Privacy

Who is responsible

Apareé is operated by Aparee Digital OÜ, a company registered in Estonia. We are the controller of the personal data described here.

• Company — Aparee Digital OÜ
• Registry code — 17533373 (Estonian Business Register)
• Address — Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Estonia
• Contact — privacy@aparee.com

What we hold

We collect only what we need to answer you, run the services you use, and keep them secure.

• When you contact us — your name, email, organization, role, and the message you send through the Begin form.
• When you use the Benchmark — the email address (and any name or photo) you sign in with, and the building, portfolio, and assessment information you choose to enter.
• When you pay — payment is handled by Stripe; we keep a record of the transaction (amount, date, receipt) but never your full card number.
• When residents contribute — survey answers are stored as a confidential aggregate; contributors are not identified and are not listed on the building.
• Automatically — standard technical data such as your IP address and device or browser information, used to keep the service secure and — for links we share — to derive a coarse, non-identifying location statistic (city, region, country). The IP address itself is not retained for that purpose.

Why we use it, and our legal basis

• To answer inquiries — and take the steps you ask for before any engagement: our legitimate interest, and steps toward a contract.
• To provide accounts and the Benchmark — performance of our agreement with you.
• To take payment and keep accounts — performance of our agreement, and our legal obligations under Estonian accounting law.
• To keep the service secure — and prevent abuse: our legitimate interest.
• To understand how the site is used — through analytics: your consent (see Cookies and analytics, below).

Cookies and analytics

Some storage is essential and is always on: it keeps you signed in, protects against bots, and remembers your light or dark preference. Analytics (Google Analytics) helps us understand how the site is used, and runs only if you consent. You can withdraw consent at any time.

Who we share it with

We do not sell personal data. We rely on a small number of trusted providers to run the service, each under a data-processing agreement:

• Google (Firebase, Cloud) — hosting, database, sign-in, and the functions that run the service, on EU infrastructure.
• Stripe — payment processing.
• Resend — delivery of transactional email: confirmations and notifications.
• Slack — internal notification of a new inquiry; this includes the name and email you submit.
• Anthropic — the analysis behind a paid Behavioral Reading; it receives only aggregated building data, never names, emails, or other personal identifiers.

Where your data is processed

Our database, sign-in, and functions run on Google Cloud infrastructure in the European Union. Some providers — Stripe, Resend, Slack, Anthropic, and parts of Google — process data in the United States; those transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

How long we keep it

• Inquiries — kept while we follow up and for a reasonable period afterward, then deleted.
• Account and building data — kept while your account is active; removed when you close it or ask us to.
• Payment and accounting records — kept for seven years, as Estonian law requires.
• Analytics — retained by Google for a limited period (about fourteen months) and then deleted.
• Aggregated or anonymized data — kept without a time limit, because it no longer identifies anyone.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or provide it in a portable form; and you can withdraw any consent you have given. Write to privacy@aparee.com and we will respond within the time the law allows. If you believe we have handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

Security

Data is encrypted in transit, access is limited to those who need it, and the service runs on hardened EU infrastructure. No system is perfectly secure, but we hold the bureau's data to the standard the bureau is built on.

Children

Apareé is a service for building owners, operators, and professionals. It is not directed at children, and we do not knowingly collect their data.

Changes

We may revise this notice as the service evolves or the law changes. The version published here is the one in force, and we will flag any material change.

Contact

Questions about this notice, or a request about your data, can be sent to privacy@aparee.com — or by post to Aparee Digital OÜ, Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Estonia.