HaveliaHavelia
BuyRent

Owners

SellSee the buyers ›LetSee the tenants ›
List a property →Free · no commission
PartnersAbout usHelp center

Privacy Policy

Version dated 06/11/2026

1. Identity of the data controller

The company HAVELIA, a simplified joint-stock company (SAS), registered with the Paris Trade and Companies Register (RCS) under number 101 916 591, with its registered office at 67 rue du Noyer Pigeon, 37500 Chinon, processes personal data in the course of operating the HAVELIA platform.

For processing whose purposes and means are determined by HAVELIA, HAVELIA acts as data controller. In certain situations involving real estate professionals, software or external partners, the role of each party is determined according to how the processing actually works and the responsibilities of each.

Contact for personal data matters: contact@havelia.app

2. Applicable legal framework

Personal data processing carried out within HAVELIA is subject in particular to Regulation (EU) 2016/679 of 27 April 2016 (GDPR), to amended French Law No. 78-17 of 6 January 1978 known as the « Informatique et Libertés » Act, and to the provisions applicable to cookies and other trackers.

HAVELIA applies in particular the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

3. Personal data processed

The data processed depends on the features used and the information provided by the User.

3.1 Identification and contact data

  • last name;
  • first name;
  • email address;
  • phone number, when provided;
  • status as an individual or a professional;
  • information needed to create and manage the account.

3.2 Account data

  • account identifiers;
  • account creation date;
  • settings and preferences;
  • usage history;
  • actions performed on the platform;
  • history of acceptances of the legal documents: document, version, server date and time;
  • dates of consent to the newsletter and of withdrawal of that consent;
  • information needed to manage the account.

Passwords are not stored in plain text.

3.3 Data relating to property purchase projects

  • budget;
  • desired location;
  • type of property;
  • desired surface area;
  • number of rooms or bedrooms;
  • desired features and amenities;
  • lifestyle criteria;
  • criteria marked as essential, desired or indifferent;
  • declarative information about financing;
  • other criteria needed for the property project.

This data enables HAVELIA in particular to search for and calculate compatibilities between projects and available properties.

3.4 Data relating to rental projects

  • rental budget;
  • desired location;
  • type of home;
  • desired surface area;
  • number of rooms or bedrooms;
  • furnished or unfurnished;
  • desired amenities and features;
  • desired move-in date;
  • essential, desired or indifferent criteria;
  • other information provided to define the rental project;
  • for a holiday rental, when this offer is available: desired stay dates, number of guests and whether animals are coming.

3.5 Declarative data making up the tenant file

As part of HAVELIA Location, a rental applicant may build a tenant file directly on the platform. HAVELIA may process the following declarative information:

  • last name;
  • first name;
  • date of birth;
  • family situation and household composition;
  • number of occupants and dependants;
  • current housing situation (in particular tenant, owner or another situation offered in the form);
  • employment situation;
  • length of time in the job or position held;
  • amount of current income declared by the User and its nature (salary, self-employment, pension, benefits, rental income, grant, other);
  • type of guarantor and, where applicable, the name of the guarantor organisation;
  • DossierFacile link, when the User chooses to provide it.

The User may also add one or more other people taking part in their application, in particular a spouse or partner, a flatmate or a guarantor. For these people, HAVELIA may process the same categories of information where they are needed to build the file.

This information is declared under the User’s responsibility. Entering it does not mean that it has been verified or certified by HAVELIA.

Nationality and place of birth are not collected: French Law No. 89-462 of 6 July 1989 prohibits any discriminatory selection of applicants, and Decree No. 2015-1437 of 5 November 2015 sets the closed list of documents a landlord may request.

3.6 Data relating to properties and listings

  • property characteristics;
  • location;
  • sale price or rent;
  • charges;
  • security deposit when provided;
  • surface area;
  • number of rooms and bedrooms;
  • amenities;
  • photographs, videos and other media;
  • energy information;
  • availability;
  • information provided by the advertiser.

