Back to home

Privacy Notice

Last updated: 12 June 2026

1. Who we are

Mattis Müller, trading as Keyra ("Keyra", "we", "us"), is the data controller for the personal data processed through this service. For privacy questions, contact privacy@keyrahome.com.

2. What data we collect

  • Account data — email address, display name, password hash, and optional avatar.
  • Home data — home name, address, house rules, manual articles, photos and upkeep records you create.
  • Stay & guest data — booking dates and the names / email addresses of guests you invite, used to deliver access links.
  • Guestbook entries — messages, ratings and photos left by you or your guests.
  • Support communications — messages and feedback you send us.
  • Technical & usage data — IP address, device and browser information, log data and basic product analytics used for security and product improvement.
  • Push notification tokens — only if you opt in to browser notifications.

Payment data (card details, billing address) is collected directly by our reseller Paddle and is not stored on our servers.

3. Why we process your data (legal bases)

  • Contract performance (Art. 6(1)(b) GDPR) — to create your account, run your home, deliver guest access and provide customer support.
  • Legitimate interests (Art. 6(1)(f) GDPR) — security and fraud prevention, service reliability, and product improvement.
  • Legal obligation (Art. 6(1)(c) GDPR) — tax, accounting and compliance records relating to your subscription.
  • Consent (Art. 6(1)(a) GDPR) — push notifications and any optional communications, which you can withdraw at any time.

4. Who we share data with

We share personal data only with the categories of recipients below, and only as needed:

  • Members and guests you authorise — within each home, data is visible to the people you invite.
  • Hosting and infrastructure provider — our backend runs on Supabase (EU region), which stores and processes data on our behalf as a sub-processor.
  • Merchant of Record — Paddle.com — our reseller handles checkout, payments, billing, tax compliance, invoicing and subscription management. Paddle is an independent controller for that data.
  • Email and notification providers — Resend (transactional email) for sending account, booking and guest-access emails.
  • AI processing — Google Gemini API — documents and text you submit to the AI import feature are sent to Google's Gemini API solely to extract your house information. The content is processed on our behalf to generate your import results.
  • Map services — Google Maps — maps load only after you actively click "Load map" (click-to-load). When you do, your IP address and device information are transmitted to Google.
  • Professional advisers — legal, accounting or tax advisers where strictly necessary.
  • Authorities — where required by law or to protect rights and safety.

We do not sell personal data and we do not use it for third-party advertising.

5. International transfers

Our primary infrastructure is located in the European Union. Where a sub-processor (for example Paddle or Google) processes data outside the EU/EEA, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework, or an adequacy decision.

6. Data retention

We keep your data while your account is active. If you delete your account, your personal data is removed within 30 days, except where we are legally required to retain certain records (for example invoices for tax purposes). Homes left with no remaining members are deleted automatically.

7. Security

We apply appropriate technical and organisational measures to protect your data — including encryption in transit, encryption at rest for sensitive fields (such as lockbox codes), row-level access control, and least-privilege backend access.

8. Your rights

Under the GDPR you have the right to:

  • Access, rectify or erase your personal data.
  • Restrict or object to processing.
  • Data portability.
  • Withdraw consent at any time (without affecting prior lawful processing).
  • Lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@keyrahome.com. We respond within one month.

9. Cookies

Keyra uses only essential cookies required for authentication and session management. We do not use advertising or third-party tracking cookies, so no cookie consent banner is shown.

10. Changes

We may update this notice from time to time. We will notify you of significant changes by email or in-app notice.