Privacy policy

1. Who is responsible

Keyhunt (a sole proprietorship, registered with the Dutch Chamber of Commerce under number 81452632, with its registered office at Schoenmakerstraat 22, Eindhoven) is the controller for the processing described on this page. For privacy questions, email hello@keyhunt.nl.

2. Who this policy covers

This policy applies to visitors of keyhunt.nl, users of the web app at app.keyhunt.nl and of the Keyhunt app for iOS and Android, people on the waitlist and search buddies who receive alerts alongside you. It concerns personal data of natural persons.

3. Which data we process

We process only what is needed to deliver the service:

• account data: your email address and an encrypted password;
• search profiles: your search criteria, such as city, price range, floor area, number of rooms and property type;
• notification settings: your chosen channel (push or email) and, for push, a technical subscription from your browser or phone;
• payment data: the status and amount of your Premium purchase. Your bank or card details go directly to our payment provider Mollie and never reach our systems;
• search buddy: your buddy’s email address, only after they have confirmed the invitation themselves;
• waitlist: your email address, with double opt-in;
• support: the content of your emails to hello@keyhunt.nl.

4. What we use your data for

We use this data to:

• match rental listings to your search profile and send you alerts;
• manage your account, settings and purchases;
• send service emails, such as a confirmation or a payment receipt;
• answer your questions and complaints;
• prevent abuse and fraud;
• improve the service with anonymised, cookieless statistics.

We never use your data for third-party advertising and never sell it.

5. On which legal bases

Every processing activity rests on a GDPR legal basis:

• performance of the contract: your account, search profiles, alerts and payments;
• consent: the waitlist, the search buddy feature and push notifications. You can withdraw consent at any time, without retroactive effect;
• legal obligation: keeping payment records for the Dutch fiscal retention duty;
• legitimate interest: security, abuse prevention and anonymised statistics.

6. Listing data and third-party data

Keyhunt monitors public rental listings only. We do not build profiles of landlords or agents and do not store third-party personal data from listings. What we keep is the property information itself (such as address, price and floor area), always with a link to the original listing at the source.

7. Search buddy: only with consent

If you invite a search buddy, we first email that person an invitation with an explanation. Only after they confirm do we start copying them on alerts, and every email to your buddy contains an unsubscribe link. If your buddy unsubscribes, delivery stops immediately and we let you know.

8. How long we keep data

We keep data no longer than necessary:

• account and search profiles: until you delete your account; after that we erase them automatically;
• payment records: 7 years, because of the Dutch fiscal retention duty. If you delete your account we anonymise them, so they can no longer be traced back to you;
• waitlist: until you unsubscribe, or shortly after launch once the list is no longer needed;
• support emails: up to 2 years after resolution, so we still have the context for a follow-up question.

9. Who has access to your data

We share your data only with processors we need to run Keyhunt, each under a data processing agreement:

• Supabase: database and account management (EU region);
• Hetzner: server hosting (Germany);
• Cloudflare: hosting, CDN and security of the websites;
• Mollie: payments (Netherlands);
• Resend: email delivery;
• Expo: delivering push notifications to the iOS and Android app, through Apple’s and Google’s push services;
• PostHog: cookieless statistics (EU cloud);
• Sentry: technical error monitoring of the app.

Our listing-collection systems process public listing data only, never your personal data. Beyond these processors we only share data when the law requires us to.

10. Transfers outside the EEA

Wherever possible we process data within the European Economic Area. Some processors (such as Cloudflare, Resend, Expo and Sentry) may process data outside the EEA; in that case it happens under the European Commission’s standard contractual clauses or an adequacy decision such as the EU-US Data Privacy Framework.

11. Security

Your data is transmitted encrypted (TLS) and stored encrypted, with row-level access control in the database. Access to production data is limited to those who need it. If, despite everything, we discover a data breach that puts you at risk, we report it to the Dutch Data Protection Authority and inform you directly.

12. Your rights

Under the GDPR you have the right to:

• access the data we hold about you;
• correct inaccurate data;
• erasure (the right to be forgotten);
• restriction of processing;
• data portability (export);
• object to processing based on legitimate interest;
• withdraw consent you gave earlier.

You can delete your account by emailing hello@keyhunt.nl; that erases your data automatically. We respond within 30 days and may ask you to confirm your identity.

13. Filing a complaint

Do you feel we are not handling your data properly? Email us first: we almost always resolve it together. You also always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

14. Changes to this policy

We may update this policy, for example for new features or new processors. The date at the top shows the latest version; we announce material changes by email or in the app.