Who we are
thetenant.app makes short-let signs, public pages and compliance records for operators in Malta. We decide what personal data this product collects and what it is for, which makes us the controller for it under the General Data Protection Regulation and the Data Protection Act, Cap. 586.
There is no registered company behind thetenant.app yet. Until there is, we are the people running thetenant.app, and you reach us at [email protected]. This clause will name the registered entity and its address as soon as one exists. We would rather say that here than print a company name that does not.
Who this covers
Four kinds of person reach this product, and they give us different things.
- Operators. You hold an account and manage one or more units.
- Responsible persons. An operator has named you as the 24-hour contact for a unit or a building.
- Reporters. You are a neighbour, a resident or a guest who reported something.
- Visitors. You read a page here and gave us nothing.
The rest of this page is written in that order.
There is a fifth, and they never came here at all. Where a landlord keeps a lease in their account, that lease names a tenant. The section on saved leases below is written for that tenant, and it is the one part of this page about somebody who cannot have read it before we held their details.
If you hold an account
We hold this because you asked us to produce signs and pages for your units. The legal basis is the contract between us: without this there is no account and no sign.
| What | Why we have it |
|---|---|
| Email address | Signs you in, sends you the sign PDF, and carries a report from a unit you manage. |
| Name | Goes on the account and on the emails we send you. |
| Password | Kept only as a bcrypt hash. We cannot read it, and a reset replaces it rather than recovering it. |
| Phone number, if you give one | So somebody can reach you about a unit. |
| Your units and buildings | Address, locality, postcode, licence number, bedrooms and occupancy. These are what a sign and a unit page have to carry. |
| What you write on a page | Welcome text, house rules, quiet hours, the wifi network and your own links. |
The address of a unit and its licence number are printed on a sign and published on a public page. Sixth Schedule Standard 1.1.2 sets out what a sign has to carry, and publishing those is the purpose of the product rather than a side effect of it.
If a lease with your name on it was kept here
A landlord can build a private residential lease on this site. Printing one keeps nothing at all. A landlord who is signed in can also press keep, and then we hold the agreement so they can come back, change a line and print it again.
A lease names two people. If you are the tenant, we hold your full name and the number of the identity card or passport the landlord wrote into it, along with the address, the term, the rent, the deposit and the clauses. We hold it because the landlord asked us to keep their document, which is our legitimate interest in providing the thing they came for, and theirs in having a contract they can produce and amend.
| What | Why we have it |
|---|---|
| Both parties full names | A lease has to name who is signing it. |
| Both identity card or passport numbers | The contract carries them, and a saved contract with them missing is one to retype rather than reopen. |
| The property, the term, the rent, the deposit and the clauses | The seven things article 6(1) of the Private Residential Leases Act requires, which is what the document is. |
It is deleted two years after the term of the lease ends, whether or not anybody asks. The landlord can delete it before that from their own screen, in one press. That period is ours: no instrument sets one, and we would rather say so than name a law that does not say it.
We do not send it anywhere, publish it, or read it to build anything else. If you are the tenant on a lease kept here and you want it out, write to [email protected] and we will find it and delete it.
If you are named on a sign
Where an operator names you as the 24-hour contact we hold your full name, your contact number, and an email address where one was given.
Your name and your number are printed on the sign and shown on the unit page. The regulation requires a sign to carry the name, surname and contact number of a designated person available 24 hours to receive complaints, so publishing them is the obligation rather than our choice. The basis is the operator's legal obligation under L.N. 92 of 2026, and our legitimate interest in providing the tool that discharges it.
The email address is treated differently. It is not on the sign and it is not on the page. It exists so a report reaches whoever is on duty without somebody having to be rung at 2am.
The operator who named you is the one who should have told you. If you were named without knowing, write to [email protected] and we will tell you which operator did it and take it up with them.
If you asked for our updates
We hold your email address, the date you asked, where on the site you asked from, and the exact wording you agreed to. We keep the wording because proving consent means proving what was consented to, and the words beside a checkbox change over time.
The basis is your consent, and consent means an unticked box that you ticked. Nothing here is ever pre-ticked, and agreeing to updates is never a condition of getting a sign: the sign is free either way, and tying the two together would make the consent worthless as well as unlawful.
If you asked from a page rather than from the sign wizard, we send one email asking you to confirm, and nothing else until you do. That is the only way we can tell that the address is yours rather than one somebody typed into a public box. If you asked while making a sign, we do not send that email, because the sign itself went to that address with the link into your account, which already proves it.
