Privacy Policy
Last updated: 9 October 2026
This policy explains which personal data Tenanvo processes, why, and what rights you have. It applies to the Tenanvo website and application.
1. Who is responsible
[Company name - to be completed], [Address - to be completed] ("we"), is the controller for the personal data of the people who use Tenanvo: account holders, people who contact us and visitors of this website. You can reach us at info@tenanvo.com. Full company details are in the imprint.
The data an organization keeps in Tenanvo about its own clients - names, addresses, contact details, tax numbers, invoices and expenses - belongs to that organization. For that data the organization is the controller and we process it on its behalf, only to provide the service. Questions about it are best addressed to the organization that sent you an invoice.
2. What we process
Account data
Your name, email address and password (stored only as a one-way hash), your role and the organizations you belong to, and when you last signed in. Accounts are created by invitation; we use your email address to send the invitation, password-reset links and notices about your account.
Organization data
The details an organization enters about itself, such as its name, address, VAT and registration numbers, bank account number and logo, which appear on its invoices.
Business records
Clients, products, invoices, expenses and the receipts attached to them, entered by the members of an organization. When you email an invoice from Tenanvo, we send it to the address you provide.
Support requests
The messages you send us through the support area or by email, and any attachments.
Technical logs
To keep the service secure and to fix problems we record events and errors, together with your user id, name, email address and browser type. For warnings and errors we also record your IP address. Logs are deleted automatically: debug entries after 7 days, information after 30 days, warnings after 90 days, errors after 180 days and critical errors after one year. Entries you attach to a support request are kept for up to two years so the request can be followed up.
3. Why we process it
- To provide the service you or your organization signed up for (performance of a contract).
- To keep the service secure, prevent abuse and fix errors (our legitimate interest).
- To answer your questions and support requests (performance of a contract or our legitimate interest).
- To meet legal obligations, for example on bookkeeping and tax.
We do not sell personal data and we do not use it for advertising.
4. Cookies and local storage
We only use what the application needs to work: cookies that keep you signed in (including your "remember me" choice) and your preferred language, stored in your browser. We do not use advertising or tracking cookies. Where the site runs on Vercel, we use Vercel Web Analytics, which counts page views without cookies.
5. Who we share it with
We use carefully selected service providers that process data on our behalf, under a data processing agreement:
- Database, authentication and file storage (Supabase).
- Hosting of the application (Vercel), where applicable.
- Sending email, such as invitations and invoices (our email delivery provider).
Where a provider processes data outside the European Economic Area, we rely on an adequacy decision or the European Commission's standard contractual clauses. We share data with authorities only when the law requires it.
6. How long we keep it
Account and organization data are kept for as long as the account or organization exists. When an organization is removed, its records are deleted with it. Logs are deleted as described above. Where the law requires us or an organization to keep records longer - for example invoices for tax purposes - they are kept for that period.
7. Security
Each organization's data is separated from every other organization's and is only visible to its members, according to their role. Passwords and reset links are stored only as one-way hashes, and connections to the service are encrypted.
8. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing and to receive it in a portable format. To use any of these rights, email info@tenanvo.com; we answer within one month. You can update your name and email address yourself on your profile page. You also have the right to lodge a complaint with the data protection authority in your country.
9. Changes
We may update this policy when the service or the law changes. The date at the top shows the latest version.