Privacy Policy

1. Data Controller

NOTARIA PRIME — Registered office: 1 impasse de Ménez Bijigou, 29120 Pont-l’Abbé, France
Contact : contact@tevaxia.lu

2. Data Collected

Browsing data:
With your consent, PostHog measures visits to selected public pages only. URL parameters, form content, private pages and account identity are excluded. Google Analytics is disabled. You can change your choice using the cookie settings in the footer. Public-page measurement with consent; a random identifier limited to the page, without tracking across visits. The provider receives technical information needed for the network connection.

User account:
Email address, name (optional), profession (optional), hashed password. You can create an account via email/password or through a third-party service (Google, LinkedIn).

OAuth login (Google, LinkedIn):
For account sign-in, Supabase receives identity information authorised by the provider, including the identifier, email address and name. Tevaxia does not receive the provider password. Additional permissions requested for a calendar or Google Drive are separate and described below.

Optional calendar and Google Drive connections:
At your request, a Google Calendar or Microsoft Outlook connection may request event read/write permissions and offline access. The external account identifiers, email, permissions, access and refresh tokens and expiry dates are stored in Supabase for this connection. Authorisation does not mean that all synchronisation features are available. A calendar subscription URL can also share published tasks and viewings with your chosen calendar service: anyone holding this URL can read its contents.

Exporting to Google Drive sends the selected file and its name to Google after your action. The drive.file permission covers files created or opened with the application, not your entire Drive. Provider tokens needed for this action are accessible in the authentication session. Exported files remain in your Drive until deleted under your Google settings.

You can withdraw permissions in your Google or Microsoft account settings. To request deletion of connection data held by Tevaxia, contact contact@tevaxia.lu. Withdrawing permission does not automatically delete files or events already sent to the provider. Also revoke subscription links you no longer want to share.

Simulation data:
Data entered in calculators and simulators (amounts, areas, energy parameters, rental lots, etc.) is stored in your browser localStorage and — if you are signed in — synced to Supabase so you can access it from any device. 500-item cap per free user (10,000 for a Pro plan), 180-day retention from last modification, automatic daily purge thereafter.

Valuer profile:
Name, company, professional contact details — stored in your browser's localStorage or in Supabase if you are logged in. This data is used to personalise valuation reports.

Professional B2B operational data:
Professional users (syndics, real estate agencies, hoteliers) enter into the Syndic/CRM/PMS modules data concerning third parties: co-owners (name, lot, IBAN, balance), hotel guests (name, stay dates, address, tokenised card number), CRM contacts (name, email, phone, purchase criteria), real estate mandates. For this data, tevaxia acts as processor under GDPR art. 28: the professional user is the controller and must have an appropriate legal basis (performance of a syndic contract, accommodation contract, real estate mandate).

PSD2 banking data (Enable Banking connection):
If you connect a bank through Enable Banking, retrieved transactions are used for the reconciliation you request. Tevaxia stores session and account identifiers and the validity date returned by the provider. A validity period of 180 days is requested, subject to the bank’s conditions; renewed authentication may be required. This is not a universal consent or retention period and must not be confused with the available transaction history. The private key used for Enable Banking requests remains on the server.

Invoice OCR & documents — local processing:
PDFs and images uploaded in the invoice OCR module are processed exclusively in your browser (PDF.js for text extraction, Tesseract.js for scan OCR). No file, no image, no extracted text is sent to any third-party AI service (OpenAI, Anthropic, Google, Mistral) nor to our servers. Only the structured data extracted (supplier, amount, IBAN, VAT…) that you explicitly validate is then saved to Supabase.

Payment data (Stripe):
If you subscribe to a paid plan, payment processing (credit card, SEPA) is entirely handled by Stripe Payments Europe Limited (Ireland). tevaxia never receives or stores your full card number: only a Stripe customer ID, the last 4 digits of your card and its expiration date are kept in our database to allow you to manage your subscription.

