Findrent

Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains how Tracewell, operating under the brand Findrent ("Findrent", "we", "us"), collects and uses personal data when you use findrent.nl and the services offered through it (the "Service"). Findrent is a rental-listing alert service: we monitor major housing platforms and notify you when a listing matches your search.

We take your privacy seriously and process personal data in line with the EU General Data Protection Regulation (GDPR), which applies throughout the European Union, together with the Dutch national data-protection law that supplements it – the Netherlands being the country in which we are established.

1. Who is responsible for your data

The data controller for the personal data described in this policy is Tracewell, Cambridgelaan 919, 3584 DW Utrecht, the Netherlands. Our full company details are in our Legal Notice.

For any privacy question or to exercise your rights, contact us at privacy@findrent.nl. Section 8 explains where you can complain if you are not satisfied with our answer.

2. What data we collect

  • Account data – the email address you register with and your login credentials.
  • Search data – the search criteria you set (city, budget, size, property type and similar preferences) and the alerts we send you.
  • Payment data – if you take a paid plan, the billing information needed to process your subscription. Payments are handled by Stripe, and card details are entered on Stripe's own hosted checkout pages, never on ours. We never see or store your card number, bank account details or any direct-debit mandate. What we store is Stripe's own reference numbers for you and your subscription, the plan's status, and the date your access runs until.
  • Usage data – statistics about how the Service is used, such as which pages are viewed and how long visits last. We collect this with analytics software we run on our own server, not a third-party analytics service, and it works without cookies: nothing is stored on or read from your device. Visits are grouped together using a value our own server works out from technical information your browser sends anyway (such as your IP address and browser type), combined with a secret that we change at the start of every month. We do not store your IP address itself. Because that secret changes each month, the value changes with it, so the same browser cannot be recognised from one month to the next. Within a single month, and on a connection that does not change, visits from the same browser are grouped under the same value, which is what lets us tell a returning visit from a new one. If you are signed in, we attach a pseudonymous account identifier – a random internal reference, never your email address – to your analytics sessions, so that we can see how registered users use the Service and where they get stuck. Because visits from the same browser are grouped for the whole month, this also covers visits you made from that browser earlier in the same month, before you signed in. The identifier is stored on our own server alongside the analytics data, and our analytics saves nothing about it on, and reads nothing about it from, your device. We do not use any of this to show you advertising or for profiling, and we do not use session recording or heat mapping. The one marketing use we make of it is described under "How you found us" below.
  • How you found us – when you create an account, we record how you arrived at findrent.nl before signing up: the campaign tags in the link you clicked, if it had any (for example the name of an advertising campaign, or the search term an ad was shown for), the name of the website that referred you (the site only, not the page), the page on findrent.nl where you landed, and when that visit was. If you clicked a tagged link in the three days before you signed up, we record the most recent one; otherwise we record the visit on which you signed up. We take this from the self-hosted analytics described above, which uses no cookies, and we store it with your account. So that we find the right visit even when you open your sign-in link in a different browser or app, your sign-in request carries a random one-off code that contains nothing about you; we use it only to match your new account to that visit, and we remove it from your account once that matching has run – normally within a few hours, and later only if our analytics server is temporarily unavailable. We do not store with your account the click identifier that advertising platforms add to their links, and we do not share any of this with advertising platforms.
  • Approximate sign-up location – when you create an account we derive an approximate location (city and country) from your IP address, for operational and anti-abuse monitoring. This lookup runs locally on our own server using an offline database: your IP address is not sent to any third party, and neither your IP address nor the derived location is stored. The approximate location appears once in an internal notification and is then discarded. Because it is derived from an IP address it is only ever approximate – it often reflects your internet provider's location rather than yours.
  • Communications – messages you send us and our replies.
  • Email preferences – whether you have chosen to receive optional product-update emails, and the date you made that choice (or withdrew it). We keep this so we can prove we only email people who asked us to, and that we stopped when asked.

