1. Who We Are
PropDesk (propdesk.ie) is a property management platform for landlords in Ireland, operated from Dublin, Ireland. For anything in this policy, you can reach us at privacy@propdesk.ie.
2. Our Role Under GDPR
PropDesk acts as data controller for information you provide when creating and managing your account (your name, email, phone number, profile details, and billing information).
For tenant data that you enter into PropDesk — including names, contact details, dates of birth, PPSNs, and lease information — you (the landlord) act as the data controller, and PropDesk acts as your data processor, handling that data solely on your behalf and under your instruction.
Landlords using PropDesk are responsible for ensuring they have a lawful basis under GDPR to collect and process their tenants' personal data before entering it into the platform.
By using PropDesk, landlords agree to the data processing terms outlined in this Privacy Policy, which constitute the data processing agreement between the landlord (controller) and PropDesk (processor).
3. What Data We Collect
We collect what is needed to provide the service:
- Account details — your name, email address, phone number (verified by an SMS code at sign-up), and your password (stored only as a bcrypt hash, never in plain text).
- Profile details you choose to add — used to generate documents such as RTB forms and tenancy agreements: postal address, date of birth, landlord type, PPSN, company name and CRO number, letting agent details (including the agent's PPSN and licence number), management company details, and a signature image you upload for use on generated documents.
- Property records — addresses, eircodes, BER ratings, valuation and mortgage figures, and other property details you enter.
- Tenant information — names, dates of birth, emails, phone numbers, PPSNs, lease documents and terms, deposits, and rent review records you add, for primary and any secondary tenants. If you invite a tenant to the tenant portal, we also store their portal account (email and a password the tenant chooses, stored as a bcrypt hash) and any maintenance requests they submit.
- Financial data — rent payments, expenses, and receipt uploads you record.
- Compliance records — RTB registrations, RPZ claims, insurance details you track.
- Uploaded files and generated documents — receipts, lease documents, maintenance photos and invoices, compliance evidence, and PDFs the platform generates for you.
- Usage and technical data — pages you visit within PropDesk (with your IP address, browser user-agent, and any sign-up campaign tags), sign-up and login timestamps, an approximate country derived from your IP address using an offline lookup, and logs of SMS verification attempts. We use this to secure the service, understand how it is used, and support customers.
4. Why We Process Your Data
We process your data to deliver the PropDesk service: managing properties, tracking rent, generating documents, sending reminders, and helping you stay compliant with Irish rental regulations.
| Data | Legal Basis |
|---|---|
| Account & billing data | Contract performance |
| Property & financial records | Contract performance |
| Tenant names, emails, phone numbers | Contract performance (on your behalf as processor) |
| PPSNs (yours and tenants') | Legal obligation related to RTB registration or tax compliance |
| Usage & technical data, AI account analysis | Legitimate interest (security, fraud prevention, service improvement, customer support) |
| Advertising measurement (see Cookies) | Legitimate interest / consent where required |
PPSNs may be stored where required for RTB registration or tax compliance purposes under Irish law. They are encrypted at the field level (AES-256-GCM), never used for any other purpose, never included in anything we send to AI providers, and never shared with any third party other than in documents you generate for the RTB.
5. AI Features
PropDesk includes AI features powered by Anthropic (the maker of Claude). Two features send data to Anthropic's API:
- The in-app assistant. When you chat with the assistant, your messages, recent chat history, and a summary of your portfolio are sent to Anthropic to generate a response. That summary includes your name, email and plan, your property addresses and eircodes, ownership entity names, each tenancy's rent amount, lease dates and status (tenants are referred to by number, not by name), open maintenance request titles, and upcoming reminders. If you ask the assistant to take an action (for example logging a payment or adding a property), it asks you to confirm before anything is saved.
- Account analysis. To help us support customers, spot accounts that need help getting set up, and detect fake sign-ups, we run an automated daily analysis of each account using Anthropic's API. This analysis includes your name, email, sign-up source, property addresses, tenant names (names only), feature-usage counts, and recent account activity. The result is visible only to PropDesk administrators.
We never send PPSNs, dates of birth, passwords, payment card details, or your uploaded files to any AI provider. Under Anthropic's commercial terms, data sent to its API is not used to train Anthropic's models.
6. Third-Party Processors
We use a small number of trusted services to operate PropDesk:
- Stripe — processes subscription payments. Stripe receives your email and payment details; PropDesk never stores your full card number.
- SendGrid — sends our emails: account verification, password resets, reminders, tenant portal invites, maintenance notifications, and billing notices. US-based.
