Privacy Policy

1. Who we are

CASITANA is operated by Forward Thinking, a company providing property management software for rental property owners in Europe. Our platform helps landlords track finances, bookings, documents and maintenance tasks for their rental properties.

For questions about this policy, contact us at: privacy@casitana.com

2. What data we collect

We collect only the data necessary to provide our service:

• Account data: your name, email address, and password (stored as a bcrypt hash, so we never see your plain-text password).
• Property data: property names, addresses, financial transactions, booking records, and documents you upload.
• Payment data: billing is processed entirely by Stripe. We store only your Stripe customer ID and subscription status, never your card details.
• Usage data: server logs, page visits, and error reports for debugging and service improvement.
• Cookies: the cookies the platform needs to work, such as the one that keeps you logged in, and, only if you allow them, analytics and advertising cookies. See section 7.
• Sign-up attribution: when you create an account on our website, how you first reached us and your cookie choice, only for the cookie categories you allowed. See section 7.

When you use the Casitana website or app while signed in, we record when you last used each of them (the date and the hour, separately for the website and the app). We use this only to understand whether our service is working for you and to offer help, and only the Casitana team can see it (legitimate interest, Article 6(1)(f) GDPR).

When you create an account, we look up the country of the IP address you sign up from and keep only that country, never the IP address. We use it to understand where our customers come from (legitimate interest, Article 6(1)(f) GDPR).

This site or product includes IP2Location LITE data available from https://lite.ip2location.com

3. How we use your data

• To provide, operate and maintain the CASITANA platform.
• To process payments via Stripe.
• To send transactional emails (account confirmation, password reset, subscription receipts).
• To provide customer support when you contact us.
• To improve our product based on aggregated, anonymised usage patterns.

We do not sell your data. If you allow analytics cookies, measurement data is shared with Google Analytics; if you allow marketing cookies, with our advertising providers, Google and Meta. This covers your visits to our public website and, if you created your account there, events such as your sign-up, trial and first subscription payment (see section 7). Without that consent we share nothing with them, and we do not use your data for any purpose other than operating and improving the service and measuring our advertising.

4. Legal basis (GDPR)

Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:

• Contract performance: to deliver the service you subscribed to.
• Legitimate interest: to maintain security, prevent fraud, and improve the platform.
• Legal obligation: to retain financial records as required by applicable law.
• Consent: for any marketing communications, and for the analytics and advertising cookies and measurement described in section 7 (which you may withdraw at any time).

5. Data sharing and third parties

We use the following third-party processors:

• Stripe: payment processing (privacy policy at stripe.com/privacy).
• Railway: cloud hosting and database infrastructure.
• Cloudflare R2: file and document storage.
• Resend: transactional email delivery.
• Anthropic PBC: AI receipt scanning. The receipt image or PDF itself is sent to the model, which reads the amount, date, supplier name and category back out of it. This happens only for a receipt you attach on a plan that includes scanning, and nothing the model returns is kept beyond the transaction you save.
• Sentry (functional.sentry.io): error monitoring and performance tracking to improve application reliability. Session capture runs only if you allow analytics cookies.
• Google (Tag Manager, Google Analytics 4, Google advertising products): on our public marketing pages, website analytics only if you allow analytics cookies, and advertising measurement and personalisation only if you allow marketing cookies. If you allowed analytics cookies when you created your account on our website, our server also reports account events to Google Analytics (see section 7). Tag Manager is the container through which our advertising tags, including Meta’s below, are loaded.
• Twilio Inc.: WhatsApp business messaging (phone numbers, message content).
• Meta Platforms (WhatsApp Business): message delivery. Part of the service; not related to cookies or advertising consent.
• Meta Platforms (advertising pixel and Conversions API): advertising measurement, only if you allow marketing cookies: the pixel on our public marketing pages and, if you allowed marketing cookies when you created your account on our website, account events our server reports to Meta (see section 7). A separate use from WhatsApp message delivery above.
• SES Hospedajes (Spanish Ministry of Interior): guest registration data as required by Royal Decree 933/2021.

All processors are contractually bound to protect your data and comply with GDPR.

6. Data retention

We retain different categories of data for specific periods based on legal requirements and operational necessity:

• Read notifications: 90 days
• Scheduled WhatsApp messages: 30 days after delivery
• Automation logs: 90 days
• Guest registration data (SES): processed on behalf of the host, who is responsible for keeping the guest register for 3 years under Real Decreto 933/2021. Casitana stores it while the host's account is active. When a host deletes their account, they can download these records first; Casitana then deletes them and keeps only the SES filing reference numbers, without guest personal data, as proof of submission, for 1 year.
• Guest registration forms not yet matched to a booking: a form sent through a property's registration link that Casitana could not attach to a booking is stored encrypted until the host assigns it. If the host does not, it is deleted 14 days after the guest's stated departure, or 60 days after it was sent if that is sooner. A form the host discards, or removes from a booking as not their guest, is deleted at once.
• Casitana's own invoices and billing records: Casitana keeps its own invoices and billing records for 10 years, as Belgian accounting law requires. When a client deletes their account, these records keep only the billing name, address and tax ID an invoice needs.
• Audit logs: 1 year
• Sign-up attribution and cookie choice (section 7): as long as your account exists

Deleting your account removes all your data, except Casitana's own invoices and billing records (see above). Before deletion you can download your guest registration records, which you must keep yourself for 3 years under Real Decreto 933/2021. Casitana keeps only the SES filing reference numbers. You can also download your financial records: your transactions and receipts, which are your own bookkeeping and yours to keep, and a copy of the invoices Casitana issued you, for your own records; Casitana keeps the originals.