3.7 Matches, interactions and messaging

  • compatibilities and matches;
  • expressed interest;
  • interactions between projects and properties;
  • messages exchanged;
  • date and time of exchanges;
  • information needed to handle a report;
  • technical information associated with interactions.

This data enables in particular matching, messaging and putting users in touch.

4. Tenant file and no collection of supporting documents

4.1 A declarative file within HAVELIA

HAVELIA allows a rental applicant to build a file presenting their situation and, where applicable, that of the other people taking part in their application. This file is based on the information declared by the User and may give an owner or a professional information useful for assessing an application and for putting the parties in touch.

Entering this information does not mean that it has been checked or certified by HAVELIA.

4.2 Income

HAVELIA may collect the amount of current income declared in the tenant file. HAVELIA does not collect, in this file, the supporting documents intended to prove that amount. The declared amount may therefore be entered, but payslips, tax notices or other proof of income are neither uploaded nor stored in HAVELIA.

4.3 No supporting documents

HAVELIA does not directly collect, receive or keep the supporting documents that make up the rental applicant’s document file.

  • national identity card;
  • passport or residence permit;
  • payslips;
  • employment contract;
  • tax notice;
  • proof of address;
  • documents concerning a guarantor;
  • more generally, documents used to prove the information declared.

For example, the User may enter their last name, first name and date of birth, but HAVELIA does not collect their identity document to prove this information.

4.4 DossierFacile

When the applicant wishes to complete their application with a document file, they may enter a DossierFacile link in HAVELIA. The supporting documents are then managed within the DossierFacile environment under its own terms and its own privacy policy.

HAVELIA does not host or keep the supporting documents uploaded to DossierFacile.

HAVELIA processes only the DossierFacile link provided by the User, to the extent needed for the feature offered. The presence of a DossierFacile link does not, by itself, mean that HAVELIA has checked or certified all the information declared by the applicant.

4.5 Spouse or partner, flatmate and guarantor

The holder of a tenant file may enter information about other people taking part in their application, in particular their spouse or partner, a flatmate or a guarantor. In this situation, the data concerning these people may be provided to HAVELIA by the file holder rather than directly by the people concerned.

A User who enters a third party’s information must make sure they are authorised to provide it as part of the rental file and that the person concerned is informed of this transmission.

Where the GDPR requires HAVELIA to inform directly a person whose data was obtained indirectly, HAVELIA provides the required information under the conditions and within the time limits set by the regulations.

5. Financing certificate - purchase project

As part of a property purchase project, the User may, when this feature is offered, voluntarily provide a certificate relating to their financing. Providing it is optional.

  • access to it is limited to authorised persons;
  • it is not publicly accessible;
  • it is not shared with other users except through a specific feature or agreement clearly brought to the person’s attention;
  • it is checked automatically by artificial intelligence, as described in article 8;
  • it is kept for a limited period corresponding to the stated purpose.

6. Professional Client Projects and future interconnections

A real estate professional may create, fill in, import or synchronise on HAVELIA a property search project on behalf of one of their clients. These projects are referred to as « Professional Client Projects ».

HAVELIA plans to enable certain interconnections with partner real estate software or CRMs, in particular to search for properties likely to match the project, bring buyer projects together with available properties and facilitate collaboration between professionals.

As of the date of this policy, the final terms of these interconnections have not yet been settled.

Before any interconnection involving personal data is actually activated, HAVELIA will determine in particular the data concerned, its origin, the direction of the flows, the recipients, the people who may access the information, the precise purpose, the legal basis, the retention period, the respective responsibilities and the necessary contractual safeguards and security measures.

A professional who provides HAVELIA with information about their client must comply with the data protection obligations that apply to them.

As of the date of this policy, projects created directly by individuals on HAVELIA are not transmitted to external software as part of this Professional Client Project interconnection feature.

This policy will be updated before any such interconnection is activated.