3. Why we use your data and our legal basis

  • To provide the Service – create your account, run your searches and send you alerts (legal basis: performance of our contract with you).
  • To process payments and manage your subscription (legal basis: performance of our contract).
  • To keep the Service secure and prevent abuse (legal basis: our legitimate interest). This includes the approximate sign-up location described above, which we chose to derive on our own server and keep unstored precisely so that this interest does not come at the cost of your privacy.
  • To understand how the Service is used and improve it, using the cookieless, self-hosted analytics described above (legal basis: our legitimate interest in running and improving our own service). We chose a method that stores nothing on your device and, apart from the pseudonymous account identifier and the one-off sign-in code described above and, in some page addresses (for example after you save a search or turn on an alert), the reference number of one of your saved searches, does not identify visitors at all, precisely so that this interest does not come at the cost of your privacy.
  • To understand which of our marketing works, using the "how you found us" information described above (legal basis: our legitimate interest in evaluating our own marketing, Article 6(1)(f) GDPR). We use it only for that: not to show you advertising and not to build a profile of you, and we do not share it with advertising platforms.
  • To respond to your messages and provide support (legal basis: our legitimate interest / performance of our contract).
  • To send service-related emails – the alerts you asked for, and messages about your account or plan (legal basis: performance of our contract).
  • To send optional product-update emails about new features and improvements. These are sent only if you tick the box asking for them (legal basis: your consent). Ticking it is never required to use the Service, and you can withdraw your consent at any time – every such email carries a one-click unsubscribe link that needs no login, and you can also change the setting in your account. Withdrawing consent does not affect the alerts for your saved searches, which are separate.

4. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run the Service, and only to the extent they need it to perform their role on our behalf:

  • Stripe – our payment provider. If you take a paid plan, Stripe processes your payment and holds your payment details; we do not. Stripe also acts as a controller in its own right for parts of that processing (fraud prevention and its own legal obligations), and its handling of your data is described in Stripe's own privacy policy.
  • Hosting and infrastructure providers – who run the servers the Service operates on.
  • Email-delivery providers – who deliver your alerts and account emails.

We may also disclose data where we are legally required to do so.

5. International transfers

Our servers are in the European Union, and most of the providers above process your data within the European Economic Area (EEA), where no transfer mechanism is required.

Stripe. Our contracting entity for payments is Stripe Payments Europe, Limited, established in Ireland, so that processing takes place inside the EEA and is not an international transfer. Where Stripe involves Stripe, Inc. in the United States, the transfer is covered by the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework and, in addition, by the European Commission's standard contractual clauses.

For any other provider that processes data outside the EEA, we take steps to ensure an adequate level of protection, such as relying on a European Commission adequacy decision or on standard contractual clauses.

6. How long we keep your data

We keep your personal data for as long as you have an account and as long as needed to provide the Service. When you close your account we delete or anonymise your data within a reasonable period, unless we are required to keep certain information longer (for example for tax or legal purposes).

Three specifics. In our analytics statistics, the only references to you they can contain are the pseudonymous account identifier and the one-off sign-in code described in section 2 and, in some page addresses (for example after you save a search or turn on an alert), the reference number of one of your saved searches. These are random internal references and nothing more. The sign-in code stops pointing to you once we remove it from your account, normally within a few hours of sign-up. When you close your account, the records these references pointed to – your account and your saved searches – are deleted, so what is left in the statistics can no longer be traced back to you and there is nothing further in them to delete. The how-you-found-us information is part of your account: we keep it for as long as you have an account and delete it together with your account when you close it. Like the rest of your account data, you can ask to see it or have it deleted at any time (section 8). Your email-preference record (whether you asked for product-update emails, and when you asked or withdrew) is kept while you have an account, because it is the evidence that we only emailed you with your permission.

7. How we protect your data

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. No online service can be completely secure, but we work to keep your information safe.

8. Your rights

Under the GDPR you have the right to access, correct, delete or restrict the processing of your personal data, to object to certain processing, to data portability, and to withdraw any consent you have given. To exercise any of these rights, contact privacy@findrent.nl.

You also have the right to lodge a complaint with a data-protection supervisory authority, and you may choose which one. Under Article 77 of the GDPR you can complain to the authority in the EU country where you live, where you work, or where the problem happened. If you live in the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Because we are established in the Netherlands, our lead supervisory authority is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You are welcome to complain to them instead, but you do not have to: complaining to your own country's authority is always open to you, and they will deal with your complaint or pass it on.

9. Cookies

We use only strictly necessary cookies: to keep you logged in, to protect the Service, and to remember something you have just asked for or chosen – for example, if you ask for an email alert before signing in, a cookie remembers that request for up to 30 minutes so the alert can be set up once you have signed in. Our Cookie Policy lists each of these cookies and how long it lasts. Our analytics is cookieless and stores nothing on your device, which is why we do not show a cookie banner. We describe all of this in our Cookie Policy.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "last updated" date above.

12. Contact

Questions about this policy or your data: privacy@findrent.nl.