1. Data controller
weloca is published by theAppsfactory (SIREN: 821 324 332), 24 rue Abel Gance, 84100 Orange, France, the controller of your personal data under the GDPR (EU Regulation 2016/679).
DPO contact: contact@weloca.fr
2. Data collected
2.1 Data you provide
- Account data: last name, first name, email address, phone number
- Payment data: handled by our partners (Stripe, Apple, Google) — weloca never stores your bank details
- Business data: information about your properties (address, surface area, photos), your tenants (identity, contact details), your leases and payments
2.2 Data collected automatically
- Browsing data (IP address, device type, operating system)
- App usage data (features used, login frequency)
- Diagnostic data (error logs, performance)
3. Purposes and legal bases
- Providing the Service — Basis: performance of a contract
- Improving the Service — Basis: legitimate interest
- Transactional communication (confirmations, alerts) — Basis: performance of a contract
- Marketing communication (newsletter, news) — Basis: consent
- Legal obligations (invoicing, record keeping) — Basis: legal obligation
4. Hosting and transfers
Your data is hosted on servers located in France (OVHcloud, Roubaix). No data is transferred to third countries without appropriate safeguards (standard contractual clauses or an adequacy decision of the European Commission).
5. Retention periods
- Active account data: for the duration of the contractual relationship
- Data after termination: 30 days, then permanently deleted
- Billing data: 10 years (legal obligation)
- Technical logs: 12 months
6. Your rights
Under the GDPR, you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct inaccurate data
- Right to erasure: ask for your data to be deleted — from the app or by email to contact@weloca.fr
- Right to data portability: receive your data in a structured format
- Right to object: object to certain processing
- Right to restriction: restrict processing in certain cases
To exercise these rights: privacy@weloca.fr. We will reply within 30 days at most. If you disagree, you can contact the CNIL (French data protection authority).
7. Cookies
The weloca.fr website uses cookies strictly necessary for it to work (session, preferences) and anonymised analytics cookies (Plausible Analytics, no IP collection). No third-party advertising cookies are set.
8. Security
We apply appropriate technical and organisational measures: TLS encryption in transit, AES-256 encryption at rest, two-factor authentication available, regular security audits, and an access-management policy based on least privilege.
9. Data sharing
Your data is never sold to third parties. It may be shared with:
- Technical processors: OVHcloud (hosting), Stripe (payments), Firebase (authentication), Mailgun (transactional emails)
- Competent authorities: only upon judicial request
All our processors are contractually bound to meet GDPR requirements.
10. Changes
This policy may be updated. Any significant change will be notified by email with 30 days' notice.
11. Contact
theAppsfactory — SIREN: 821 324 332 — 24 rue Abel Gance, 84100 Orange, France — contact@weloca.fr