Privacy policy

This policy explains what personal data Bausian processes when you use it, why, where it is stored, who receives it, and your rights under the EU General Data Protection Regulation (GDPR).

1. Controller

2. What we process

• Account data: your name, email address, sign-in method, and sign-in and verification status.
• Property data you enter: address, property details, rooms, and, if you add them, your landlord's name, email address and phone number. Only add third-party details you are allowed to share.
• Photos: a resized copy used in the app and your original upload, kept byte-for-byte as evidence. Original files can contain metadata such as capture time, camera model and, if your camera recorded it, GPS location.
• Evidence records: after each upload our server records a fingerprint (SHA-256) of the original file, when it was uploaded, and from the file's metadata the capture time, camera model and whether a location was recorded (not the location itself). For each PDF we generate we store its fingerprint under a verification code, with its title, dates and number of findings and photos.
• Inspection results: captions, notes, AI checklists, damage findings with their photo areas, your reviews and corrections, comparisons, and generated PDF reports.
• Documents you upload to a property (for example a lease or handover protocol).
• Shared report links: if you share a report, we store a copy of it with the link, when the link was opened and how often, and the recipient's response: their name, optional email address, decision, comments and the time of the response. Recipients do not need an account.
• Usage counters (how many analyses, reports and exports you ran per day) to enforce fair-use limits.
• Error reports: when the app hits an unexpected error, the error message and technical trace, the page it happened on (with private link and verification codes removed), your browser type and your pseudonymous user ID (not your name or email).
• Technical data: IP address and request information processed by our hosting provider to deliver the service and protect it from abuse.

3. Purposes and legal bases

• Providing the service you signed up for (accounts, inspections, AI analysis, reports, documents): Art. 6(1)(b) GDPR.
• Sending a report to recipients you choose, such as your landlord: at your request, Art. 6(1)(b) GDPR.
• Recording a recipient's response to a shared report: providing the service to you (Art. 6(1)(b) GDPR) and, for the recipient, our and your legitimate interest in documenting the agreed condition of the property (Art. 6(1)(f) GDPR). Recipients can contact us to exercise their rights.
• Evidence records and the public verification page, which let anyone holding one of your PDFs or original photos confirm it is unaltered: providing the service to you (Art. 6(1)(b) GDPR). The verification page only shows the document type, dates, counts and fingerprint, never names, addresses or findings. Files checked there are fingerprinted in the browser and are not uploaded.
• Error reports, to find and fix faults: our legitimate interest in a reliable service, Art. 6(1)(f) GDPR.
• Security, abuse prevention and fair-use limits: our legitimate interest in a secure, available service, Art. 6(1)(f) GDPR.

AI findings are suggestions. You confirm, edit or dismiss each one before any report is created. Bausian does not make automated decisions with legal or similarly significant effects about you (Art. 22 GDPR).

4. Where your data is stored and who receives it

• Google Cloud / Firebase (Google Ireland Limited) hosts the app. Your account, database records and files are stored in Frankfurt, Germany (europe-west3); the web app is served from the Netherlands (europe-west4). Google acts as our processor under its data processing terms.
• Anthropic PBC (USA) provides the AI model (Claude) that writes photo checklists, detects damage in your photos and compares inspections. For these features we send the relevant photos and inspection details (room names, notes, captions and findings; not your name or email) to Anthropic, which processes them in the USA. This transfer is based on the EU Standard Contractual Clauses in Anthropic's data processing terms. Under Anthropic's commercial terms, data sent through its API is not used to train its models and is retained only for a limited period, for example for abuse monitoring.
• Email delivery: when email delivery is enabled, reports are sent through Resend, Inc. (USA), based on the EU Standard Contractual Clauses. Recipients you add (for example your landlord) receive the report.

5. How long we keep data

• Your properties, inspections, photos, documents and reports are kept until you delete them or delete your account.
• Deleting a property, inspection, comparison or your account removes the related records and files. Deleting your account removes everything, including your sign-in.
• Data exports are deleted automatically after 7 days.
• Evidence records are kept with the photos and reports they describe and are deleted with them. After that, a verification code no longer confirms the PDF.
• Shared links stop working when they expire or you revoke them. The link record, including any recipient response, is kept as part of the inspection until you delete the inspection, the property or your account.
• Error reports are kept in Google Cloud Logging for 30 days.
• Hosting logs are kept by our hosting provider for a limited period for security and operations.

6. Cookies and local storage

Bausian uses no advertising, analytics or tracking cookies. It stores only what is strictly necessary in your browser: your sign-in session (Firebase Authentication) and your appearance preferences (light/dark mode and accent color). Because this storage is strictly necessary for the service you request, no consent banner is needed (§ 25(2) TDDDG).

7. Your rights

• Access and data portability (Art. 15, 20): download all your data at any time in Settings → Download my data (JSON plus all your files).
• Rectification (Art. 16): edit your details, properties and findings in the app.
• Erasure (Art. 17): delete individual items, or your whole account in Settings → Delete account.
• Restriction and objection (Art. 18, 21): contact us at vsr.veera@gmail.com.
• Complaint (Art. 77): you can lodge a complaint with a data protection supervisory authority, for example Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Wiesbaden.

8. Security

Data is encrypted in transit and at rest. Access rules ensure that only you can read or change your properties, photos, documents and reports.

9. Changes

We will update this policy when the service changes and show the date of the latest version at the top.