7. Technical and security data

  • IP address;
  • date and time of connection;
  • technical logs;
  • information about the browser and device;
  • information needed for technical diagnosis;
  • events used to detect abnormal, fraudulent or automated activity.

This data is used in particular to ensure the security, availability and proper functioning of the platform.

8. Artificial intelligence

Some HAVELIA features use artificial intelligence (AI) models provided by Google. The AI never publishes, sends or contacts anyone on the User’s behalf.

  • Price estimate and suggested listing description: when a listing is published or edited, the property’s characteristics (including its price, street, postcode and town) are sent to the AI, which estimates a market price or suggests a text. The estimate is indicative; the User reviews and edits the suggested text before publishing.
  • Photo checks: every listing photo, profile photo or photo sent in messages is checked automatically to remove inappropriate content and, for a listing, to recognise the room shown. A photo found inappropriate is removed and may be reported to HAVELIA’s moderation team.
  • Financing certificate check (article 5): the AI reads the document to check that it is a certificate of financing for a property purchase. The result (verified or rejected, with the reason) is shown to the User.
  • Kleo, HAVELIA’s assistant, where offered: Kleo is an AI, and says so. Available to signed-in Users with a verified phone number, it answers in writing or by voice and can fill in a draft project or listing that only the User can publish. It receives the User’s messages and the account information it needs to answer (first name, projects, listings, drafts, pending contact requests and the other parties’ first names). It cannot access the content of messages exchanged with other users. In voice mode, the voice is streamed in real time to the AI; HAVELIA does not record the audio and keeps the transcript of the conversation. We recommend not sharing information about your or your family’s health with Kleo.

Creating a project. A project is created by answering Kleo’s questions. An answer chosen with a tap is saved to the draft without any artificial intelligence. When the User types or dictates an answer, that text or recording (30 seconds at most) is sent to the artificial intelligence to be interpreted, together with only those answers already given that are needed to interpret it. Only the values retained, shown to the User who can correct them, are saved to their draft. HAVELIA keeps neither that text, nor the recording, nor its transcript. If the User talks with Kleo in voice mode, the transcript of the conversation is kept for 90 days, like other conversations.

Publishing a listing. A listing is published by answering Kleo’s questions. The User may first describe their property in their own words, typed or spoken (4,000 characters or 90 seconds at most). This description is sent to the artificial intelligence to take from it the answers it contains and to suggest a listing text written from the User’s words. The address is not sent at this step; it may be sent for the price estimate and the suggested description described above. HAVELIA keeps neither the description, nor the recording, nor its transcript. If the User talks with Kleo in voice mode, the transcript of the conversation is kept for 90 days, like other conversations. The answers retained and the suggested text are saved to the draft; the User reviews and edits them before publishing, and that text then becomes the listing’s public description. Photos stay on the User’s device until publication; when added, each one is checked by an automated tool (Google, European Union) that removes inappropriate photos and recognises the room shown, without keeping the photo.

Conversations with Kleo. Written messages and the transcripts of voice conversations are kept for 90 days, then deleted. Audio is not recorded. The User can delete their history at any time.

Purposes and legal bases: providing the assistant and the project or listing creation requested by the User (performance of the contract); limiting usage and preventing abuse (legitimate interest).

Provider. This processing is carried out by Google (Google Cloud, Vertex AI service), HAVELIA’s processor, on servers located in the European Union. Google commits not to use this data to train its models. Google may keep a technical copy for up to 24 hours, in particular so that a voice conversation can be resumed. If its automated filters detect possible abuse, it may keep the request for up to 90 days, in the European Union, for review by authorised staff. Exception: from app versions earlier than 2.0, the price estimate and the suggested description go through a Google global endpoint and may be processed outside the European Union. These transfers are covered by the EU–U.S. Data Privacy Framework, to which Google LLC has certified, or by the European Commission’s standard contractual clauses.