- Twilio — sends the SMS verification codes used at sign-up and for password reset, and WhatsApp messages where you configure them. Twilio processes the phone number being verified. US-based.
- Anthropic — powers the AI features described in section 5. US-based.
- Google Cloud Storage — stores your uploaded files and generated documents in a multi-region bucket located entirely within the European Union. Files are private and accessed only through short-lived signed links (valid for 10 minutes).
- Sentry — monitors application errors and performance. Reports contain technical data (route, status code, stack traces) and an internal account identifier so we can investigate problems; no session recording or replay is used.
- Cloudflare Turnstile — protects our sign-up, login, and password reset forms against bots. Cloudflare processes your IP address and a browser challenge token.
- Google & Reddit — advertising and sign-up measurement tags run on our website and app pages (see Cookies, section 11). They are not present on the tenant portal.
The PropDesk application and its PostgreSQL database are hosted on Render in Frankfurt, Germany (EU); database backups are kept in the same region. These processors handle data on our behalf under GDPR-compliant agreements. We do not sell your data.
7. International Data Transfers
Stripe, SendGrid, Twilio, Anthropic, Sentry, Cloudflare, Google, and Reddit are US-headquartered services. Where personal data is transferred outside the EU, those transfers are protected by European Commission approved safeguards such as Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
Your database records (Render, Frankfurt — including backups) and uploaded files (Google Cloud Storage, EU multi-region) are stored within the European Union.
8. Data Storage & Security
Security measures include:
- field-level encryption (AES-256-GCM) of PPSNs, with hashed lookups so plain values never appear in queries
- password hashing using bcrypt — we cannot see your password
- HTTPS/TLS encryption for all connections
- private file storage with signed, time-limited download links
- server-side sessions (a session cookie identifies you for up to 7 days; the session itself is stored in our database)
- rate limiting and bot protection on authentication endpoints
- restricted access to production systems — all provider and administrative accounts are protected with multi-factor authentication
9. How Long We Keep Your Data
We keep your data for as long as your account is active.
If you delete your account (Settings → Delete Account), your records — properties, tenants, leases, payments, expenses, compliance records, and uploaded files — are deleted immediately from our live systems.
Payment and invoice records held by Stripe may be retained as required for financial and tax compliance. We may retain anonymised, aggregated statistics that no longer identify anyone.
10. Your Rights Under GDPR
As an EU resident, you have the right to:
- Access — request a copy of your personal data.
- Rectification — correct inaccurate data (you can do this directly in the app).
- Erasure — delete your account and all associated data (available in Settings).
- Portability — export your data as CSV files (available in the Documents & Reports section).
- Restriction — ask us to limit how we process your data.
- Objection — object to processing based on legitimate interest.
- Complaint — lodge a complaint with the Data Protection Commission (DPC) at dataprotection.ie.
To exercise any of these rights, email privacy@propdesk.ie or use the self-service options in your account settings.
If you are a tenant whose landlord manages your tenancy through PropDesk, your landlord is the data controller for your tenancy data — please direct requests to them first. We will assist landlords in fulfilling tenant requests, and you can also contact us at the address above.
11. Cookies & Browser Storage
Essential cookie. PropDesk uses one session cookie (propdesk.sid, lifetime 7 days) to keep you logged in. It is strictly necessary for the service to function.
Advertising & measurement. Our website and app pages load a Google tag (Google Ads/Analytics) and a Reddit Pixel. We use these to measure sign-ups and the performance of our advertising. These third parties set their own cookies and may recognise your browser across other websites; their processing is governed by Google's and Reddit's privacy policies. These tags do not run on the tenant portal.
Browser storage. The app keeps small convenience items in your own browser — for example navigation state, a cached copy of your name for the sidebar, a daily-tip flag, and your assistant chat history (kept in session storage and cleared when the tab closes). This data stays on your device and is not used for tracking.
Your choices. By continuing to use PropDesk with cookies enabled you consent to the use described above. You can withdraw or manage that consent at any time: block or delete cookies in your browser settings (the essential session cookie is required to stay logged in), or opt out of the advertising tags directly via Google Ads Settings and Reddit privacy settings. If you have questions, contact support@propdesk.ie.
12. Children
PropDesk is not intended for use by anyone under 18 years of age. We do not knowingly collect data from minors.
13. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email or an in-app notice.
14. Contact
For privacy-related questions or data requests, email privacy@propdesk.ie.
See also: Terms & Conditions