Legal
Privacy Policy
This policy explains which personal data is processed when you visit this website, use the interactive demo or the customer application, on what legal basis, and by whom. It is deliberately specific rather than generic.
1. Controller
The controller under the GDPR for operating the public website sakhly.com and the demo
demo.sakhly.com is:
2. Two roles — shown separately
SAKHLY acts in two different data-protection roles. The distinction matters because it determines whom data subjects should contact to exercise their rights.
Website & demo → mezzoNET SL is the controller
For data arising when you visit this website, contact us, or use the synthetic demo (e.g. technical logs, the demo session cookie), mezzoNET SL is the controller under Art. 4(7) GDPR. This policy applies directly.
Customer application → mezzoNET SL is a processor
For the data stored in the customer application app.sakhly.com (properties, units,
tenants, tenancies, payments, documents), the respective customer (the managing
agent or owner) is the controller. mezzoNET SL processes this data solely on the customer's
documented instructions as a processor under a data-processing agreement (Art. 28 GDPR). Data
subjects (e.g. tenants) should primarily contact that customer; we assist the customer in doing
so.
3. Visiting this website
The public website is static. It sets no cookies, embeds no third-party analytics, tracking or advertising, and loads no external fonts; everything is rendered with system fonts and local files.
When the site is accessed, access logs are created at the hosting and reverse-proxy layer for technical reasons (date/time, requested path, HTTP status, amount of data transferred, coarse technical origin). The purpose is secure, stable operation and attack defence; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). These logs are not combined with other data and are not stored indefinitely: container logs rotate by size (max. ~50 MB in five files per service) and are overwritten automatically.
4. Contacting us
If you e-mail us ([email protected]), we process your details (name, e-mail address, content of the request) solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) or (f) (legitimate interest in replying). We delete prospect enquiries once they are resolved, unless statutory retention obligations apply.
5. Registration, sign-in and sessions (customer application)
The customer application requires a user account. We process an e-mail address, name and a password that is stored only as a cryptographic hash — never in clear text. The sign-in is maintained by a signed, host-bound session cookie; it is strictly necessary and is not used for analytics or advertising. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Security-relevant events (e.g. sign-ins) are logged, but without document contents, passwords or unnecessary personal data.
6. Customer and prospect data in the customer application
The customer application stores the data required for property management: properties and units, tenants and tenancies, payments and related documents. We process this data as a processor on behalf of the respective customer (see section 2). Strict tenant separation applies: each record belongs to exactly one tenant, and an account only ever sees its own data.
7. Document import and storage
Uploaded documents (e.g. tenancy agreements, service-charge statements) are stored on our hoster's EU infrastructure. Classification (document type, property, tenancy) is first performed by a local, on-device recognition step without transmission to third parties. Raw files containing personal data are not kept longer than necessary after a controlled import. The principle of data minimisation applies.
8. AI-assisted document interpretation (Anthropic) — currently disabled
SAKHLY can additionally read documents with AI support and suggest assignments (always with a source citation; nothing is booked automatically). For real customer data this feature is disabled by default and is only enabled after the respective customer's explicit data-protection approval (an addendum to the data-processing agreement).
Only after that approval is the text of the relevant document transmitted to our sub-processor Anthropic (USA); this may contain personal data of tenants and other parties. Special categories under Art. 9 GDPR are not intentionally processed. Safeguards: no training on customer content, transmission only over TLS, encryption at rest, short or switchable retention of the API data (around 30 days, "Zero Data Retention" on request), deletion at contract end. The AI makes no automated individual decision with legal effect (Art. 22 GDPR); human approval always remains required.
9. Demo with synthetic data
The interactive demo at demo.sakhly.com contains exclusively invented,
synthetic sample data — no real people. It runs in its own database, fully separate from
customer data. In the demo, e-mail sending is disabled, no AI calls are made (the AI
property file is shown with prepared synthetic sample documents), and the demo is read-only. A
strictly necessary session cookie is set; no login or registration is required.
10. Processors engaged (sub-processors)
| Provider | Purpose | Location | Basis & safeguards |
|---|---|---|---|
| Hetzner Online GmbH | Server, database and document hosting | Germany / EU | No third country; processing under Art. 28 GDPR |
| Cloudflare, Inc. | Reverse proxy, CDN, TLS termination, attack (DDoS) protection | USA (global edge network) | EU Standard Contractual Clauses (SCC) + Cloudflare DPA; transit only, no permanent content storage |
| Anthropic, PBC | AI-assisted document interpretation — only after explicit approval | USA | SCC; no training on customer content; TLS; encryption at rest; ~30 days retention (ZDR on request) |
SAKHLY uses a dedicated Anthropic account with a spend limit, separate from other projects; e-mail sending is disabled project-wide.
11. International transfers
Hosting (Hetzner) takes place in Germany/the EU and is not a third-country transfer. For the US providers Cloudflare and — only when AI is enabled — Anthropic, data is transferred to the USA on the basis of the EU Standard Contractual Clauses (Modules 2 or 3, plus a UK addendum/Swiss annex where applicable). In addition, encryption in transit and at rest, strict purpose limitation, data minimisation (AI only on explicitly uploaded documents, not on the entire dataset), no AI training on customer content, and short or switchable retention apply. A transfer risk assessment exists and is updated if the providers' situation changes.
12. Retention and deletion
- Account and contract data: for the duration of the contractual relationship and thereafter within statutory retention periods (commercial and tax law).
- Documents and application data: until deleted by the responsible customer or until contract end. Deleted records are first moved to a recycle bin (recovery possible) and permanently removed by a prepared, audited purge run (recycle bin 30 days; prospect enquiries 180 days, appointments 365 days, sensitive documents 90 days). This automatic run is activated together with the data-protection approval; until then an authorised person performs the final deletion.
- Technical access logs: short-term (see section 3).
- Anthropic API data (only when AI is enabled): ~30 days, "Zero Data Retention" on request.
13. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw a given consent at any time with effect for the future (Art. 7(3)). If your request concerns data in the customer application, please contact the respective customer as controller first (see section 2).
You also have the right to lodge a complaint with a supervisory authority. The controller's lead authority is the Spanish data-protection authority Agencia Española de Protección de Datos (AEPD), Madrid (aepd.es). You may also contact the authority in your place of residence.
14. Data security
We use TLS encryption throughout for transmission, encryption at rest at the hoster, strict tenant separation and restrictive access controls. Our measures are continuously adapted to the state of the art.
15. Changes to this policy
We update this policy when the processing or the legal situation changes — for example when the AI feature is enabled for real data. The version published here applies in each case.
Last updated: November 2026
← Back to home