Privacy notice

Controller and contact

The controller is Federico Tessarin, a natural person established in Luxembourg, operating the Verax public beta service at https://luxten.devprg.com. Privacy requests: privacy@verax.lu. General support: support@verax.lu.

Verax is currently offered as a free public beta. No landlord subscription fees are charged. If paid plans are introduced later, this notice will be updated before any charge is taken.

Data, purposes and lawful bases

• Account and authentication data (name, email, password hash, role): provide and secure the service; Article 6(1)(b) contract and Article 6(1)(f) legitimate interests.
• Reviews, scores, tenancy attestations and landlord replies: publish a fair rental trust record and prevent abuse; Article 6(1)(b) contract and Article 6(1)(f) legitimate interests in trustworthy consumer information and freedom of expression.
• Profile claims, landlord registration details and identity documents (government ID / passport for private landlords, or company registration extracts such as an RCS extrait for companies): verify entitlement to manage a profile, prevent fraud and run landlord tools; Article 6(1)(b) contract and Article 6(1)(f) legitimate interests. No card or subscription payment data is collected during the public beta. Identity documents are stored securely for claim review and are not published.
• Optional third-party document OCR (when Idswyft or a similar provider is configured): assist automated matching of names and registration numbers on uploaded IDs; Article 6(1)(f) legitimate interests in fraud prevention. If enabled, a processor agreement applies and the Privacy notice lists the provider.
• Content reports, moderation decisions and audit logs: comply with the Digital Services Act, defend legal claims and protect users; Article 6(1)(c) legal obligation and Article 6(1)(f) legitimate interests.
• Non-essential analytics and preference storage: Article 6(1)(a) consent. Verax does not load these technologies before consent.
• Support correspondence: answer requests and resolve disputes; Article 6(1)(b), 6(1)(c) or 6(1)(f), depending on the request.

Review identity and erasure

Published reviews are public user opinions, not statements by Verax. A verified-stay badge means Verax recorded evidence or confirmation of a tenancy; it does not guarantee every factual allegation.

When an account is erased, Verax deletes the account and unpublished reviews, removes direct links from related records and changes published review authors to “Deleted user”. The review text remains where necessary for the legitimate interests of other tenants, landlords’ rights of reply, platform integrity and the public trust record. Verax will remove or further redact content where those interests do not outweigh the person’s rights.

Recipients and transfers

Data is available to Federico Tessarin and service providers that host, secure, communicate or support the service (including the Contabo VPS hosting the application at luxten.devprg.com). Public reviews, landlord replies and claimed-profile information are visible to anyone.

Processor arrangements are maintained for hosting and related infrastructure. If personal data is transferred outside the EEA, Verax relies on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, with supplementary measures where needed.

Retention

• Active account data: for the account lifetime; deletion is processed without undue delay after a valid request.
• Published reviews and replies: while relevant to the rental trust record, with periodic review; authorship is anonymised on account erasure.
• Unpublished reviews: deleted on account erasure and otherwise after 24 months.
• Consent evidence: current choice plus prior evidence for up to 3 years after replacement or withdrawal.
• Content reports, statements of reasons and moderation audit logs: 5 years, unless a dispute requires longer.
• If paid plans are introduced later, payment and invoice records will be retained up to 10 years where Luxembourg accounting or tax law requires it.
• Security logs and backups: normally 12 months and 35 days respectively, subject to incident holds.

Your rights

You may request access, a portable copy, rectification, erasure, restriction, and object to processing based on legitimate interests. You may withdraw cookie consent at any time without affecting earlier lawful processing. Use Privacy & data in your account or email privacy@verax.lu. Verax may need proportionate identity verification and normally responds within one month.

You may complain to the Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg, or another competent supervisory authority. Verax does not use solely automated decisions producing legal or similarly significant effects.

Security, children and changes

Verax uses password hashing, HTTP-only session cookies, access controls, moderation logs and data minimisation. No online service is risk-free. Suspected personal-data breaches should be reported to privacy@verax.lu.

The service is not directed to children under 16. Material changes will be announced in-product and the effective date updated.