Privacy

What data Kivlo processes, why, where, for how long, and what your rights are.

A page like this is often a wall of text nobody reads. We wrote ours to be clear: each type of data has its own table, which says why we process it, on what legal basis and how long we keep it.

Updated on November 10, 2026

On this page

1. Who is responsible for your data?

SLASH PARIS, which publishes Kivlo, is the controller of your account data, your waitlist sign-up and your exchanges with us. Address: 73 avenue du Général de Gaulle, 94700 Maisons-Alfort, France.

For the data you enter about your tenants, their guarantors and your candidates, you, the landlord, are the controller; Kivlo processes it on your behalf, as a processor (Article 28 of the GDPR). A tenant or a candidate who wants to exercise their rights contacts their landlord.

2. What data do we process, and why?

For each type of data: why, on what legal basis and for how long. To see it, correct it or have it erased, see What are your rights?

The information marked as required in a form is needed to create your account or to answer you; without it, we cannot do so. The rest is optional.

For your account

For your account
Data	your name, your e-mail address and, if you add it, your phone number; your password, stored in a form that cannot be turned back into it, or the Google or Microsoft account you sign in with; your sessions: browser, device and sign-in IP address; for security: your login attempts and, at sign-up, the IP address and a fingerprint of your device computed by your browser; your organization, your plan and your credit history.
Why	Signing you in, securing your account (two-factor authentication, an alert if someone tries to guess your password), limiting the free plan to one account per person, and sending you the e-mails about your account.
Legal basis	The performance of the contract (Article 6.1.b of the GDPR) for the account; our legitimate interest in protecting the service (Article 6.1.f) for security and preventing multiple accounts.
How long	As long as the account exists, then 30 days after you ask to delete it. Login attempts: 1 month. Sign-up IP addresses and fraud signals: 12 months (a signal under review, until the review ends).

Delete your account from your settings: you can cancel for 30 days. The export of all your data is downloaded there too, as a ZIP file.

For your rental management

For your rental management
Data	your properties: address, features, financing and tax regime; your leases, your tenants and their guarantors: identity, contact details, rent and deposit; rents, payments, receipts, reminders and reviews; the documents you upload or that Kivlo generates, and the photos of your inspection reports; your accounts and your tax data.
Why	What you ask the service for: rent receipts, tracking, chasing and reviewing rents, documents, accounts and exports. Never sold, never used for advertising.
Legal basis	The performance of the contract (Article 6.1.b of the GDPR). For your tenants, guarantors and candidates, you set the legal basis; we act on your instructions (Article 28 of the GDPR).
How long	As long as your account exists, or until you delete it. When the account is deleted, everything is erased, documents included: first export what the law requires you to keep, such as your accounts.

For the bank connection

For the bank connection
Data	the accounts you connect: bank, account name and IBAN; their transactions: date, amount and label; the date of your consent and of its expiry.
Why	Spotting the rents you receive, matching them to your leases and booking the entries in your accounts. Read-only: no payment can be initiated.
Legal basis	The performance of the contract (Article 6.1.b of the GDPR), if you connect your bank. Your consent to access your accounts is collected by the licensed provider.
How long	As long as your account exists. If you disconnect your bank, reading stops; transactions already imported stay in your accounts.

Disconnect your bank from the app to stop reading.

For tenant search

For tenant search
Data	their name, e-mail address and phone number; their messages; the documents in their file (ID, payslips, tax notice, guarantor…) and the information extracted from them; the analysis of their file and the scheduled viewings.
Why	On your behalf: receiving applications, asking for missing documents, analyzing files, offering viewings and, if you turn it on, replying with the assistant. You decide: a file flagged as suspicious is only rejected automatically if you turned that on.
Legal basis	Set by you, as the controller; Kivlo acts on your behalf (Article 28 of the GDPR). The messages sent to candidates tell them how their data is processed.
How long	Rejected candidate: erased as soon as the rejection is sent, at the latest 30 days after (a delay you can set from 7 to 90 days). Applications not selected: 30 days after the listing closes.

The candidate contacts you. By replying “SUPPRIMER” to any message they received, they have their data erased and get a confirmation.

For the waitlist

For the waitlist
Data	your e-mail address; the language of the site when you signed up; the date you signed up and, once you click the link, the date you confirmed; where your visit came from: the name of the site that sent you to Kivlo, without the address of its page, and, if the link carried them, its source, medium and campaign (for example “newsletter”). From these we derive the channel: search engine, AI assistant such as ChatGPT, another site, campaign link or direct visit.
Why	Checking that the address is yours, then telling you by e-mail when sign-ups open. Where your visit came from only tells us which sites and campaigns bring sign-ups. Nothing else.
Legal basis	Your consent (Article 6.1.a of the GDPR), given when you sign up and confirmed by clicking the link we e-mail you. For where your visit came from, our legitimate interest in knowing where sign-ups come from (Article 6.1.f), which you can object to.
How long	An address never confirmed: erased 30 days after sign-up. A confirmed address: erased once the opening e-mail is sent, or earlier if you ask to leave the list. Where your visit came from is erased with the address.