7. Cookies and similar technologies

We group cookies and similar technologies into three categories. You choose which optional categories to allow the first time you visit, and you can change that choice at any time under Cookie settings.

• Essential: always on. A session cookie keeps you logged in, a CSRF token protects against cross-site request forgery, a language preference cookie (casitana_locale) stores your chosen language for one year, and a menu preference cookie (casitana_nav) remembers for one year whether you collapsed the side menu in the app. These cannot be switched off, because the platform does not work without them.
• Analytics: off unless you allow it. Measures which pages people use and where they run into difficulty. This includes error-triggered session capture through Sentry, a third-party service: when something goes wrong, a recording of what happened on the page is captured so we can diagnose it. Text and form inputs are masked in those recordings.
• Marketing: off unless you allow it. Google advertising products and Meta’s advertising pixel, both loaded through Google Tag Manager, used to measure which advertisements and referrals bring people to Casitana and to show you our advertisements on other sites. Neither is enabled unless you allow this category.

Cookies, analytics and advertising

We only use analytics and advertising cookies after you give consent in our cookie banner. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page. When you withdraw marketing consent, we also delete the advertising cookies from your browser; if you do so inside the customer portal, they are deleted on your next visit to our public website. The consent recorded on your account follows the account owner’s choice: a team member’s choice applies to their own browser only.

Cookies we set ourselves

Third-party cookies

What we do with this information

• Analytics (Google Analytics 4). With analytics consent we measure how visitors use our website, for example which plan our plan finder recommends. If you allowed analytics cookies when you created your account on our website, our server also reports to Google Analytics when you sign up, start a trial, make your first subscription payment and when a subscription ends. With each of these events we send the Google Analytics identifier from your browser, an internal account identifier (so we can combine visits across devices), how you signed up (email, Google or Apple) and the plan, billing period, amount and invoice reference where they apply. We never send your name, email address or phone number to Google Analytics. Whether Google may also use these events for advertising follows your marketing choice: without marketing consent, we tell Google it may not.
• Advertising (Google Ads and Meta). With marketing consent, Google’s and Meta’s advertising tags on our public website measure whether our ads bring visitors and what they do there. If you allowed marketing cookies when you created your account on our website, our server also reports to Meta (Conversions API) when you sign up, start a trial and make your first subscription payment. With each of these events we send your email address and our internal account identifier, both in hashed form (irreversibly encoded with SHA-256), Meta’s browser and click identifiers from the _fbp and _fbc cookies, and the plan, billing period and amount where they apply. With the sign-up event only, we also send the IP address and browser user agent of your sign-up request, which we do not store. Meta uses this to match the event to an existing Meta account. Without marketing consent, we send nothing to Google Ads or Meta.
• Attribution in your account. When you create an account on our website, we store the information from the cookies above (only for the categories you consented to), including the Google Analytics and Meta identifiers, together with your cookie choice and how you signed up. For an account created in our mobile app we store only how it was created, and send nothing about it. We use this to understand which channels bring us customers. It is kept for as long as your account exists, is included in your data export and is deleted when you delete your account.

Legal basis and transfers. The legal basis is your consent (Art. 6(1)(a) GDPR); for casitana_consent it is our legitimate interest in respecting your choice (Art. 6(1)(f) GDPR). Google and Meta may process data in the United States. Both are certified under the EU–US Data Privacy Framework.

Questions: privacy@casitana.com.

We use Google Consent Mode. On our public marketing pages this means the Google Tag Manager container loads before you have made a choice, in a state where advertising and analytics storage are denied; your choice is then applied to it. That applies to every advertising tag in the container, Meta’s included. The container is not loaded at all inside the customer portal, or on the pages guests reach through a registration or contract link.

If you do not allow analytics or marketing cookies, Google still receives cookieless signals through Consent Mode, such as the page you visited, the time, your browser type and the fact that you did not consent, without any cookie being read from or stored on your device.

8. Your rights (GDPR)

As an EU resident, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your account and data (“right to be forgotten”).
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request that we limit how we use your data.

To exercise any of these rights, email privacy@casitana.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

9. Security

We use industry-standard security measures including HTTPS encryption in transit, bcrypt password hashing, and isolated database access controls. No method of electronic storage is 100% secure; we work continuously to protect your data and will notify you promptly in the event of a breach.

10. Changes to this policy

We may update this policy when our practices change or when required by law. We will notify active users by email at least 14 days before material changes take effect. Continued use of the service after that date constitutes acceptance.