DepositSafe
Privacy policy
1. Who we are
The controller of your personal data is DepositSafe Ltd, registered in Ireland under number [CRO number], [registered address]. For anything about your data, write to privacy@depositsafe.ie.
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Email, name, phone number, password (stored only as a hash); your Google account ID if you sign in with it | To create and run your account | Performance of our contract with you |
| Date of birth, nationality, address; images of your identity document and proof of address; a photo of your face | To verify that the landlord, before being paid, and the tenant, if they choose to verify, are who they say they are. A member of our team compares the photo with your document by eye; we do not use facial recognition. | Legal obligation (anti-money laundering) or our legitimate interest in preventing fraud — to be confirmed |
| Property address, rent, deposit amount, dates and terms of the tenancy; the email of the tenant you invite | To set up the deposit agreement between landlord and tenant | Performance of our contract |
| Payment amount and Stripe payment reference. Card details are entered directly with Stripe and never reach us. | To take and track the deposit payment | Performance of our contract |
| The landlord's IBAN and account holder name | To pay out the deposit to the landlord | Performance of our contract |
| Check-in photos and notes | To record the condition of the property, as evidence if a deduction is claimed | Performance of our contract |
| Release, refund and dispute details: amounts, bank transfer references, reasons and evidence | To return or pay out the deposit and handle disagreements | Performance of our contract; legal obligations to keep financial records |
| A log of what happened to each deposit, by account ID | To keep an accurate record of every movement of money | Legal obligation; our legitimate interest in security and accountability |
We do not use your data for advertising, we do not sell it, and no decision about you is made by automated means alone.
3. How we protect it
Names, identity documents and their details, check-in photos, generated documents and IBANs are encrypted on our servers with AES-256-GCM. All traffic to DepositSafe is encrypted with TLS. Bank details are visible only to authorised staff, and only when they need them to make a payment. Backups are encrypted and stored in a second location.
4. Who we share it with
| Recipient | What for | Where |
|---|---|---|
| The other party to your deposit | Your name, the property and deposit details, the check-in record and any deduction or dispute | — |
| Stripe Payments Europe Ltd | Card payments, refunds and fraud prevention | Ireland; transfers to Stripe, Inc. in the US under the EU-US Data Privacy Framework and Standard Contractual Clauses |
| Brevo (Sendinblue SAS) | Sending our emails, including receipts and documents | France (EU) |
| [Hosting provider] | Hosting our servers | [country] |
| [Backup storage provider] | Storing encrypted backups | [country] |
| Only if you choose to sign in with it | US, under the EU-US Data Privacy Framework | |
| The Residential Tenancies Board, courts, An Garda Síochána or other authorities | Where the law requires us to, or to comply with a determination or order about a deposit | Ireland |
5. How long we keep it
- Deposit, payment and dispute records, and the documents we generate: 6 years after the deposit is released or refunded, to meet our legal obligations and defend legal claims.
- Check-in photos: 6 months after the deposit is closed, or 6 years if there was a dispute.
- Identity documents and details: 5 years after our relationship ends if anti-money laundering law applies to us; otherwise 90 days after your last deposit is closed. After that we keep only the outcome of the check.
- The photo of your face: deleted 30 days after we decide on your verification.
- Verifications that were refused or abandoned: 90 days.
- Accounts never used for a deposit: deleted after 24 months of inactivity, with 30 days' notice by email.
- Backups: data you have deleted can remain in our encrypted backups for up to 35 days, until they expire.
6. Your rights
You can ask us to give you a copy of your data, to correct it, to delete it, to restrict how we use it, to transfer it to you in a portable format, or object to our use of it based on legitimate interests. Write to privacy@depositsafe.ie; we will reply within one month.
Where we must keep some data by law, for example the record of a deposit, we will tell you what we keep and until when, and we will use it only for that purpose.
You can also complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, dataprotection.ie.
7. Cookies
We use only what is strictly necessary for the service to work. Details are in our cookie policy.
8. Changes
If we change this policy in a way that matters to you, we will tell you by email before the change takes effect.