No automated decision with legal effects. This processing makes no decision that produces legal effects concerning the User or similarly significantly affects them: the estimate is indicative, texts and drafts are reviewed and published by the User alone, and the certificate check decides no purchase and no loan. The User may contest the removal of a photo or the rejection of a certificate and ask for a person at HAVELIA to review the decision, by writing to contact@havelia.app.

Your choices. The User is free not to use Kleo and may clear their conversation history with it at any time. They may object to the price estimate by writing to contact@havelia.app. The rights described in articles 18 and 19 apply to this data.

Kleo’s answers are general information, not personalised advice.

9. Data of professionals, subscriptions and payments

  • identity;
  • professional contact details;
  • company;
  • professional information;
  • subscription or service purchased;
  • subscription history;
  • billing data;
  • payment status.

When payments are made through a specialised provider, HAVELIA does not directly keep the User’s full banking details.

10. Purposes and legal bases

  • Creating and managing the account: performance of the contract;
  • Proof of acceptance of the legal documents: legitimate interest (proving acceptance of the contract);
  • Proof of newsletter consent and of its withdrawal: legal obligation (Article 7(1) GDPR);
  • Providing HAVELIA features: performance of the contract;
  • Suggested listing description, financing certificate check and the Kleo assistant: performance of the contract, as the User requests these features;
  • Listing price estimate: HAVELIA’s legitimate interest in giving the advertiser a price reference;
  • Automated photo checks, Kleo usage limits and abuse prevention: HAVELIA’s legitimate interest in protecting users and the platform from inappropriate content and abusive use;
  • Kleo assistant and project or listing creation by conversation: performance of the contract;
  • Managing purchase and rental projects: performance of the contract;
  • Building and managing the holder’s tenant file: performance of the contract;
  • Matching, messaging and requested introductions: performance of the contract;
  • Publishing and managing listings: performance of the contract;
  • Managing professional subscriptions: performance of the contract;
  • Billing and accounting records: legal obligation;
  • Security, abuse and fraud prevention: legitimate interest and/or legal obligation, as the case may be;
  • Handling reports and defending rights: legitimate interest and/or legal obligation, as the case may be;
  • Marketing where consent is required: consent;
  • Trackers that are not strictly necessary: consent;
  • Spouse or partner, flatmate or guarantor data entered by the file holder: legitimate interest in enabling a complete application to be presented;
  • Sending contact details to the agency of a listing published from its software: performance of the contract, at the request of the User expressing interest;
  • Professional Client Projects: performance of the contract with the professional. The legal basis of any future interconnection will be specified before it is activated.

11. Recipients of the data

  • authorised persons within HAVELIA;
  • technical service providers acting on HAVELIA’s behalf;
  • artificial intelligence provider: Google (Google Cloud, Vertex AI), processor, processing in the European Union except as described in article 8;
  • measuring our ads, with your consent: Google (Google Analytics, Google Ads), processor for Google Analytics, separate controller for Google Ads;
  • hosting and infrastructure providers;
  • payment providers;
  • providers involved in security and abuse prevention;
  • owners or professionals with whom an applicant chooses to get in touch;
  • the public, including visitors without an account: a published listing is visible on the havelia.app website and in the app (the listing’s page, search by town, map) and may be indexed by search engines. It shows its description, photos, price, characteristics, town and postal code, its position to within about 1 km (or its exact address if the advertiser chose to show it), and the advertiser’s first name and last-name initial, or the name of the agency and its agent; never the advertiser’s email address or phone number. A published project is also visible on the website and in the app, with its criteria and its author’s first name, last-name initial and profile photo. To stop a listing or project being visible, delete it; search engines may take some time to remove their results;
  • the real estate agencies concerned when a User expresses interest in a listing, including, for a listing published on HAVELIA from the agency’s management software (CRM), that software: the User’s last name, first name, email address and phone number are then sent to it so that the agency can contact them about the listing concerned;
  • other partner software and CRMs once a professional interconnection is actually implemented and after its GDPR framework has been defined;
  • administrative or judicial authorities when required by law.