You can leave from the foot of any of these emails, and it takes effect at once. Leaving does not touch your account: emails about your own units, a wrong licence number or a sign that needs reprinting still reach you, because those are about the thing you asked us to look after rather than about anything we want to sell you.
If you reported something
When you report a problem from a unit page or a building page, we hold what you wrote and which category you chose, with the time it arrived. Your name, your phone number and your email address are each optional, and we hold only what you filled in.
We use it to pass the report to the person on duty, to send you a link for following it, and to keep the compliance log the operator has to show at an inspection or a renewal. The basis is our legitimate interest in running a complaint route that works, together with the operator's own duty under L.N. 92 of 2026 to receive complaints at any hour.
An email address does one further thing. It is where we send the code that opens the messages on your report. Without one you can still see the status of your report, and we say so on the page rather than showing you a form that cannot work.
Your words go to the operator and to the person on duty for that unit. They are not sold, they are not shared for advertising, and they reach nobody else except us.
We are the exception, and it is a narrow one. To answer an operator who has written to us for help, someone here can open that operator's account and see what they see, including your report. Every time that happens it is written down: who did it, whose account, and everything they changed while they were in there. If they write a reply on the operator's behalf, that entry is marked in the record as ours rather than theirs. Ask us at [email protected] and we will tell you whether anyone has looked at your report.
Who else sees it
| Who | What they get | Where |
|---|---|---|
| Brevo | Every email this product sends, so the address it goes to and what is inside it. | France |
| Google Ireland Limited | Google Tag Manager and Google Analytics 4, and only once you have accepted. | Ireland, with onward transfer to the United States |
| PostHog | Product analytics on its EU Cloud, and only once you have accepted. For a signed-in operator this includes the email address, the name and the role on the account, and the unhandled errors described above. | European Union |
| Our hosting provider | The database and the API run there. | European Economic Area |
The MTA is not on that list, and one thing does travel to them. When an operator presses to check a licence, we send the licence number to str.mta.com.mt. No personal data goes with it, and nothing calls them when a page is opened.
Where it is kept
The database and the API run in the European Economic Area. Brevo is French. PostHog is on its EU Cloud.
Google Analytics is the one transfer out of the EEA. Google Ireland Limited is the controller for it here, and onward transfer to the United States runs on the European Commission's standard contractual clauses. Declining measurement means none of that happens.
How long we keep it
- Your account, for as long as it is open. Deleting it deletes your units, buildings, signs, responsible persons, saved leases and reports with it.
- Reports and the compliance log, for as long as the unit exists. The log is what an operator shows at an inspection or a renewal, so it is not thinned out on a timer.
- An unverified email address, for as long as the account is open. Making a sign opens an account, and we keep asking you to confirm the address rather than deleting what you made because you have not.
- A saved lease, until two years after its term ends, or until the landlord deletes it, whichever comes first. Both happen without anybody at this end deciding anything.
- Measurement, for whatever retention is set on our Google Analytics and PostHog accounts. Ask us and we will tell you what it is at the time you ask.
Your rights
Under the GDPR you can ask us to do any of the following.
- Give you a copy of what we hold about you.
- Correct something that is wrong.
- Delete it.
- Stop using it, or limit what we do with it.
- Hand it over in a machine-readable file, to you or to somebody else.
- Stop relying on legitimate interests, where that is the basis we named above.
- Take back your consent to measurement, which you can also do from the box above without writing to anyone.
Write to [email protected]. We answer within one month. Please do not send more than the request needs; where an answer would otherwise go to the wrong person, we may ask for something that shows the request is yours.
If you think we have got this wrong you can complain to the Information and Data Protection Commissioner in Malta, at idpc.org.mt. You can do that whether or not you have raised it with us first.
Taking your name off a report
A reporter can ask us to take their name, phone number and email address off a report. We do that, and we keep the report itself, its category and its timestamps.
We keep that part because the compliance log is the operator's evidence that a complaint came in and was answered, and an inspection or a renewal asks for exactly that. Deleting the record would take something away from a person who is not you. Taking your name out of it does not.
Children
This is a product for licensed short-let operators. It is not meant for children and we do not knowingly collect anything from one. If you think a child has given us something, write to [email protected] and we will delete it.
Changes to this policy
The date at the top of this page is the last time it changed. Where a change matters, meaning we begin collecting something new or sending it somewhere new, we email operators and the cookie question is asked again, because consent given to one list of recipients is not consent to a longer one.
Contact
Write to [email protected] about anything on this page, including a request under your rights. It is read by the people who run thetenant.app.