Privacy policy

Data controller

The controller of your personal data is MB Tenlo (company code 308157451), registered office Žirmūnų g. 27, LT-09105 Vilnius, Lithuania. Data collected and stored in the Register of Legal Entities of the Republic of Lithuania (keeper: State Enterprise Centre of Registers). Email: info@tenlo.lt, phone +370 694 88900.

We have not appointed a Data Protection Officer, as this is not required under the GDPR. For any data protection question, use the contact details above.

The service is intended for adults. If you are under 18, you may not use Tenlo.

What data we process

Account data: first and last name, email, phone, language, profile photo, country, VAT-payer status and code, and company details (if provided).

Rental data: property addresses, rental terms, bank account details, meters, readings and photos, bills, payment statuses, maintenance records and chat messages.

Rental contract data: the parties' names, personal identification numbers, ID document numbers and expiry dates, addresses and contact details – if you enter them in a contract. If you upload a document to fill in a contract (ID card, passport, company register extract or an old contract), it is stored with the contract only if you choose so.

Subscription data: plan, payment history and invoices issued by Tenlo. Card details are handled by Stripe – Tenlo never receives or stores them.

Consent records (when you accepted the Terms and the Privacy policy, your cookie choice) and messages you send us via the contact form or by email.

Technical data: login time, IP address, browser type and device information – for security and troubleshooting.

Where we get the data

Mostly from you. Some data may be provided by another user: a landlord inviting a tenant enters their name and email, and when preparing a contract – the other party's details. If you sign in with Google, we receive your name, email and profile photo from Google. From Stripe we receive the status of subscription payments.

Why we use it and on what basis

To provide the service, including preparing and storing bills, readings and contracts and sending notifications about them (performance of a contract, GDPR Art. 6(1)(b)). To produce and keep subscription accounting records (legal obligation, (c)). To keep the service secure, prevent fraud and abuse, improve the service and answer your enquiries (legitimate interest, (f)). Analytics cookies are used only with your consent ((a)). We do not send marketing messages without your separate consent.

Roles of the landlord and Tenlo

Data a landlord processes for their rental activity (e.g. tenants' details in contracts, bills, readings) is processed by the landlord as an independent controller: the landlord decides what to enter and is responsible for having a legal basis for it. For that data Tenlo acts as a processor – it stores and processes it only on the landlord's behalf to provide the service and does not use it for any other purpose. The processing terms are set out in the Terms of service.

Artificial intelligence

If you upload a supplier invoice, a meter photo or a document to fill in a contract, it may be passed to an AI provider to recognise the amount, the reading or the contract party's details. You always review and confirm the result yourself. This data is not used to train AI models.

Automated decisions

We do not make decisions based solely on automated processing that have legal effects on you, and we do not profile you.

Processors and recipients

Data is processed by these service providers: Base44 (app platform, hosting, database, sign-in, file storage and AI features), Twilio SendGrid (system emails), Zoho (the info@tenlo.lt mailbox), Stripe (subscription payments) and, when these features are enabled, a payment-initiation provider (bank-link payments) and an e-signing provider (Dokobit or GoSign). Data processing agreements apply to our processors.

Google (sign-in with Google) and, for certain purposes such as fraud prevention, Stripe act as independent controllers under their own privacy policies. We disclose data to public authorities (e.g. the tax authority or law enforcement) only where required by law.

Some processors may process data outside the European Economic Area, e.g. in the USA. In that case transfers rely on a European Commission adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses.

Who sees your data

Property data is visible only to its landlord and the tenants and household members they invite. A tenant sees the landlord's name, contact details and the details needed to pay bills; a landlord sees the tenant's name, contact details and the readings, photos and payment confirmations they submit. We do not sell your data, share it for advertising or pass it to third parties other than the recipients listed above.

Do you have to provide the data

Your email and other account data are needed to enter into a contract with Tenlo – without them we cannot create your account. A profile photo, company details, personal identification numbers in contracts and other additional data are optional, but without them some features (e.g. contract preparation) may not work.

How long we keep it

Subscription invoices and other accounting records are kept for 10 years, as required by accounting law. Rental bills and contracts – until you delete them or your account is deleted; contracts – no longer than 10 years after they end. Document photos saved with contracts – until you delete them or for as long as the related contract is kept. Other account data – while you use your account and for no longer than 12 months after deletion. Contact-form and email messages – up to 24 months. Technical logs – up to 12 months.

Your rights

You have the right to access your data, correct it, request its deletion, restrict processing, object to processing based on legitimate interest, receive your data in a machine-readable format and transmit it to another controller (portability), and withdraw your consent at any time – without affecting the lawfulness of processing before withdrawal. You can change or export most data yourself in the app.

Send your request to info@tenlo.lt. We reply within one month; where necessary we may extend this by two further months and will tell you so. We may ask you to confirm your identity first. If your data was entered into Tenlo by a landlord, you may also contact them – we will pass such a request to the landlord and help them fulfil it.

You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt), although we suggest contacting us first.

Security

Data is transmitted over an encrypted connection (HTTPS), access is restricted by role, and logins are protected by a password with email verification or by your Google account. We will inform you without undue delay of a personal data breach likely to result in a high risk to your rights. No system is completely secure, so please keep your login details safe.

Changes and contact

We will notify you of material changes to this policy by email or in the app. For data protection questions, contact info@tenlo.lt or +370 694 88900.