Privacy Policy

The controller responsible for processing personal data in imanino is:

• Maksimir software lab d.o.o.
• Savska cesta 41
• 10000 Zagreb
• Croatia

For anything related to privacy, including requests to exercise your rights, contact privacy@imanino.com. General questions go to hello@imanino.com, support requests to support@imanino.com. Full company details are in the imprint at /imprint.

We have not appointed a data protection officer, because the conditions of Art. 37 GDPR do not apply to us. privacy@imanino.com reaches the people responsible for data protection directly.

Landlords, owners and agents who use imanino for their business decide themselves which personal data of tenants, co-owners, contacts or other people they add. They are responsible for having a legal basis for that and for informing those people. If you need a data processing agreement for such business use, contact us.

We do not use advertising, tracking pixels, analytics scripts or profiling. We do not sell personal data.

Where we rely on legitimate interests, you can object at any time for reasons arising from your particular situation by writing to privacy@imanino.com.

Providing your name and email address is necessary to create an account. Everything else is optional, but some features do not work without it.

When you upload a document or an inventory photo, imanino converts it to text (for photos: a text description) using Cloudflare Workers AI and asks AI models to suggest a document type, title, parties, amounts, dates, lease terms or an item name, category, condition and room. The text sent includes the document text, the file name or the photo description, and can contain personal data that appears in the document.

• The results are suggestions that you can review and edit. No decision with legal or similarly significant effect is made solely by automated means (Art. 22 GDPR).
• Part of this classification is performed by our processor TypeSafe AI, Inc. in the United States under the EU Standard Contractual Clauses, see Who receives data.
• Uploaded content is not used by us to train AI models.
• AI features are limited per property and per user to prevent misuse.

Other members of a property see the shared records of that property, including your name, profile photo and the member details you add. People you invite receive an email with your name and the property name.

We use the following service providers. Unless the table says otherwise, providers that process personal data on our behalf do so under a data processing agreement (Art. 28 GDPR) and only on our instructions.

If you subscribe to a property calendar feed, your calendar provider (for example Google, Apple or Microsoft) fetches the feed from imanino on your behalf under its own privacy terms. Links that open Google Maps, Google Calendar or Outlook are only followed when you click them.

We disclose data to authorities, courts or advisers only where we are legally required to or where it is necessary to establish, exercise or defend legal claims.

Your account data, shared records and files are stored in the European Union. Some providers listed above can access or process data outside the EU and EEA, in particular in the United States. The safeguard for each provider is named in the table above: an adequacy decision of the European Commission (Art. 45 GDPR), such as the EU-US Data Privacy Framework, or Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the relevant safeguards from us.

imanino is designed so that a record of a property cannot be changed or quietly removed by one side. Uploaded photos and documents are stored in write-once storage and chained by cryptographic fingerprints, so that any later change would be detectable. Neither members nor our staff can edit them.

• To remove a photo, document or item, a member requests deletion. Where the other side of the property is affected, it must approve the request. Once approved, the record is hidden from everyone in imanino and can no longer be opened or downloaded.
• The underlying file and its fingerprint stay in write-once storage so the chain of evidence remains verifiable. It is not used for any other purpose.
• We rely on Art. 6(1)(b) and Art. 6(1)(f) GDPR for this, and erasure requests can be limited where the data is needed to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR) or where erasure would affect the rights of the other members (Art. 17(1) in conjunction with Art. 6(1)(f)).
• If you believe a file contains personal data that should not be kept, for example a photo showing a person who is not a member, write to privacy@imanino.com. We will assess the request and, where the balance of interests requires it, block further access to the file.

You can delete your account at any time in Account, Privacy and data. When you do:

• Your name and email address are replaced by Deleted user and an anonymous placeholder. Your profile photo, login methods and passwords, alternate emails, sessions, trusted devices, calendar feeds, notification settings, onboarding progress and activity days are deleted. Browser cookies set by imanino are cleared.
• Your memberships end, including the phone number, address and bank details you added to them. If you were the last admin of a shared property, another member becomes admin.
• Properties where you were the only member are deleted together with their records, or archived if they contain evidence files.
• Records you created in shared properties, such as evidence files, bills, log entries and contract comments, stay available to the other members and show Deleted user as author. They belong to the shared record of that property.
• Subscriptions you pay for are cancelled immediately and your Stripe customer record is deleted. Stripe and we keep invoices and payment records as required by law.

Before deleting, you can download your data. If you cannot sign in, contact us from the email address on your account.

imanino only uses cookies and browser storage that are strictly necessary to provide the service you request. They are all first-party: set by imanino and not readable by other websites. We do not use analytics, advertising or social media cookies, so we do not show a cookie banner. Under Art. 5(3) of the ePrivacy Directive and the national laws implementing it, strictly necessary storage does not require consent.

Fonts are served from imanino itself. Address suggestions and map tiles are loaded from the providers listed above when you use those features. They do not set cookies through imanino.

We only send emails that relate to your use of imanino. Security and account emails, such as sign-in codes, email verification and invites, are always sent. Activity notifications and reminders can be set to instant or digest delivery or turned off per type and per property in Account, Notifications, and every such email contains a link to manage notifications and a one-click unsubscribe link. We do not send newsletters or advertising.

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have data erased (Art. 17), within the limits explained above
• Restrict processing (Art. 18)
• Receive your data in a structured, machine-readable format and have it transmitted to another controller (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time where processing is based on consent, without affecting earlier processing (Art. 7(3))

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation by writing to privacy@imanino.com. We then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Most of this is self-service: edit your profile and member details in the app, download your data as JSON in Account, Privacy and data, and delete your account there. For anything else, write to privacy@imanino.com. We answer within one month and may ask you to confirm your identity.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where an alleged infringement took place. The authority responsible for us is Agencija za zaštitu osobnih podataka (AZOP), the Croatian Personal Data Protection Agency, Selska cesta 136, 10000 Zagreb, Croatia, https://azop.hr.

• All connections use HTTPS. Session and device cookies are HTTP only and secure.
• Passwords are hashed. Sign-ins on unknown devices require a one-time code sent by email.
• Files are only served to signed-in members of the property they belong to.
• Access to production systems is limited to the people who need it to run the service.

imanino is not directed at children. You must be at least 18 years old, or have reached the age of majority where you live, to create an account.

We update this policy when our processing changes. The version and effective date are shown at the top. If a change is significant, we will inform you by email or in the app before it takes effect.