Privacy Policy

Last updated: March 2026

1. Data Controller

The controller responsible for the processing described below is the publisher of dwelliq.io, identified in our legal notice. For any question about your data, or to exercise the rights set out in section 7, write to privacy@dwelliq.io.

2. Information We Collect

When you create an account, we collect your name, email address, and profile image from your OAuth provider (Google or GitHub). When you use DwellIQ to analyze a property, we process the listing URL you provide.

If you are signed out, we store a salted one-way hash of your IP address together with a month counter, solely to enforce the free-analysis limit. We do not keep the IP address itself, and the hash is not used to profile or track you. A hashed IP is still personal data, which is why we disclose it here.

3. Legal Bases

  • Contract (Art. 6(1)(b) GDPR): creating and running your account, delivering analyses, storing your history, and handling your subscription.
  • Legitimate interests (Art. 6(1)(f)): abuse prevention and enforcing free-tier limits for signed-out visitors, and keeping the service secure.
  • Consent (Art. 6(1)(a)): analytics cookies only. Analytics is not loaded at all unless you accept, and you can decline without losing any functionality.
  • Legal obligation (Art. 6(1)(c)): retaining billing and tax records.

4. How We Use Your Information

  • To provide and maintain our service
  • To manage your account and subscription
  • To store your analysis history
  • To track usage limits based on your plan
  • To improve our AI analysis engine
  • To send important service-related communications

5. Data Storage

Your data is stored in a PostgreSQL database on servers located in the European Union (Hetzner, Germany). Analysis results and property data are stored to provide your analysis history feature. We do not sell your data, and we do not share it with third parties except the processors listed below.

6. Third-Party Processors and International Transfers

  • Authentication: Google and GitHub OAuth for secure sign-in
  • Payments: Stripe for subscription billing (PCI DSS compliant)
  • Analytics: Google Analytics for aggregated usage statistics
  • AI Processing: Anthropic (Claude) and OpenAI for property analysis

Stripe, Google, Anthropic and OpenAI are established in the United States, so using DwellIQ involves transferring data outside the European Economic Area. These transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

What is sent for AI processing is the property data — price, living area, city, energy rating and the listing description — together with the computed scores. Your name, email address and payment details are never included in prompts sent to Anthropic or OpenAI. We do not permit these providers to train their models on our API traffic.

7. Your Rights

You have the right to:

  • Access your personal data
  • Delete your account and all associated data
  • Export your analysis history
  • Opt out of non-essential communications
  • Object to processing based on legitimate interests, and request restriction
  • Withdraw analytics consent at any time, by declining the cookie banner or clearing site data
  • Lodge a complaint with your supervisory authority — in France, the CNIL

8. Data Retention

We retain your account data for as long as your account is active. When you delete your account, all personal data and analysis history are permanently removed within 30 days. Anonymous usage counters (hashed IP plus month) are kept for 12 months for abuse prevention. Billing records are retained for 10 years where tax law requires it.

9. Cookies

Essential cookies handle authentication and session management, and a small counter cookie enforces the free-analysis limit; these are required for the service to work. Google Analytics is only loaded after you accept — if you decline, or simply ignore the banner, no analytics script is requested and no analytics cookie is set. When analytics does run, we report only the listing portal’s domain, never the full listing URL you entered.

10. Contact

For privacy-related inquiries, contact us at privacy@dwelliq.io.