Data controller
IACrea, 60 rue François Ier, 75008 Paris, France. Contact for any question about your data: contact@homicrea.com.
What data, and why
- Account — first name, email address, date you accepted the terms. If you create your account with a password, it is encrypted (never readable). If you sign up with Google, we use the email and name (first name, and last name where applicable) provided by Google. Legal basis: performance of the contract.
- News — if you tick the box provided at sign-up, we may send you emails about the product (new features, tips). Nothing is sent unless you tick this box. You can withdraw your consent at any time by writing to contact@homicrea.com. Legal basis: consent.
- Projects and plans — the plans you draw or copy from a shared link, and the layouts you create in them. When a plan comes from an agent, we may keep the city, postcode, floor area and number of rooms as provided; never the exact address, the price or the listing number. Legal basis: performance of the contract.
- Viewing a shared link — a random session identifier, erased when the tab is closed, used only to avoid counting the same visit twice. No IP address, browser or identity is recorded. The agent who shared the link only receives an aggregated count. Legal basis: legitimate interest (minimal audience measurement).
- Audience measurement — pages viewed, source (search engine, referring site, campaign), device type, browser, approximate country and city, page load speed, and a few key steps (account creation, project creation, first actions in the editor). We use Umami, a tool we host ourselves: no cookie is set, the IP address is used for the calculation and is not stored, and shared links and project identifiers are masked before anything is recorded. These statistics are linked neither to your account nor to your plans, and are not shared with anyone. Legal basis: legitimate interest (audience measurement).
- Technical logs — when an error occurs, a technical report (page, error message, browser) may be sent to Sentry, without any plan content. Legal basis: legitimate interest (security and proper operation).
- Directory — we do not pass on any of your data (email, name, plan) to the listed businesses. You contact them yourself. Legal basis: performance of the contract.
- Business account (if you pay to be listed) — business identity, contact details, billing information, payment history. Payment is processed by Stripe: we do not store card numbers. Legal basis: performance of the contract and accounting obligations.
We use no advertising trackers and sell no data.
Cookies
Only strictly necessary cookies are set: your login session, and a cookie lasting a few minutes during a password reset. When paying for a directory subscription, Stripe may set cookies needed for the payment. These do not require consent. No analytics or advertising cookies.
Recipients and processors
- Supabase Inc. — database and authentication, European Union region (Ireland).
- Vercel Inc. — hosting and delivery of the website and of our audience measurement tool.
- Google LLC — if you choose to sign in with Google (authentication).
- Functional Software, Inc. (Sentry) — technical error monitoring.
- Resend, Inc. (resend.com) — confirmation and password reset emails and, if you have consented, news emails.
- Stripe, Inc. / Stripe Payments Europe, Ltd. — payment of directory subscriptions.
When a plan is shared with you by a real estate agent using IACrea, Homicrea acts on that agent’s instructions solely for viewing the link; from the moment you create your account and your copy, Homicrea is the controller of your data.
Transfers outside the European Union
Account, project and plan data is stored by Supabase in Ireland (European Union).
Vercel, Sentry, Resend, Stripe and, if you use Google sign-in, Google LLC, are based in the United States (Stripe also has a European entity). Using these providers may therefore involve transferring data outside the European Union (for example technical logs, your email address to send a message, payment data, or the traffic needed to display the website). These transfers rely on the European Commission’s standard contractual clauses and, where applicable, on the EU–US Data Privacy Framework to which the provider has signed up.
Retention periods
- Account data, projects and plans: for as long as the account exists, then erased when it is deleted.
- Billing data for directory subscriptions: kept for as long as accounting rules require (ten years for supporting documents).
- Shared link view events: for as long as the link exists, then erased with it.
- Technical logs (Sentry): 30 days.
- Audience measurement statistics: 25 months at most.
Your rights
You have the right to access, rectify, erase and restrict the processing of your data, to object to its processing, and to data portability.
- Export your data: from the “My account” page, “Download my data” button (a JSON file containing your profile, your projects and your plans).
- Delete your account: from the “My account” page. Deletion is immediate and permanent.
- Withdraw consent to news emails: write to contact@homicrea.com. Withdrawal does not affect emails already sent, nor how your account works.
- For any other request: contact@homicrea.com. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).