Privacy Policy

1. Who processes your data

Rezido is a condominium management platform built and operated by ARIFES LTD., UIC 208789432, 33 Promishlena str., Ovcha Kupel Distr., Entr. B, Fl. 5, Apt. 23, Sofia 1632, Bulgaria. This policy covers rezido.app, the manager and owner web apps, and the Rezido mobile app for Android (app.rezido.mobile) and iOS.

We act as data controller for your Rezido account data (name, email, phone, role, settings), subscription billing and security records; and as data processor for the building data entered by the building manager (owners, residents, obligations, payments, minutes) — there the owners' association or its manager is the controller and we process data only on their instructions.

2. What we collect and why

• Account: name, email, optional phone, role, language and notification preferences. Passwords are handled entirely by Firebase Authentication — Rezido never stores or sees them.
• Property: building/entrance, unit, floor, area and ideal parts — required to allocate costs and to compute General Assembly quorum and voting weight.
• Statutory register (Bulgarian Condominium Act, ЗУЕС): household members, temporary residents with dates, and pets (type, count, passport number).
• Financial: charges, contributions, debts, payments, invoices and cash records. Card and bank payments are processed by ePay.bg; card data never passes through or is stored by Rezido.
• Content you create: maintenance requests and photos, uploaded documents, messages and announcements, General Assembly attendance and votes.
• Technical: push notification token (FCM), session tokens, IP address and sign-in timestamps, device type and OS version for diagnostics.

We use no advertising identifiers, we do not track you across other apps or websites, and we do not sell personal data.

3. Legal basis

Performance of a contract (account and service data); legal obligation (the ЗУЕС registers and Bulgarian accounting/tax records); legitimate interest (platform security and abuse prevention); and consent (mobile push notifications, revocable at any time).

4. Retention

Account data is kept while the account is active; 90 days after a building subscription ends. Deletion requests are completed within 30 days. Accounting records are retained for 5 years as required by Bulgarian tax law, with personal identifiers anonymised. Sign-in and security records are kept up to 90 days.

5. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability (JSON export) and object to processing based on legitimate interest. Write to support@rezido.app; we respond within one month. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), cpdp.bg.

6. Account and data deletion

Accounts are created by the building manager — the app has no self-registration. To delete your account, email support@rezido.app from your sign-in address with the subject "Account deletion". Access is revoked immediately and personal identifiers are anonymised at once; related records are fully deleted within 30 days. Accounting records are retained for 5 years as required by law, with personal data anonymised.

7. Sub-processors

Google (Firebase Authentication and Cloud Messaging) for sign-in and push; Amazon Web Services for hosting, database and file storage, in the EU (eu-central-1, Frankfurt); Resend for transactional email, which sends from Ireland but stores delivery records in the United States (see section 8); ePay.bg for payments, in Bulgaria. Each is bound by a data processing agreement. We disclose data to public authorities only where legally required.

8. Security and data location

All traffic is encrypted with HTTPS/TLS; files and the database are encrypted at rest. Access is role-based and scoped per building — cross-building access is not possible. Your account, building data, documents and accounting records are stored in the European Union on AWS in eu-central-1 (Frankfurt, Germany).

Email notifications are the exception. We send them through Resend from servers in Ireland (EU), but Resend is a US company and keeps its delivery records there. The recipient's email address, the subject line (which may contain their name) and the message body — a registration invitation, an announcement, an emailed invoice — are therefore held in the United States for up to 30 days, after which Resend deletes them automatically.

That transfer relies on the European Commission's standard contractual clauses, included in our data processing agreement with Resend. The same basis — or an adequacy decision — applies to any other provider processing data outside the EU.

9. Children

The service is intended for adults — owners, residents and building managers. We do not knowingly collect data from anyone under 16. Household member names, including children, are entered by the owner solely to satisfy ЗУЕС requirements.

10. Contact

ARIFES LTD., UIC 208789432, 33 Promishlena str., Ovcha Kupel Distr., Entr. B, Fl. 5, Apt. 23, Sofia 1632, Bulgaria — support@rezido.app