1. Who we are
The controller of your personal data is Isma G., trading as Trophy Lab and the Convivia app (referred to below as “Convivia”, “we”, “us” or “our”).
Convivia is an app for managing room and shared-flat rentals, aimed at landlords and tenants. This policy applies to the Android and iOS app and to this website.
If you have any questions about this policy or want to exercise your rights, email us at contact [at] quierolibros [dot] com.
2. Summary
- We process the data needed to manage your account, properties, contracts, payments, chat and notifications.
- If you use Google sign-in, we only receive basic data from your Google account and use it to create or link your account and authenticate you.
- We do not sell your data or use it for advertising.
- We do not use product analytics tools or advertising SDKs.
- You can delete your account in the app under Profile → Delete account, or request deletion by email.
- You can read this policy without creating an account and without accepting cookies.
3. Data we process
These are the data categories the app and website actually process. We do not list categories that do not exist in the product.
| Category | Data | Why we use it | Legal basis |
|---|---|---|---|
| Account and profile | Name, email, password stored as a bcrypt hash, role (landlord or tenant), language, assigned avatar, registration and last-login dates, verification status and notification preference. | Create and manage your account, authenticate you and show your profile. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Name, email, account identifier and, if available, the URL of your profile picture. We do not receive your Google password. | Create or link your account and authenticate you when you choose this option. | Performance of a contract (Art. 6(1)(b) GDPR). | |
| Properties and rooms | Description and square metres of the property or room, number of rooms and occupancy status. | Manage the property and the rooms you rent out. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Contracts | Rent, deposit, additional guarantee, advance monthly payments, payment day, grace period, notice period, start and end dates, incidents and end-of-contract requests. | Enter into, perform and manage the rental contract. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Payments and utilities | Amounts, due and payment dates, and payment status for monthly rent and utilities. We do not collect cards, IBANs or bank details. | Track payments, generate reminders and keep the property history. | Performance of a contract (Art. 6(1)(b) GDPR); legal obligation where invoicing or accounting rules apply (Art. 6(1)(c)). |
| Chat | Messages, sender and recipient, read status and blocks between users. | Enable communication between the landlord and tenants of the same property. | Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in facilitating shared living (Art. 6(1)(f)). |
| Invitations and tenants | Invited tenant’s email, acceptance code and link to the contract. There are no ID number, phone number or address fields. | Send the invitation, verify that the invited person accepts and link their account to the contract. | Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in managing the property (Art. 6(1)(f)). |
| Push notifications | Device token, language and whether notifications are enabled. | Send alerts about payments, contracts, utilities and messages. | Consent (Art. 6(1)(a) GDPR), which you can withdraw by disabling notifications. |
| Security | IP address, route, method, response code, user agent and timestamp in server logs. | Protect the platform, prevent fraud and diagnose errors. | Legitimate interest in security (Art. 6(1)(f) GDPR). |
| Website | IP address and technical browser data received by GitHub Pages and Cloudflare; Google Fonts receives your IP when loading the typeface. | Publish and serve this website securely. | Legitimate interest in the security and operation of the site (Art. 6(1)(f) GDPR). |
Data we do not process: we do not use device location, access your camera, microphone, contacts or photos, and there are no fields for ID numbers, phone numbers, IBANs or card data. If you type any of these in a message or description, it will be treated as part of that content. We also do not process health, religion, sexual orientation or other special-category data.
The app has no address field or geolocation. The property description is free text and may contain whatever information you choose to write.
4. Sign in with Google
If you choose to sign in with Google, Google provides us with your name, email address, a technical account identifier and, if available, the URL of your profile picture. We never receive or store your Google password.
We use that data solely to create your account or link it to an existing account and to authenticate you. Your name and email are stored in your account; the Google identifier is stored with the account to link the sign-in. We do not store your profile picture: Convivia assigns you an avatar.
We do not sell, rent or share this data with third parties for advertising. We do not use it for advertising or to build commercial profiles.
We only share it with the providers necessary to deliver the service (hosting, database and push notifications), acting on Convivia’s behalf and under data processing agreements where applicable.
Limited Use: “The use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.”
Artificial intelligence: “Google user data is not used to develop, improve, or train artificial intelligence or machine learning models.”
You can revoke Convivia’s access to your Google account at https://myaccount.google.com/permissions. Revoking access does not delete your Convivia account: to do that, use Profile → Delete account or contact us.
