Privacy & your data.

Privacy Notice · version 2026-09-21

Local preview — not ready for public registration. The controller's details and hosting arrangements must be completed before public registration.

Who is responsible?

Huurly's data controller: Loading….
Privacy contact: Loading….

Huurly is free

Browsing, creating an account and using Huurly do not require a payment card or a Huurly subscription. Original listing providers may charge separate fees. Their services and privacy notices apply when you visit them.

What we collect and why

• Account: your first name, last name, email, optional phone number, registration and last sign-in dates, and the version and time of your privacy acknowledgement. We use these to operate your requested account. The phone number is not required and is not used for marketing.
• Saved homes and activity: saved listing identifiers, a total count of listing clicks and the most recent click time. Saved homes support your account; limited activity counts help us understand use of the service. For signed-in members, we also record which listing was opened, saved or viewed on the map, its price, source, type and contact-fee category, the time, and whether the action happened on the list or map page. These events are visible only to the owner in the dashboard and are kept for 30 days to understand usage and improve the service. An open event records a request to visit the provider, not proof of a completed visit or rental. Anonymous visitors are not individually tracked by this feature.
• Feedback: your usefulness rating, topic, message, account identifier and submission date. The owner can see your message and associate it with your account to understand and improve Huurly. Feedback is not public.
• Security: an essential session cookie, hashed session and one-time sign-in tokens with expiry in SQLite; short-lived request counters in server memory use your IP address to limit repeated access attempts. The app does not intentionally log your form contents.

Legal bases

We rely on performance of the service you request for core account and saved-home functions (GDPR Article 6(1)(b)). We rely on legitimate interests in protecting the service and improving it for security counters, listing interaction history and voluntary feedback (Article 6(1)(f)); you may object. Optional phone data, if supplied, is processed with your consent and can be withdrawn. Reading or acknowledging this notice is not consent to marketing. We do not send marketing emails, sell member details or use advertising trackers.

Who receives data?

The Huurly owner can access account data and feedback through the protected dashboard. This local preview stores data on the computer running Huurly. Hosting and email arrangements have not been configured.

Listing photographs load from external image hosts, which receive your IP address and browser request information. On the map page, OpenStreetMap receives tile requests, including your IP address and the site's origin. Normal browser caching applies. PDOK receives public rental address queries from our server to locate homes; we do not send it account or feedback data. Opening an original listing sends a browser request to that provider. Those third parties have their own privacy practices.

Cookies and storage

We use the essential huurly_session cookie for sign-in, lasting up to 30 days. It is HttpOnly and SameSite=Strict, and Secure on the public HTTPS site. Signing out clears your current session. There are no third-party analytics or advertising cookies. Your chosen language is stored in your browser to remember this preference. Internal usage events use your existing signed-in session.

How long?

Unconsumed sign-in links and pending registration details expire after 15 minutes and are removed during hourly cleanup or the next sign-in request. Sessions expire after 30 days. Feedback is removed after 180 days. Listing interaction events are removed after 30 days. Accounts inactive for 730 days are removed together with linked sessions, activity and feedback. Cleanup runs at startup and hourly. Active account data stays while your account is in use, unless you request deletion. Request-rate counters expire after 10 minutes. A backup deletion schedule must be configured before launch.

Your choices and rights

You may request access, correction, deletion, restriction or portability where applicable, object to processing based on legitimate interests, and withdraw consent to optional phone storage. Contact the privacy address above. We may need proportionate identity verification to protect your account. We normally respond within one month; lawful extensions or exceptions will be explained. You may complain to the data protection authority in your EU/EEA country of residence, work or the alleged infringement.

No automated eligibility decisions

Huurly sorts public listings using your filters. It does not decide whether you qualify for a home and does not make housing eligibility decisions about you. Do not submit financial documents, identity documents or sensitive personal details through feedback.

Changes

We will update this page when processing changes and provide additional notice where required. Account acknowledgement records keep the version shown at registration.