Torch Real Estate

Privacy policy

Last updated: 28 July 2026

1. Controller

The controller responsible for data processing on this website is:

Torch Technology LTD
[Street + number]
[Postal code + city]
[Country]
Email: hello@torchtechnology.de

2. What data we process

We process the following categories of personal data:

  • Account data of the property manager / landlord (name, email, organisation)
  • Tenant data (name, contact, date of birth, contract details) — entered by the property manager
  • Applicant data (name, contact, household size, income info) — entered by applicants or staff
  • Chat content from Telegram and portal messages between tenant and landlord
  • Images and documents (damage photos, contracts, handover protocols, applicant documents)
  • Technical logs (IP address, timestamps, user-agent — only as needed for operation and security)

3. Purposes and legal basis

We process data to fulfil the contract with the property manager (Art. 6(1)(b) GDPR) and on the basis of legitimate interests in operating a secure, functional platform (Art. 6(1)(f) GDPR).

Tenant data is processed on behalf of each property manager as a processor under Art. 28 GDPR. A data processing agreement (DPA) is available on request.

4. Third-party processors

We use the following service providers:

  • Supabase Inc. — database, file storage, auth. Server location: Frankfurt (EU). DPA in place.
  • Railway Corp. — application hosting.
  • Resend — transactional emails.
  • Stripe Payments Europe, Ltd. (Dublin, Ireland) — payment processing and subscription management for paid use of the software. Processed data: payment details (card or bank details, billing address, VAT ID, payment history). Card details are collected and stored solely by Stripe — we never have access to them. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations). Invoices and payment records are retained for ten years under § 147 AO and § 257 HGB.
  • OpenRouter / OpenAI / Google AI — AI-powered contract analysis + photo OCR. Only active if explicitly enabled per organisation.
  • Telegram FZ-LLC — Telegram bot for tenant communication. Only active per-org.
  • Google LLC — Google Calendar OAuth for viewing appointments. Only active per-user; access limited to calendar.events scope.

5. Retention

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods. After account deletion, data is removed within 30 days unless statutory retention applies.

6. Your rights

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction (Art. 18 GDPR)
  • Portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)

Requests: hello@torchtechnology.de. We respond within one month.

7. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority.

8. Cookies

We only set technically necessary session cookies for authentication and to preserve language + theme preferences. No tracking, analytics, or marketing cookies.

9. Contact

For all privacy-related questions: hello@torchtechnology.de