Privacy policy

Data controller

Cloud Ninja Consulting ApS, CVR no. 46044118, Apeldoorn Alle 20, 2791 Dragør, Denmark. Questions about this policy or your data can be sent to kontakt@lejlet.nu.

What data we collect

• Name and email address, when you create an account
• Phone number, if you choose to provide one — used solely to give a landlord or tenant a contact option besides the messaging feature; we never call or text you ourselves
• Address details for listings you create (validated via Adressevælgeren, the public address service run by the Danish Agency for Climate Data)
• Company name and CVR number, if you register as a business
• The content of messages you send through LejLet.nu's messaging feature
• Your search agents (saved search criteria) and saved listings
• The content of any listing reports you submit
• Suggestions you submit via the "Missing something?" box found in various places on the site, along with an encrypted (hashed) version of your IP address for a short period — used solely to prevent spam and cannot be used to recover your real IP address
• If you've consented to statistics cookies: a random cookie ID, which pages you visit and what you do on the site (e.g. search criteria, which listings you view, and whether you've messaged a landlord — never the content of messages, your name, your email or your phone number), plus device type, browser and approximate location
• When you request a login code: an encrypted (hashed) version of your email address and your IP address, whether the attempt succeeded, and which language the email was sent in — used solely to limit the number of login attempts and cannot be used to recover your real email address or IP address; the address and the IP address themselves are never stored, and the records are deleted automatically after 30 days

Purpose and legal basis

We process your data in order to:

• Fulfil our agreement with you (GDPR Article 6(1)(b)) — create your account, display your listings, relay messages between tenant and landlord, and notify you when a listing matches a search agent you've created — this is part of the service you asked for.
• Legitimate interests (Article 6(1)(f)) — investigate reported listings to counter fraud and platform abuse, prevent spam in our feedback forms, and limit the number of login attempts so that neither your email address nor our login function can be abused to send unwanted mail.
• Consent (Article 6(1)(a), cf. § 3 of the Danish Cookie Order) — statistics on how LejLet.nu is used, via Google Analytics, but only if you've said yes in the cookie banner. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page; this doesn't affect the lawfulness of the processing carried out before the withdrawal.

We do not use your data for marketing, and we do not sell or share it with third parties for commercial purposes.

Who we share data with

We use the following data processors to deliver the service:

• Supabase — hosts our database and handles login. Data is stored within the EU.
• Brevo — an EU-based (French) email provider, sends emails on our behalf: message notifications, search-agent matches and login emails. A login email contains either a one-time code or a login link, and is sent via Brevo or Supabase; both process your email address within the EU.
• Vercel — runs the technical delivery of the website itself and, as part of normal web operations, logs IP addresses in its operational logs. Your database, login, and data continue to live with Supabase in the EU.
• Google Ireland Limited — provides Google Analytics to us as a data processor, and only if you've given consent. We have switched off Google signals, ad personalisation and Google's use of the data for its own purposes. For visitors in the EU, Google doesn't store your IP address; it's used only on servers in the EU to derive an approximate location (country/city) and is then discarded. The data may be transferred to Google LLC in the USA on the basis of the European Commission's adequacy decision (the EU-U.S. Data Privacy Framework), under which Google LLC is certified, and alternatively the European Commission's standard contractual clauses.

Retention

We retain your data for as long as your account is active. If you delete your account, we permanently delete your listings, messages, search agents, saved listings, and reports at the same time — see the rights section below. Login-attempt logs contain only hashed values and are deleted automatically after 30 days, independently of your account.

Statistics data in Google Analytics is deleted automatically after 14 months. Since we don't send your user ID, name or email to Google, statistics data can't be linked to your account.

Your rights

Under the GDPR, you have the right to:

• Access what data we hold about you
• Have inaccurate data corrected
• Have your data deleted — you can do this yourself, instantly, under Account on your account page
• Object to our processing
• Complain to Datatilsynet (the Danish Data Protection Agency) if you believe we're mishandling your data

Cookies

These cookies are technically necessary to deliver a service you've actively requested (§3 of the Danish Cookie Order, per guidance from Datatilsynet and the Danish Agency for Digital Government) and don't require consent:

We also use Google Analytics for statistics on how LejLet.nu is used — but only if you've given consent in the cookie banner. If you decline, or don't make a choice, Google Analytics isn't loaded at all and nothing is sent to Google. Your choice is stored in your browser's local storage (not as a cookie) for 12 months, after which we ask again. You can change your choice at any time via “Cookie settings” at the bottom of every page; if you withdraw your consent, we also delete the Google Analytics cookies in your browser.

Cookie settings

We also use Vercel Analytics (our hosting provider's built-in statistics), which doesn't set cookies or store any identifier about you and therefore doesn't require consent.

Security

All traffic to LejLet.nu is encrypted. Access to your data in our database is restricted by Row Level Security policies, so other users can only see the information you've made public yourself (e.g. your listings) — not your private messages or account details.

Changes

We update this policy whenever we change how we process your data. Material changes will be marked here with a new date.