Privacy Policy — bail.immo

Effective date: 1 May 2026

This policy explains, in plain language, what data we collect, why, for how long we keep it, and how to exercise your rights.

1) Data controller

Data controller: bail.immo (a service operated in France).

Privacy contact (GDPR): privacy@bail.immo

General contact: contact@bail.immo

2) Data we collect

Depending on your use, we may process:

• Account data: email, name, profile type (tenant/landlord/agency), language,
• Usage data: pages visited, actions taken, timestamps, technical information,
• Document data: leases and documents you upload for analysis,
• Payment data: transaction information (card data is processed by our payment provider),
• Support data: messages sent to support.

We avoid collecting data that isn't necessary.

3) Purposes and legal bases

We process your data to:

• Provide the analysis and generation service (performance of the contract),
• Manage accounts, billing, and support (performance of the contract),
• Secure the platform and prevent fraud (legitimate interest),
• Comply with our legal, accounting, and tax obligations (legal obligation),
• Improve the product and quality of service (legitimate interest, with minimization measures),
• Produce statistics, market indicators, aggregated analyses, evaluation datasets, and performance measurements from aggregated, pseudonymized, or anonymized data (legitimate interest, with minimization and anonymization where possible),
• Send marketing communications where permitted (consent or legitimate interest, depending on the case),
• Transmit certain personal data to commercial partners for prospecting or offers related to your real-estate project where you have separately consented.

4) Retention period

Key principles:

• Contracts and documents imported for analysis: automatically deleted after 30 days,
• Associated analysis results: retained for 12 months to enable user history, then deleted or anonymized,
• Account data: retained while the account is active, then deleted or anonymized no later than 36 months after inactivity,
• Billing data: retained for 10 years (legal obligation),
• Technical and security logs: 12 months maximum unless a particular legal need requires otherwise,
• Marketing data and partner consents: until consent is withdrawn, then deleted or deactivated within 30 days,
• Anonymized data and aggregated statistics: may be retained without time limit once they no longer allow a person to be identified.

If you delete your account, we trigger an early deletion process, subject to legal retention obligations.

Identifying source documents and identifying extracted text are not retained indefinitely by default. Longer retention may apply where necessary for an account history, proof of a transaction, security, a dispute, a legal obligation, or a feature explicitly requested by the user, subject to their rights.

5) Data recipients

Your data is accessible only to the people and processors who need it to run the service:

• hosting and infrastructure,
• technical analysis and monitoring,
• sending transactional emails,
• payment,
• customer support.

Each processor is selected with security and compliance guarantees.

For B2B clients (agencies/companies), a data processing agreement (DPA) can be provided on request.

We may share or commercialize anonymized, aggregated, or statistical information, for example clause trends, market indicators, or sector measurements, where it does not allow a specific person or document to be identified.

With your separate consent, we may transmit to commercial partners listed at /partners certain data useful for prospecting and offers related to your real-estate project: contact details, profile type, geographic area, type of need, property data entered, preferences, customer status, actions taken within the Service, and relevant information from forms, documents, or analyses.

We do not sell identifying personal data or identifying documents to independent commercial partners without specific notice and an appropriate legal basis. Full Documents and identifying full texts are not transmitted for commercial prospecting purposes, except upon explicit request or additional specific consent. Where consent is required, it must be collected separately and can be withdrawn.

6) Transfers outside the EU

If certain processors process data outside the European Union, we put in place appropriate safeguards (notably the European Commission's standard contractual clauses).

7) Your GDPR rights

You have the following rights:

• access,
• rectification,
• erasure,
• restriction,
• objection,
• portability,
• withdrawal of consent at any time (for processing based on consent).

To exercise your rights: privacy@bail.immo

We generally respond within 30 days.

You may also lodge a complaint with the CNIL (www.cnil.fr).

8) Deletion of data

You may request deletion of your account and your data by writing to privacy@bail.immo.

We delete or anonymize data not subject to a legal retention obligation, then confirm the request has been closed.

9) Cookies and trackers

We use:

• cookies strictly necessary for the site to function,
• audience-measurement and marketing cookies only according to your choices (consent where required).

You can change your cookie preferences at any time from the consent manager.

10) Security

We implement reasonable technical and organizational measures to protect your data (access control, encryption in transit, logging, principle of least privilege).

11) Minors

The service is not intended for unaccompanied minors. If you believe a minor has provided data without authorization, contact us at privacy@bail.immo.

12) Updates

We may update this policy to reflect legal, technical, or product developments.

The version in force is the one published at /privacy with its effective date.