When you write to us

When you write to us
Data	your e-mail address; the topic you chose and your message.
Why	Answering you. Your message reaches us by e-mail, at the address of the topic you chose; Kivlo does not store it in its database.
Legal basis	Our legitimate interest in answering the requests we receive (Article 6.1.f of the GDPR).
How long	12 months after our last exchange.

For audience measurement

For audience measurement
Data	the pages viewed and a few actions, such as sending a form; the type of device and browser, the language and the landing page; a random identifier and, in the app, your account’s internal identifier, never your name or e-mail; session recordings, where all text and every input are masked and images removed.
Why	Understanding what gets used and what gets in the way, to improve Kivlo. Never for advertising.
Legal basis	Your consent (Article 6.1.a of the GDPR), given in the cookie banner; without it, the measurement tool is not even loaded.
How long	12 months with PostHog, in the European Union; session recordings: 30 days. The trackers in your browser are described on the Cookies page.

Withdraw your consent from the Cookies page, then write to privacy@kivlo.io to erase what was already collected.

What the AI assistant receives is detailed on the Your data and AI page.

3. Who processes your data, and where?

Your data is hosted in France. Some providers are US companies: the transfers this involves are shown below.

To run Kivlo, we use the following categories of providers; each one receives only what it needs.

Hosting: the app and its database, in France. The website, files (documents, rent receipts, photos) and bot protection go through Cloudflare, a US company.
Emails and text messages: sent from the European Union and from France. Candidates’ emails, for tenant search, are received by Postmark, a US company.
Payment: Stripe, a US company, for subscriptions and credit packs. Your card details go straight to Stripe; Kivlo never sees them.
Bank connection: a licensed provider, read-only.
Electronic signature and electronic registered mail: providers based in France.
Artificial intelligence: Anthropic, a US company, only when you use an AI feature (see Your data and AI).
Technical monitoring: error reports and technical logs, in the European Union, with recognizable personal data masked.
Audience measurement: in the European Union, only with your consent.
Sign-in with Google or Microsoft: US companies, only if you choose to sign in with their account.

Data sent to US companies may be transferred to the United States. These transfers rely on the European Commission’s adequacy decision of July 10, 2023 (EU-U.S. Data Privacy Framework) where the provider is certified, and otherwise on the Commission’s standard contractual clauses (GDPR art. 46). The named list of our providers and a copy of these safeguards are available on request at privacy@kivlo.io.

The Kivlo team only accesses your account to help you: read-only, for 30 minutes at most, with a reason recorded every time.

4. How long do we keep it?

Your account and your management data: as long as the account exists; erased 30 days after you ask to delete it.
Login attempts: deleted after 1 month.
Sign-up IP addresses: deleted after 12 months.
Fraud-detection signals: deleted after 12 months, except a signal under review, kept until the review ends.
E-mail delivery history: deleted after 13 months.
Record of paid service usage (text messages, document reading, signature): deleted after 13 months.
Rejected candidates: erased at the latest 30 days after the rejection, a delay the landlord sets between 7 and 90 days.
Applications not selected: erased 30 days after the listing closes.
AI assistant data: until you withdraw your consent or delete the account.
Waitlist, where the visit came from included: erased 30 days after sign-up if the address was never confirmed; a confirmed address, once the opening e-mail is sent, or earlier if you ask to leave it.
Contact form messages: 12 months after our last exchange.
Audience measurement: 12 months; session recordings: 30 days.
Your subscription invoices: kept for ten years, as the law requires us to.

5. How do we protect it?

Exchanges with Kivlo are encrypted (HTTPS).
Passwords are stored in a form that cannot be turned back into them. A new password is checked against known leaks without ever being sent: only the first five characters of its hash leave.
Two-factor authentication is available.
Files only open through temporary links, valid for a few minutes for the most sensitive documents.
Each organization is walled off: you only see the data of the organization you belong to.
Technical logs mask recognisable personal data.

If a breach of your data occurred, we would report it to the CNIL, the French data protection authority, and, if it posed a high risk to you, we would let you know.

6. What are your rights?

At any time, you can:

access your data and get a copy of it;
have it corrected;
have it erased;
restrict its processing;
get it back in a reusable format, with the export in your settings;
withdraw a consent, without affecting what was done before;
decide what becomes of your data after your death.

Right to object: at any time, on grounds relating to your situation, you can object to processing based on our legitimate interest, such as account security, answering your messages or where your waitlist sign-up came from.

To exercise your rights, write to privacy@kivlo.io. We answer within one month, which can be extended by two months if the request is complex; we let you know if so. If we have reasonable doubts about your identity, we may ask you to confirm it.

7. What about cookies?

What kivlo.io and the app place in your browser, and how to change your mind, is detailed on the Cookies page.

8. Can this page change?

Yes, when the service or the law changes. The update date is at the top of the page; if a change alters how your data is used, we tell you by e-mail before it applies.

9. Contact us

For any question about your data or to exercise your rights: privacy@kivlo.io. You can also lodge a complaint with the CNIL.

By post: SLASH PARIS, 73 avenue du Général de Gaulle, 94700 Maisons-Alfort, France.