Data shared with other users is limited to what the feature concerned requires or what has been voluntarily shared.

The supporting documents of the tenant file are not transmitted by HAVELIA, since they are not collected by HAVELIA.

12. Information shared when users are put in touch

When a User expresses interest in a listing or accepts an introduction, some information may be shared with the other party where this is needed for the service to work.

  • last name;
  • first name;
  • contact details;
  • information about the property or rental project;
  • declarative tenant-file information intended to present the application.

Sharing declarative tenant-file information does not include HAVELIA transmitting the corresponding supporting documents. When a DossierFacile link has been voluntarily provided, that link may be passed on to the recipient concerned.

The declarative tenant-file information and the DossierFacile link are only accessible to the owner or professional with whom an introduction for a rental search has been accepted. They are never visible before that acceptance, nor to a seller in a sale.

13. Retention periods

User accounts

For as long as the account is used. Accounts that remain inactive for a long time may be deleted after a period set by HAVELIA.

Acceptance history and newsletter consent dates

For as long as the account exists; deleted with it. They are included in the data export (“Export My Data”).

Property and rental projects

For their active period, then for a limited period needed to manage the account and to defend HAVELIA’s rights.

Declarative tenant-file data

For as long as the account exists. The User can edit it at any time from the app, remove the people attached to it and request its erasure; it is deleted with the account.

Tenant-file supporting documents

No retention period at HAVELIA: HAVELIA neither collects nor keeps these documents.

DossierFacile link

Kept until the User removes it from their file, and deleted with the account.

Messaging

For as long as needed for messaging to work and to manage exchanges, then, if necessary, for a limited period allowing in particular the handling of reports, abuse or disputes.

Artificial intelligence and Kleo

Conversations with Kleo (written messages and transcripts of voice conversations): up to 90 days, then deleted automatically; the User can clear their history at any time. Drafts prepared with Kleo: deleted after 90 days without changes, or earlier if the User discards them. Kleo usage counters: 60 days. Voice audio, typed or dictated answers and descriptions sent to create a project or publish a listing, and data sent for an estimate, a suggested description or a photo check: not kept by HAVELIA. This data is deleted with the account.

Drafts: deleted on publication or after 90 days without changes. Answers typed or dictated while creating a project or a listing: not kept by HAVELIA. Suggested listing text: in the draft until publication, when it becomes the listing’s description, or until the draft is deleted.

Marketing

For the periods applicable to the relationship concerned and in accordance with the applicable rules.

Billing and accounting

For the periods required by the applicable regulations, in particular ten years where this retention period is legally required.

Financing certificate

For as long as strictly needed for the stated purpose, then deleted or archived where an obligation justifies it.

Logs and security

For a period proportionate to security and incident-management needs.

Professional Client Projects

The same periods as property and rental projects. The periods applicable to future interconnections will be specified before they are activated.

14. Data security

HAVELIA implements technical and organisational measures appropriate to the level of risk to protect data against unauthorised access, loss, alteration, disclosure, destruction or fraudulent use.

  • secure hosting;
  • access control and restriction;
  • authentication;
  • encryption where relevant;
  • logging;
  • backups;
  • security measures against automated or malicious access.

Access to data is limited to the people who need it to perform their duties.

15. Cloudflare Turnstile

HAVELIA may use Cloudflare Turnstile to protect certain features, in particular sign-up and sign-in, against bots, automated attempts, abuse and fraudulent activity. This tool may involve processing certain technical information needed for it to work, in particular information about the device, the browser or the connection.

Legal basis: legitimate interest (security).

16. Cookies and other trackers

Havelia reads or writes on your device only what follows. Trackers that need your consent are only activated after “Accept all”, or after you turn their purpose on under “Customise”. You can change your mind at any time: the “Cookies” link at the bottom of the page, or Profile › My data when you are signed in. Your choice applies to this device and this browser; it is kept for 6 months, then asked again. Withdrawing your consent deletes the trackers concerned.