3. Purposes of Processing

• Service operation (calculations, simulations, display of results)
• Saving simulations and valuations to your account
• Personalisation of valuation reports (valuer profile)
• Public-page measurement with consent

4. Legal Basis for Processing

• Consent (Art. 6.1.a GDPR): Public-page measurement with consent
• Performance of a contract (Art. 6.1.b GDPR): creating and managing your account, saving simulations and optional connections needed for the features you request.
• Legitimate interest (Art. 6.1.f GDPR): service improvement, platform security.

You may withdraw your consent at any time for processing based on this legal basis.

5. Sub-processors

6. Data Retention

• Account data: kept until the user deletes their account.
• Simulation data (saved valuations, rental lots): 180 days from last modification, 500-item cap per free account (10,000 for a Pro plan). Automatic daily purge at 03:00 UTC for rows exceeding these thresholds. Local data (localStorage) remain available as long as the browser is not cleared.
• Public share links: 90 days by default, duration configurable by the user (1 to 365 days) at creation, with optional view cap.
• Audience measurement choice: acceptance and refusal are both stored in the browser for 180 days, with the decision date and version, then requested again. This is a service policy, not a universal legal rule. Authentication sessions follow their expiry and renewal; local backups remain until removed by the user or browser.
• B2B operational data (co-owners, hotel guests, CRM contacts): retained for the duration of the service contract with the professional user. Specific LU legal retention obligations apply (accounting and invoices 10 years under art. L.16-2 Commercial Code, general meeting minutes 10 years, AML/KYC data 5 years).
• Bank connection: validity ends on the date returned by the bank or provider. Expiry blocks access but does not mean connection metadata is automatically erased. You can request deletion at contact@tevaxia.lu. Data incorporated into your reconciliation documents follows the retention of those documents.
• Invoice OCR: PDFs/images uploaded are never stored on our servers — 100% browser processing. Only structured data validated by the user is saved.
• Calendars: connection information and tokens remain stored while the integration exists; token expiry does not delete its record. Deletion can be requested using the contact below. Copies already held by Google, Microsoft or another calendar, and exported Drive files, remain subject to your account settings with that provider.

7. Your Rights

In accordance with the General Data Protection Regulation (GDPR) and the Luxembourg law of 1 August 2018, you have the following rights:

• Right of access to your personal data
• Right to rectification
• Right to erasure ('right to be forgotten')
• Right to data portability under the GDPR conditions. The profile JSON export covers only the categories listed in its manifest: it is not a complete account archive and excludes several business modules, documents and logs. Contact us to exercise your rights for data not included.
• Right to object to processing
• Right to restriction of processing under the conditions of the GDPR

To exercise these rights, contact us at contact@tevaxia.lu.

8. Cookies

• Technical cookies (necessary): essential for the operation of the site (language preferences, session). No consent required.
• Analytical cookies (consent): With your consent, PostHog measures visits to selected public pages only. URL parameters, form content, private pages and account identity are excluded. Google Analytics is disabled. You can change your choice using the cookie settings in the footer. Public-page measurement with consent; a random identifier limited to the page, without tracking across visits. The provider receives technical information needed for the network connection.
• Authentication cookies: Supabase session management (login token). Required for user account functionality.

9. Data Transfers Outside the European Union

Some of our sub-processors are located in the United States. These transfers are governed by standard contractual clauses approved by the European Commission and/or the EU-US Data Privacy Framework adequacy decision.

Account and simulation data are hosted by Supabase on servers located in the European Union (AWS eu-central-1, Frankfurt, Germany).

10. Security Measures

We implement the following technical and organisational measures to protect your data:

• Encryption of communications via HTTPS (TLS)
• Content Security Policy (CSP)
• Row Level Security (RLS) on Supabase: each user can only access their own data
• Hashed passwords (never stored in plain text)
• Local browser processing for invoice OCR (PDF.js + Tesseract.js): no document sent to any external AI service
• PSD2 keys stored in server environment variables, JWT RS256 signature for every bank request

11. Data Protection Officer / Contact

For any questions regarding the protection of your personal data, you can contact us at contact@tevaxia.lu.

12. Right to Lodge a Complaint

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission Nationale pour la Protection des Données (CNPD)
15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg
cnpd.public.lu