Legal
Privacy policy
Effective 16 October 2026.
This policy explains how EasyHaus ("EasyHaus", "we") handles personal data. It covers visitors to easy.haus, people who contact us, and the members of organizations that use EasyHaus.
If you are an investor using a manager's portal, or you left your details on a manager's public offer page, the manager is responsible for your data. Please read the manager's privacy notice; section 3 explains our role.
1. Who is responsible
Abbasov Anar, a sole entrepreneur registered in the Republic of Azerbaijan (VAT ID 3103587002), 52nd street, Sebail district, Baku AZ1000, Azerbaijan, is the controller for the data described in section 2. You can reach us about privacy at [email protected] or the contact form at /contact, choosing the topic "Privacy and data protection" in the form. We have not appointed a data protection officer, because our processing does not require one.
We process personal data in line with the Law of the Republic of Azerbaijan on Personal Data and, where it applies to you, the EU General Data Protection Regulation (GDPR).
2. Data we process as controller
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data of members: name, email, password hash, two-factor and passkey settings, language, role | Providing the manager app and signing you in | Contract (Art. 6(1)(b)) |
| Organization and billing data: company name, billing address, tax ID, subscription and invoice records. Card details are held by Stripe, not by us | Billing, tax and accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Security data: IP address, user agent, sign-in times, active sessions, request identifiers | Protecting accounts, preventing abuse, investigating incidents | Legitimate interests (Art. 6(1)(f)) |
| Contact form: name, email, company, topic and message | Answering your message | Legitimate interests; steps before a contract |
| Service emails we send you and their delivery status (delivered, bounced, marked as spam) | Account, security and billing notices | Contract; legitimate interests |
We do not use advertising, tracking pixels or third-party analytics, we do not sell personal data, and we do not make decisions about you based solely on automated processing.
You give us your account and billing data to use EasyHaus; without it we cannot provide the service. Contacting us is voluntary.
3. Investor data we process for managers
Managers use EasyHaus to keep records about their clients and portal users: identity and contact details, KYC documents, tax and bank details, investor classification, holdings, orders, distributions, messages and documents, and the details people leave on a manager's public offer page. For this data the manager is the controller and EasyHaus is a processor acting only on the manager's instructions under a data processing agreement.
If you are an investor and want to access, correct or erase your data, contact the manager. If you contact us, we will pass your request to the manager.
4. Who receives data
We use these sub-processors to run the service:
| Sub-processor | Purpose | Data | Location and transfer safeguard |
|---|---|---|---|
| OVHcloud | Hosting of the application servers and the database | All customer data stored in the database | Warsaw, Poland (EU) |
| Cloudflare | Network security, encryption and delivery of all traffic to EasyHaus | All data passing between your browser and EasyHaus, including IP addresses | Global network, Cloudflare, Inc. in the United States; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Amazon Web Services (S3) | Storage of documents, photos and generated PDFs | Files uploaded or generated in the service | United States (us-east-1); EU–US Data Privacy Framework and Standard Contractual Clauses |
| Amazon Web Services (SES) | Sending transactional and notification emails | Recipient name and address, email content | United States (us-east-1); EU–US Data Privacy Framework and Standard Contractual Clauses |
| Google (Google Drive) | Storage of encrypted backups | Backups of the database, encrypted on our server before upload; Google cannot read them | United States and other Google locations; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Stripe | Subscription billing of customers for EasyHaus | Customer billing contact, billing address, tax ID and payment method; no investor data | Ireland (EU), with transfers to the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses |
Maps in the manager app load map tiles from OpenFreeMap, which receives your IP address and the map area shown. Property addresses are looked up with OpenStreetMap's geocoding service; no personal data is sent.
We disclose data to authorities only where the law requires it. EasyHaus staff access customer accounts for support only when the organization's owner has enabled support access.
5. International transfers
EasyHaus is operated from the Republic of Azerbaijan. The database is hosted in the European Union. Some sub-processors in section 4 are based in the United States or process data there. Each of them is certified under the EU–US Data Privacy Framework, and the European Commission's Standard Contractual Clauses apply as well. Where personal data from the European Economic Area is accessed from Azerbaijan, the Standard Contractual Clauses apply. You can ask us for a copy of the safeguards at [email protected].
6. How long we keep data
- Member accounts: while the account exists. A member can delete their account unless they are the sole owner of an organization.
- Organization data: for the subscription, then 90 days after it ends, then deleted. A deleted organization can be restored for 30 days before it is purged.
- Invoices and accounting records: for the period required by the tax and accounting laws of the Republic of Azerbaijan.
- Security data: sessions and sign-in links are deleted 30 days after they end; web server logs are kept for up to 52 days.
- Contact form messages: as long as needed to handle your request and any follow-up, and at most 24 months.
- Encrypted backups: 30 days.
7. Security
We protect data with encryption in transit and of sensitive fields at rest, strict separation between organizations, two-factor authentication, passkeys and an audit trail. The security page at /security describes the measures in detail.
8. Your rights
You can ask for access to your data, correction, erasure, restriction and portability, and you can object to processing based on legitimate interests. Members can see and correct their account details and delete their account in their account settings; for anything else, including a copy of your data, write to us through [email protected] or the contact form at /contact. We answer within one month. You may also complain to a supervisory authority, for example the competent authority of the Republic of Azerbaijan or, if you are in the European Economic Area, the data protection authority where you live or work.
10. Changes
We will publish changes to this policy on this page and tell organization owners about material changes by email.