Privacy Policy

This policy explains how Cíos collects, uses, shares and protects personal data. Cíos is a service for landlords and their tenants to manage tenancies, rent, receipts and documents. It is operated by Meitheal Technology ("we", "us"), the controller of the personal data described here. You can reach us about any privacy matter at meitheal@meithealtech.ie.

The data we process

We process the following categories of personal data:

Account data: your name, email address, role (landlord, tenant or accountant) and the password hash used to sign you in.
Tenancy data: properties, tenancies, rent amounts, payment records, documents and photos you or your landlord add to the service.
Financial data: figures you enter or import for rent, expenses, loans and tax, and payout details where you collect rent through the service.
Bank account information: where you choose to connect a bank account, the account details and transactions we retrieve through open banking, used only to match and reconcile rent. See "Open banking" below.
Technical data: the minimum needed to keep you signed in and the service secure, such as session cookies and server logs.

Open banking

Connecting a bank account is optional and is never required to use Cíos. When you choose to connect one, we use Enable Banking, a licensed account information service provider in the European Union, to retrieve your account and transaction information from the bank you select, and only after you give your explicit consent in your bank's own interface. This access is read only: Cíos can see transactions to reconcile rent, but cannot move money or initiate any payment. We use the data solely to match incoming payments to the right tenancy. You can withdraw your consent and disconnect the account at any time from the open banking settings, and the connection also expires on the schedule set by your bank.

Why we process it, and our legal bases

To provide the service you or your landlord signed up for (performance of a contract).
To meet legal obligations, such as keeping records needed for tax and tenancy law (legal obligation).
To connect a bank account through open banking, which we do only on your explicit consent, given through your bank and withdrawable at any time.
To keep the service secure and working, for example preventing abuse and fixing faults (legitimate interests).

Who we share it with

We do not sell personal data. We share it only with service providers that help us run Cíos, each bound to process it on our instructions and to protect it:

Supabase, for database hosting and authentication, on infrastructure in the European Union.
Enable Banking, for the optional open banking connection described above.
Stripe, where rent or plan payments are made, for payment processing.
Mistral AI (France), where you use the assistant or receipt reading features, processing only the text or document you submit for that feature.
Resend, to send transactional email such as receipts and sign-in messages.

We may also disclose data where the law requires it. This list may change as the service evolves, and this page will be updated to reflect it.

Where it is stored

Cíos data is hosted in the European Union. Where a provider processes data outside the European Economic Area, that transfer is covered by an adequacy decision or by standard contractual clauses.

How long we keep it

We keep personal data for as long as your account is active and for as long afterwards as the law requires us to, in particular the retention periods set by tax and tenancy law. Bank transaction data pulled through open banking is kept only as long as needed to reconcile rent, and the connection itself is removed when you disconnect it.

Your rights

Under the General Data Protection Regulation you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw a consent you have given, including your open banking consent, without affecting processing carried out before you withdrew it. To exercise any of these, write to meitheal@meithealtech.ie. You also have the right to complain to the Data Protection Commission in Ireland at dataprotection.ie.

Security

Access to data is restricted so that each landlord, tenant and accountant sees only their own records, passwords are stored only as hashes, sensitive fields are encrypted, and bank access is read only. No system is perfectly secure, but we take appropriate technical and organisational measures to protect your data.

Changes to this policy

We may update this policy as the service or the law changes. When we do, we will revise the date at the top of this page.

Contact

For any question about this policy or your data, contact Meitheal Technology at meitheal@meithealtech.ie.