Privacy notice

What we process

• Account: email, password (hashed), name, phone, address, preferences.
• The home: everything you and your team add — documents, photos, tasks, site diary, budget, quotes, equipment, bills and consumption, garden, smart plan.
• Household finances, visible only to you: income, loan payments, own funds, loan offers, the bank file.
• Data about other people in documents you upload (for example a supplier’s or tradesperson’s name). You decide what to upload; please upload only what is needed.
• Technical data: the device for notifications, security logs.
• If you reserve a paid plan on the pricing page: the form details (email, name, company, company ID, phone, message) and the price shown then.

Why, and on what basis

• To provide the service you asked for (account, home, AI assistant, document reading, reminders, monthly report) — contract, GDPR art. 6(1)(b).
• Security, abuse prevention and keeping the service working — legitimate interest, art. 6(1)(f).
• Optional messages (for example the monthly report by email) — switch them off at any time in Preferences or from the email link.
• To contact you about the plan you reserved, at your request — steps before a contract, art. 6(1)(b). No advertising is based on it.
• Legal obligations such as accounting, if we introduce payments — art. 6(1)(c).

The AI assistant

The assistant answers from your home’s records and verified public rules; answers are generated automatically and may contain errors. We make no automated decisions with legal effects on you. Loan, cost and consumption figures are estimates, not offers or professional advice.

Who else sees the data

• Members you invite to the home (architect, builder, family), according to the role you give them. Finances stay yours alone.
• Professionals you send a quote request to see only the request, not the home.
• The buyer, if you transfer the home when selling, and anyone with a passport link you created (technical facts only).
• Supabase — database, sign-in and uploaded files; servers in the European Union (Frankfurt).
• Cloudflare — hosting and delivery of the web app.
• Fireworks AI — the model that words the assistant’s answers and reads uploaded documents (invoices, rating plates, utility bills). It receives only what the answer needs.
• Google — address search, only when you press “Search the address with Google”; Google receives the search text and your IP address. You can also type the address yourself.
• Open-Meteo — weather forecasts for briefings; it receives only the home’s town.
• Expo — push notifications to your phone; it receives a device identifier.
• Resend — sending the monthly report by email, once that feature is switched on.
• PowerHosting — the mail server that sends account messages (address confirmation, password reset) from office@homora.ro.

Transfers outside the EU

The main data is in the EU. Some providers (for example Fireworks AI, Google, Expo, Resend) may process data in the US; we rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the European Commission’s standard contractual clauses.

How long we keep data

• While you have an account.
• If you delete your account: we block it at once, and after 30 days we delete the files and irreversibly anonymise the personal data (see Deleting your account).
• Accounting documents, if there are payments, as long as the law requires.
• A plan reservation: while we discuss the offer; if you tell us you no longer want to be contacted, we mark it so and do not contact you again.

Your rights

• Access and a copy of your data (My account → Download my data).
• Correction — directly in the app.
• Erasure — My account → Account deletion.
• Restriction, objection and portability — write to us.
• A complaint to Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (https://www.dataprotection.ro).
• For any request: office@homora.ro. We answer within one month.

Security

Access to every record is checked in the database itself (row-level rules), passwords are hashed, connections are encrypted (HTTPS), and integration tokens are encrypted separately. If a personal data breach happens, we notify the authority within 72 hours, and you if the risk is high.

Age

HOMORA is for people aged 18 or over.