Privacy Policy — Mlau

Last updated: 2026-05-18

Data controller: Mlau ApS, c/o Mark Laursen, Denmark. Contact: privacy@mlau.dk.

1. What we collect

When you use Mlau, we collect:

• Account data: name, email address, the company you work for, language preference, and an encrypted password.
• Tenancy data: your assigned room, building, move-in date, optional move-out date, and signature of house rules.
• Photos: images you submit for defect reports, move-out reports, and reference photos taken by Mlau staff in your room.
• Communications: messages you send to Mlau via in-app tickets, and any reply we send back.
• Device + technical data: anonymised device identifier for push notifications, language setting, and error/crash diagnostics via Sentry.

2. Why we collect it

We process this data to:

• Operate the rental service (assign rooms, manage move-outs).
• Enforce the house rules you accepted on move-in.
• Triage defect reports and respond to service requests.
• Send transactional emails (account invites, password resets, status updates).
• Detect and fix bugs in the app via anonymised crash reports.

3. Legal basis

• Contract performance for tenancy data (article 6(1)(b) GDPR).
• Legitimate interest for crash reports (article 6(1)(f)).
• Consent for push notifications (revocable in your phone settings).

4. Who sees it

• Mlau staff (internal).
• Your employer's customer-admin (limited: name, email, room assignment, defects + move-outs you file).
• Third-party processors strictly necessary for service:
  • Postmark (USA) — transactional email delivery.
  • Firebase Cloud Messaging (Google, USA) — push notifications.
  • AWS S3 (eu-north-1, Stockholm) — photo + backup storage.
  • Sentry (USA) — error tracking. PII stripped from event payloads.

International transfers rely on Standard Contractual Clauses.

5. How long we keep it

• Tenancy + account data: while you have an active assignment, plus 12 months after move-out for dispute handling.
• Defect + move-out photos: 24 months after the event.
• Crash reports: 90 days.
• Backups: 30 daily snapshots, then deleted.

6. Your rights

You can ask us to:

• Access the data we hold about you.
• Correct inaccuracies.
• Delete your account ("GDPR forget"). This removes name, email, tenancy history, and anonymises photos. Some financial records may be retained for legal compliance.
• Export your data in a portable format.

Email privacy@mlau.dk to exercise any of these rights. We respond within 30 days.

7. Complaints

You can complain to the Danish Data Protection Authority: datatilsynet.dk.

8. Changes

We post material changes here and notify you in the app at least 30 days before they take effect.

Dansk