Privacy policy
Last updated: 31 August 2026
This policy explains what personal data we process when you use Totukeli, why we do it, how long we keep it and what you can demand from us. It is written to be understood: if anything is unclear, write to us and we will explain it.
Who the controller is
Totukeli is an early-stage project, and its full identifying details —legal name, tax ID and registered address of the data controller— will be published on this very page. We would rather tell you than leave you with an incomplete detail and no warning. In the meantime, the contact point for anything to do with your data is totukeli.com@totukeli.com, and we answer every rights request from there.
Contact email for data protection matters: totukeli.com@totukeli.com. We do not have a data protection officer: given the volume and the type of processing, appointing one is not mandatory.
What data we collect and what for
We only collect what we need for each thing. These are all the points at which Totukeli obtains data about you:
| Where | What we collect | What for | Legal basis |
|---|---|---|---|
| Sign-up with email and password | Name, email address, password (we store only a hash, never the password in the clear), the profile you choose (tenant, landlord or brand), and the date and version of the terms and the policy you accept. | Create your account, verify your email, let you in, and be able to prove what you accepted and when. | Performance of the contract (Article 6.1.b GDPR). Proof of consent and of acceptance of the terms is kept because of the legal obligation to be able to demonstrate it (Article 7.1 GDPR). |
| Sign-up or sign-in with Google, Microsoft, GitHub or Facebook | The email address and the name that the provider you choose returns to us, and which of them you used. We do not receive your password and we have no access to your account with that provider. | Create your account or let you in without one more password. | Performance of the contract (Article 6.1.b GDPR). |
| Contact form | Name, email address and the message you write. | Read and answer your enquiry. Nothing else: we do not add you to any list and we do not send you advertising. | Your consent (Article 6.1.a GDPR), which you give by ticking the box on the form. |
| Listing a home (landlords) | Title, city, address (optional), price, number of rooms and the description of the listing. | Publish your listing and make it available to people looking for a home. | Performance of the contract (Article 6.1.b GDPR). |
| Brand profile | Company name, sector and website. | Identify your brand within the platform. | Performance of the contract (Article 6.1.b GDPR). |
| Use of the platform | The requests you send or receive (with any optional message you include), the homes you mark as favourites and the notifications we generate for you. | Make the service work: put tenants and landlords in touch and let you know about anything that affects you. | Performance of the contract (Article 6.1.b GDPR). |
| Any page on the site | Technical connection data: IP address, browser type and operating system, and the request made. | Keep the service standing: limit the number of attempts per IP address, block attacks and detect abuse. | Legitimate interest in the security of the service (Article 6.1.f GDPR). |
| Analytics and errors (only if you accept them) | Aggregated visit statistics and —if you accept analytics— the campaign parameters (UTM) you arrived with. Error reports may include the IP address and browser data. | Know which parts of the site are used, understand which campaign each sign-up comes from and detect technical failures. | Your consent (Article 6.1.a GDPR), which you give in the cookie banner and can withdraw whenever you want. |
What you publish in a home listing is public: anyone who visits Totukeli can see it, registered or not. Think about that before writing anything in the description or the address that you would not want to be seen.
How long we keep each thing
| Data | Retention period |
|---|---|
| Your account and your profile | For as long as the account exists. If you close it, we delete or anonymise the data within a maximum of 30 days, except for anything we must keep because of a legal obligation. |
| Home listings | For as long as they are published and for as long as the landlord's account exists. |
| Requests, favourites and notifications | For as long as the account they belong to exists. |
| Proof of acceptance of the terms | For as long as the account exists and for up to five years afterwards, so that we can demonstrate it if needed. |
| Contact form messages | They live in our email inbox. We delete them when they are no longer necessary, and at the latest one year after the last reply. |
| Backups | They are stored encrypted and deleted automatically after 30 days. Data you delete may remain in a backup until then. |
| Error reports (Sentry) | According to Sentry's default retention, 90 days at most. |
| Visit statistics (Umami) | Aggregated data, with no identification of you. |
Who else processes your data
We do not sell your data and we do not hand it to anyone for advertising purposes. To be able to operate we do work with providers acting as data processors, each with its own contract, and they only process what is essential to provide us with their service:
| Provider | What it does | Where the data is |
|---|---|---|
| Supabase | Hosting of the database where your account and your content live. | European Union (AWS, Ireland — eu-west-1). |
| Render | Hosting of the server that runs the Totukeli API. | Provider based in the United States. |
| Cloudflare | Content delivery network, security and hosting of the website, and image storage (R2). | Global network, based in the United States. |
| Resend | Sending of the service emails: verification, password recovery and notifications. | Provider based in the United States. |
| Sentry | Technical error logging. Only if you accept monitoring in the cookie banner. | Sentry's European region (Germany). Company based in the United States. |
| Umami | Visit statistics. It is our own installation, on our own domain; the data is not shared with anyone. | European Union (AWS, Ireland). |
| Backblaze B2 | Custody of the encrypted backups of the database. | United States (us-east region). |
| Google, Microsoft, GitHub and Facebook | Only if you choose to sign in with one of them: they confirm your identity to us and give us your email address and your name. | Providers based in the United States. |
We may also disclose data to law enforcement, the courts or public authorities when a legal rule obliges us to do so.
International transfers
The database and the analytics are in the European Union. Render, Cloudflare, Resend, Backblaze and the external sign-in providers, on the other hand, are US companies, and some processing may involve a transfer of data outside the European Economic Area.
Those transfers rely on the Standard Contractual Clauses approved by the European Commission and, where the provider is certified, on the EU–US Data Privacy Framework. You can ask us for a copy of the applicable safeguards by writing to totukeli.com@totukeli.com.
Your rights
Over your personal data you can exercise these rights, free of charge and at any time:
- Access: find out what data of yours we process and get a copy of it.
- Rectification: correct data that is inaccurate or incomplete.
- Erasure: ask us to delete it when it is no longer necessary or when you withdraw your consent.
- Objection: object to processing we carry out on the basis of legitimate interest.
- Restriction: ask us to keep the data but stop using it while a claim of yours is being resolved.
- Portability: receive the data you provided to us in a commonly used format, or have us send it to another controller.
- Withdraw your consent at any time, without that affecting what we did before you withdrew it. Consent for analytics and for monitoring is withdrawn from the cookie banner itself.
- Not be subject to automated decisions: we make no decision about you automatically and we do not build profiles of you.
To exercise them, write to totukeli.com@totukeli.com saying which right you want to exercise. We will reply within a maximum of one month. We may ask you to prove your identity if we have reasonable doubts about who is writing to us.
If you believe we have not handled your request properly, or that we process your data improperly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), which is the competent supervisory authority. You can also go to the authority of your country of residence.
Security
Passwords are stored with a slow, salted hashing algorithm (bcrypt), never in the clear. All communication with Totukeli is encrypted (HTTPS). The session travels in a cookie that the page's JavaScript cannot read, and the forms are protected against request forgery. We limit sign-up, sign-in and password recovery attempts per IP address. Backups are encrypted and held with a provider other than the one hosting the database.
No system is infallible. If a breach occurred that posed a high risk to your rights, we would tell you and notify the supervisory authority within the deadlines set by the GDPR.
Minors
Totukeli is a service for people over 18. We do not ask for and do not want data about minors. If we find that an account belongs to a minor, we will delete it. If you believe a minor in your care has signed up, write to us and we will delete it.
Changes to this policy
When we change anything significant we will update this page and its date, and —if the change affects you— we will let you know by email or when you sign in. Current version: 2026-08-31.