You can read Google’s privacy policy and the Google API Services User Data Policy.
5. Third-party data: landlords and tenants
If you are a landlord and provide a tenant’s email, you confirm that you have a legal basis to share it and that you have informed the tenant about this processing. Convivia uses that email to send the invitation and link the account to the contract.
The tenant can exercise their rights with Convivia or with the landlord who invited them. Within the same property, the landlord and other tenants can see the information needed about the contract, payments and chat, because it is necessary for shared management.
We do not share data between different properties or use it for purposes unrelated to the service.
6. Who we share data with
We do not sell your data or share it with advertisers. We only share it with:
- Infrastructure and service providers, which process data on Convivia’s behalf: Oracle Cloud (API hosting, database and Redis), Google Firebase Cloud Messaging (push notifications), Google OAuth (Google sign-in, if you use it), GitHub Pages and Cloudflare (publishing, DNS and CDN for this site), the email provider that sends verification and invitation emails, and Google Fonts (typefaces on this site).
- Members of your property, when necessary for the contract, payments or chat.
- Public authorities, where there is a legal obligation or a valid request.
Providers may only use the data to deliver the contracted service and are subject to confidentiality and security obligations.
7. International transfers
Oracle Cloud is located in Frankfurt (European Union). Some providers, such as Google, Cloudflare or GitHub, may process data outside the European Economic Area.
In those cases we apply appropriate safeguards: Standard Contractual Clauses approved by the European Commission and, where applicable, the EU–US Data Privacy Framework (DPF). You can ask us for more information about these safeguards at the contact email.
8. Advertising and analytics
Convivia does not show ads and does not include advertising SDKs. We do not use Google Analytics, Firebase Analytics, tracking pixels or equivalent tools. We do not build advertising profiles or sell data to advertisers.
We do not set analytics, advertising or tracking cookies on the website. The app uses local device storage to keep you signed in and remember your preferences; these are not tracking cookies.
The only technical records are the security and diagnostic logs described in this policy.
9. Retention and deletion
We keep your data while your account is active and for as long as necessary to provide the service.
You can delete your account at any time in the app under Profile → Delete account, or request deletion by email. Once confirmed, your data is deleted from the database. If you are a landlord, the properties, rooms, contracts and chats associated with your account are also deleted. If you are a tenant, your account and your link to the contracts are deleted.
We may keep data for longer only where strictly necessary to comply with legal obligations (for example, contractual or tax rules) and to handle potential claims. Security logs are kept for the time needed to protect the platform and diagnose incidents.
If you want to delete your account but cannot access the app, email us from the address associated with your account.
10. Security
We apply technical and organisational measures to protect your information:
- HTTPS/TLS on the website and API, so data travels encrypted.
- Bcrypt passwords: password accounts are stored with a secure salted hash. We cannot see your password.
- JWT tokens and access control: the API requires authentication and checks that the user belongs to the property, contract or chat they are trying to access.
- Rate limiting on sensitive endpoints to make brute-force attacks harder.
- Security logs with IP address, timestamp and technical request data, to detect abuse and diagnose errors.
No system is completely secure. If you spot a security issue, email us and we will review it as soon as possible.
11. Your rights
Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), you can request:
- Access to the personal data we hold about you.
- Rectification of inaccurate or incomplete data.
- Erasure of your data and account, subject to legal retention obligations.
- Restriction of processing in the cases provided by law.
- Objection to processing based on legitimate interest.
- Portability of the data you provided to us.
- Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
- Not to be subject to decisions based solely on automated processing that produce legal effects concerning you.
To exercise them, email contact [at] quierolibros [dot] com with “Convivia” and the right you want to exercise. We may ask for additional information to verify your identity. We will respond within one month.
If you believe we have not handled your request correctly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority in your country.
12. Minors
Convivia is intended for people aged 18 and over. Minors are not allowed to create an account. We do not knowingly collect data from minors; if we detect an account belonging to a minor, we will delete it.
If you believe a minor has provided us with personal data, email us and we will act to delete it.
13. Changes to this policy
We may update this policy to reflect changes in the product, providers or law. We will publish the current version with its update date. If the change is significant, we will notify you in the app or by email.
14. Contact
Controller: Isma G. (Trophy Lab). For any privacy, data protection or policy question, email contact [at] quierolibros [dot] com.
You can also use that email to request account deletion if you cannot do it in the app.