Session replay is limited to our public home page, masks all input fields and text, and is kept for at most 30 days.

Processing by our AI provider

For the AI letter assistant we send, through OpenRouter, only the profile details you selected, the relevant home details and your own instruction. We treat listing information as untrusted content. We ask the provider not to retain your text or to use it for training.

Because your data may pass through a third party outside our own environment, we ask for your explicit consent. Your account details and your application are unaffected by this.

Processors and third parties

We use the following parties to be able to deliver the service. They process personal data only on Homebound's behalf, except where the law or their role dictates otherwise.

• Vercel - hosting of the website.
• Railway - hosting of the application servers and the database.
• Resend - delivery of transactional emails, such as email verification and alerts.
• PostHog (EU) - product analytics and session replay, only with your consent.
• OpenRouter - AI letter assistant, only with your consent.
• Dodo Payments - payment processing. Dodo is the Merchant of Record here and therefore the legal seller of any subscription.

Payment processing by Dodo Payments

When you start a paid subscription, Dodo Payments processes your payment data as an independent controller: Dodo is the Merchant of Record and the party that contracts with you for the purchase. From Dodo we receive whether you have paid, which plan you have, the date up to which it runs and whether a cancellation has been scheduled, together with the customer, subscription and checkout ids tied to the purchase. We also keep the notification Dodo itself sent us about each billing event, with its contents determined by Dodo. We never receive your card number or security code. Dodo holds your card details and handles refunds; we are not the contact point for those.

Listing information and sources

We collect rental advertisements through public channels of Dutch rental sites. This data belongs to the respective provider, not to you, and we keep it according to a retention window per source. When you submit an application on an external site, that site receives only what you submit there yourself.

How long we keep data

We do not keep your data longer than needed for the purpose it was collected for:

• Account data: for as long as your account is active, until you delete the account.
• Sign-in sessions: up to 30 days, with a refresh up to 60 days.
• Account deletion request: a 30-day grace period, then permanent deletion from the database.
• Data export: the downloadable file is available for 24 hours and is then deleted.
• AI letter requests: 7 days after a failed request, and 30 days after you approve the letter or your application ends; aggregate usage at most 90 days.
• Session replay: at most 30 days.
• Listing advertisements: a retention window per source, as described in Homebound's documentation.
• Data we are legally required to keep, such as a payment receipt, we keep for as long as that legal term lasts.

Security

We take appropriate technical and organisational measures to protect your data, such as storing passwords as a one-way hash rather than readable text, using secure connections (HTTPS), limiting staff access and continuously monitoring for vulnerabilities. No method is completely watertight, but we work continually to reduce risk.

Your rights

You have the right to access your data, have it corrected, have it erased, restrict its processing, take a copy of it (data portability) and object to processing based on legitimate interests. You also have the right to withdraw your consent for analytics, session replay, the AI letter assistant or the extension at any time; consent then applies no longer to the future.

You can exercise these rights from within your account (download your data, delete your account, change your privacy choices) or through our feedback option. We respond within one month.

Complaints and supervision

If you disagree with how we process your data, please first let us know through the feedback option in your account. You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

Changes to this privacy policy

We update this privacy policy when the service or the law requires it. The date at the top of this page shows the version in force.