What data we process, why, and how to get it removed.
Kavvl is a service of CYOS Group B.V., Glenn Millerweg 39, 1311 RP Almere, Nederland. For any privacy question or to exercise your rights, email support@kavvl.com. We are the data controller for the data you share with us through www.kavvl.com.
Account data (name, email, hashed password, language preference, plan), usage data (saved searches, favorites, flagged deals, call notes, LOIs you send, AI analyses you request), technical data (IP address, browser type, request timestamps) and billing data (customer and subscription id at Stripe). Full card details never reach our servers: Stripe handles those.
To deliver your account and subscription (performance of the contract), to send deal alerts, the daily digest and signals on your favorites (performance and legitimate interest), to prevent abuse and fraud and enforce limits (legitimate interest), and to meet accounting and tax obligations (legal obligation).
Functional email about your account and invoices cannot be switched off while you are a customer. Deal alerts, the daily digest, market radar and favorite signals can be turned off in the app (Deal alerts and Favorites) or by emailing support@kavvl.com. We send email through Resend and keep sending logs for a maximum of 12 months.
To deliver the service we use: Stripe (payments and invoicing), Resend (email delivery), MongoDB (database), RentCast and Realtor via RapidAPI (property data), Google Maps (maps), and OpenAI, Anthropic and Google Gemini for AI analysis and the assistant. They only process what is needed and are bound by confidentiality.
Some of these parties process data in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
When you analyse a deal or use the assistant, we send the relevant property data and your question to the AI model. We never include passwords or payment data. This data is not used to train public models.
Account data is kept while your account exists and for 30 days after, so an accidental deletion can be undone. Invoices and accounting records are kept for 7 years (statutory tax retention). Technical logs are kept for a maximum of 90 days.
We use one necessary session cookie to keep you signed in and local storage for your language and filters. We set no advertising or tracking cookies and use no ad networks.
You have the right to access, rectification, erasure, restriction, portability and objection. Email support@kavvl.com and we respond within 30 days. If you are unhappy with our response you can complain to the Dutch Data Protection Authority.
Passwords are stored hashed, all traffic runs over TLS and access to production data is limited to administrators. If you find a vulnerability, report it to us; we act on reports the same business day.
This policy may change. The current version is always at www.kavvl.com/privacypolicy. Last updated: June 2026.
Data from public sources and licensed feeds. Not investment advice.