With your consent

  • Audience measurement — PostHog (PostHog Inc., data hosted in the European Union, through f.havelia.app). Pages viewed, a few actions and technical errors encountered, to fix bugs and improve Havelia; when you are signed in, linked to your account’s identifier. In the app: screens viewed, technical errors and masked screen recordings (texts and images hidden). Cookie and local storage ph_…_posthog: 12 months.
  • Measuring our ads — Google Analytics and Google Ads (Google Ireland Ltd). Knowing whether an install or a sign-up came from our Google ads, without profiling or personalised ads. Google receives your browser or device identifier, the ad-click identifier and the sign-up; for Google Ads, it is responsible for its own use (how Google uses this data). Cookies _ga, _ga_XCW8PP23GJ, _gcl_au: 13 months; _gcl_aw, _gcl_gs and local storage _gcl_ls: 90 days; Android app: advertising ID; local storage noting that a sign-up was counted.

Without consent (needed for the service)

  • Remembering your cookie choice — Havelia, local storage eu-consent, 6 months.
  • Keeping you signed in — Havelia (Supabase), local storage sb-…-auth-token, until you sign out.
  • Protecting sign-in and sign-up against bots — Cloudflare Turnstile: reads technical information from the browser during the check, no cookie.
  • Sign in with Google, offered at the sign-in step — Google, its own cookies (g_state, Google’s policy).
  • Preferences and navigation (theme, steps in progress) — Havelia, local or session storage, until changed or the end of the session.

17. Transfers outside the European Economic Area

Where possible, HAVELIA favours processing data within the European Economic Area. Some providers may nevertheless involve a transfer of, or access to, data from a country outside the EEA.

When this happens, HAVELIA ensures that the transfer relies on a mechanism recognised by the GDPR, such as an adequacy decision, appropriate standard contractual clauses or another legally accepted mechanism.

Google may transfer data to the United States; this transfer relies on the EU–US adequacy decision (Data Privacy Framework).

18. Rights of data subjects

  • right of access;
  • right to rectification;
  • right to erasure;
  • right to restriction;
  • right to object;
  • right to data portability where the conditions are met;
  • right to withdraw consent where processing is based on it;
  • right to set instructions regarding the handling of one’s data after death, under the conditions provided by French law.

19. Exercising your rights

Any request relating to personal data may be sent to: contact@havelia.app.

HAVELIA may ask for the information reasonably needed to identify the requester and process the request. An identity document will only be requested where this is necessary to reasonably verify the person’s identity.

HAVELIA responds to requests within the time limits set by the GDPR, in principle within one month of receipt, subject to the extensions allowed by the regulations.

20. Complaint to the CNIL

Anyone who considers that the processing of their data does not comply with the regulations may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).

21. Data protection contact

As of the date of this policy, HAVELIA has not appointed a Data Protection Officer (DPO). Any request concerning personal data may be sent to contact@havelia.app.

HAVELIA reassesses the need to appoint a DPO as its activity and processing evolve.

22. Data obtained indirectly

HAVELIA may receive information about a person who has not provided it directly to HAVELIA, in particular when a user enters the information of a spouse or partner, flatmate or guarantor, or when a professional creates, imports or synchronises a Professional Client Project.

Where the GDPR requires it, the person concerned receives information covering in particular the identity of the controller, the purposes, the legal basis, the categories of data, their origin, the recipients, the retention periods or criteria, and their rights.

23. No sale of personal data

HAVELIA does not sell its Users’ personal data.

Sharing data as needed for a requested feature, an introduction or a governed professional interconnection does not constitute a sale of data. Any further use by a recipient must have its own legal basis where one is required.

24. Changes to the policy

HAVELIA may amend this policy to take account in particular of new features, the development of HAVELIA Location, new partners or providers, future professional interconnections, technical developments or legal or regulatory changes.

When a change substantially affects the processing of Users’ data, HAVELIA provides appropriate information where the regulations require it. The date at the top of the document is that of its last update.