Legal
Privacy policy
What we use, why we need it and your choices.
Updated
Who is responsible
Hesra operates Hesra and is the controller of your personal data. This policy covers our website and rental-search service. You can contact us using the details below.
Information we use
- Google sign-in details, your name, email and account information.
- Search preferences, applicant and household details, uploaded documents and application history.
- Subscription, payment-status and usage records. Your payment provider handles card details.
- Support messages, technical logs and feature-usage events, including account-linked analytics.
Account and application details are needed for the features that use them. Only upload relevant documents you are entitled to share; remove unnecessary identifiers and sensitive information.
Free rental tools
The budget explorer uses aggregated rental observations. For commute maps, address searches go to PDOK and destination coordinates, travel mode and arrival time are processed by Hesra’s self-hosted router. Map tiles load from OpenStreetMap, which receives your IP address and the map areas requested. Hesra temporarily caches tool requests for up to five minutes and does not attach work addresses or commute settings to analytics or your account.
Why we use it
We use your data to perform our agreement: manage your account, find matches, send alerts, submit applications you enable and manage billing. We rely on legitimate interests for security, preventing abuse, support, service reliability and limited analytics to improve Hesra. We also keep records needed to meet legal obligations and establish or defend legal claims. We do not sell personal data or use your application documents for advertising or to train our own AI models.
Who receives it
We use providers for hosting, storage, sign-in, AI processing, email, analytics and payments. They receive data needed for their role. When you enable applications, OpenAI processes relevant profile and form information, and rental providers receive application details and required documents. Those providers decide who gets a tenancy; Hesra does not. You can pause automation, but cannot recall information already sent.
Paddle handles purchases as merchant of record under its privacy policy. Rental and payment providers are responsible for their own records. We may also disclose relevant data to meet legal obligations or protect legal rights.
Our application database and document storage are in the EU. Some providers process data outside the EEA; transfers require an adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact us for provider details or a copy of the relevant safeguards.
Cookies and analytics
We use essential sign-in cookies. Our product analytics uses no fingerprinting, session recordings or visitor identifiers. Public page views, tool use and sign-up button clicks are counted without tracking you across visits; signed-in feature and subscription events can be linked to your account. Analytics includes your account email and name, subscription status, feature usage and internal identifiers linking searches, documents and applications. It excludes document contents, filenames, form values and AI prompts or responses. You can object to account-linked analytics by contacting us.
To learn which pages bring people to Hesra, when you start Google sign-in we send along the Hesra page you first arrived on within the previous 24 hours, the kind of site that sent you (for example a search engine) and its domain, any campaign tags in the link, and the page where you clicked to start. These details are kept in browser local storage for up to 24 hours, without a visitor identifier, to survive reloads and new tabs. They are cleared after successful sign-in. We retain them on our servers only if the sign-in creates a new account, store it with that account and include it in account-linked analytics. It is removed when you delete your account.
We use an approximate country supplied by our hosting provider to show where Hesra is available. Public analytics records only the country code, page and notice interactions, not your IP address or precise location. Session storage remembers that the country notice was shown so it does not keep interrupting your browsing; it contains no visitor identifier and is not used for analytics.
Keeping and deleting data
We keep account data and documents while needed to provide your account. You can edit your information, remove documents or delete your account in settings. Deletion also removes linked analytics and workflow records; provider cleanup may take time. We keep limited records where needed for legal obligations, disputes, support or to reject late events for deleted accounts. Uploaded documents are encrypted in storage.
Your rights and policy updates
You can request access, correction, deletion, restriction or a portable copy of your data, and object to processing based on legitimate interests. Rights depend on the circumstances; we may verify your identity and normally respond within one month. You can complain to the Dutch Autoriteit Persoonsgegevens or your local data protection authority.
We may update this policy and will notify you of significant changes by email or in Hesra.