Privacy Policy
This policy explains which personal data Activo (activo.world) processes, why and on what basis, who receives it, how long it is kept and what rights you have, in line with the Law of Georgia on Personal Data Protection. It also covers the people whose data you enter into Activo: tenants, guests and drivers.
Who processes the data
The controller of your account data is Activo (activo.world). Contact: contact@activo.world.
When you enter another person's data into Activo — a tenant's, guest's or driver's name, phone number, contract or a vehicle's location — you are the controller of that data. Activo processes it on your instructions, as your processor, and only so that the service works for you — apart from the anonymous district averages described below.
What data we process
- Account: email and whether it is confirmed, password (stored only as a hash — the password itself is never kept), name (if you give one), language and workspace type; for a team invitation, the invitee's email and role.
- Team and activity log: who did what in the workspace and when (for example “recorded a payment”, with the asset's or tenant's name). In a company workspace its data and files are seen by the owner and every team member; the log by the owner and the team.
- Uploaded documents and photos: whatever you upload — for example a contract, a tenant's or driver's ID copy, a technical passport, receipts.
- Invoices: the tenant's name and phone, amount, period, your “from” details and payment instructions; an invoice may have a link you share with the tenant.
- Notifications: the devices you turn phone notifications on for (push address and browser type); email-confirmation links. If you connect your own WhatsApp Business number — its ID, number and Meta access token (encrypted).
- Security: a session record (one-way hashed) and sign-in attempts (email and IP address) to limit repeated attempts.
- Your portfolio: assets, addresses, values, contracts, payments, income, bookings, digital holdings and notes — whatever you enter.
- Other people's data you enter: a tenant's, guest's or driver's name and phone number, contract terms, payments, the text of messages sent to them, and your note of whether they agreed to WhatsApp messages and whether they asked to stop them. The payment instructions you write (for example an account number) are added to those messages.
- Vehicle location, if you connect a GPS tracker: the last reported position, speed and time (each new report replaces the previous one) and the positions where the vehicle approached, crossed or came back across a red line you set. We keep no route history.
- Calendars: Airbnb and Booking.com iCal links and the booking dates read from them (and the guest's name if the feed includes it); also each unit's calendar link that you give to the channels (the unit's name and its busy nights — no guest data).
- Billing: plan, amount, order number and status. You enter card details on Flitt's page — they never reach us.
- Technical: essential cookies only — session (sign-in), locale (language), theme (colour mode), splash_seen (the intro shown once); browser localStorage for the tour's progress; the host's server logs (IP address, time, page). We use no advertising or analytics tracking.
Why, and on what legal basis
- Providing the service — account, portfolio, calendar, reminders and alerts: performance of our contract with you (the Terms of Service).
- WhatsApp messages to tenants and drivers, in your name and on your instructions: we act as your processor; the legal basis is yours to have — for example, your contract with the tenant or their consent. A message is sent only once you record the recipient's agreement on the contract.
- GPS red-line alerts: we act as your processor; the basis is your contract with the driver and informing them in advance.
- Security and abuse prevention (sign-in limits, logs): our legitimate interest.
- Billing and accounting: performance of the contract and a legal obligation (tax records).
- Emails (password reset, address confirmation, urgent alerts) and phone notifications: performance of the contract; you can turn alert emails and notifications off in Settings.
- The activity log — so the owner can see who in the team changed what: the security of the workspace, your and our legitimate interest.
- AI-written explanations of price suggestions, when enabled: the unit's name, district, city and prices are sent — never tenant or guest data; our legitimate interest.
- Anonymous market averages: from running contracts and stays we compute each district's average rent per m², nightly rate and occupancy. Only the district average is kept, and only when it rests on at least 5 records from at least 3 different accounts — no owner's, tenant's or guest's data shows in it or leaves us; our legitimate interest (a market comparison for every customer).
We send no marketing without consent, never sell data and make no automated decisions about you that have legal effect.
Who receives the data
We entrust data only to the providers the service needs to run, and only with what each needs for its part:
- Vercel — hosting: every request passes through it; also the private store that keeps the documents and photos you upload.
- Neon — database: all stored data.
- Meta Platforms (WhatsApp Business) — the recipient's phone number and the message text when a message is sent (through your own Meta account if you connect your own number).
- Flitt — card payments: it receives the card details itself.
- Resend — password-reset and urgent-alert emails: your email address and the alert text.
- Your browser's push service (Google, Apple, Mozilla) — the encrypted notification to your phone, if you turn it on.
- Sentry — error reports: the technical details of an error, without your name or email.
- Anthropic — the text of price-suggestion explanations (unit name, district, prices) and the messages you type into the support chat, so an answer can be written — when these features are enabled. The chat cannot see your account; please do not type personal details into it.
- OpenStreetMap — map tiles when you draw a red line: your IP address and the map area.
Market price sources (CoinGecko, Finnhub, Stooq, Gold API, the National Bank of Georgia) are asked only for an asset's symbol — never for personal data. From Airbnb and Booking.com we only read the calendar link you give, and you give them the link of a unit's busy nights. A shared invoice link opens without signing in — whoever has it sees that invoice (with the tenant's name and phone and your details) until you void it. We disclose data to public authorities only where the law requires it.
Data outside Georgia
Some of these providers process data outside Georgia (for example in the USA and the EU). Such transfers are made only with the safeguards the law requires — for example, a data processing agreement with the provider.
How long we keep data
- Account and portfolio data — while the account exists. When you delete the account yourself (Settings → Your data) it is erased at once together with everything in it — uploaded files too — including our record of your subscription payments (a copy may stay in the database backup for a few more days, until it is replaced); Flitt keeps its own record of card payments for the period tax law requires. On a written request we delete within 30 days.
- What you delete disappears from your view at once. A deleted contract can be restored for 30 days, and its payment history stays hidden with the account; you can ask us to erase it completely.
- GPS: the last position is replaced with every new report; red-line events are kept until you delete the red line, the vehicle or the account.
- Sign-in attempts and password-reset requests (kept for the rate limit) — deleted after a day, at the latest within two days.
- Sessions — 30 days or until you sign out; an expired session is deleted within a day. A password-reset link works once and for one hour, and is deleted within a day after that.
- The log of sent messages — with the account.
- Invoices — with the account; an issued invoice is not deleted, only voided (for accounting).
- The activity log — 1 year; a team member who deletes their account is no longer named in it.
- Notification devices — until you turn them off, sign out on that device, or the push service tells us it is gone. An email-confirmation link works once and for 3 days.
- Server logs — for the period set by the hosting provider.
Your rights
Under the law you have the right to:
- be informed about the processing of your data and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted or destroyed;
- have processing stopped or your data blocked;
- receive the data you provided in a structured, machine-readable form, where the law provides for it;
- withdraw consent where processing relies on consent;
- complain to the Personal Data Protection Service of Georgia (personaldata.ge) or to a court.
In Settings → Your data you can download a copy of everything in your workspace (a JSON file; the documents and photos themselves download from each asset's page) and delete the account yourself.
Send any other request to contact@activo.world from the email address you sign in with. We answer within the time the law sets — no later than 10 working days.
If you are a tenant, guest or driver
Your data was entered into Activo by the owner of the property or vehicle, who is its controller. To exercise your rights, contact the owner. You can also write to us at contact@activo.world — we will pass the request to the owner and help them fulfil it. If you no longer want to receive WhatsApp messages, tell the owner: once they mark it, no further messages are prepared for you. Every message says this too.
How data is protected
Passwords are stored only as hashes and sessions as one-way hashes; connections are encrypted (HTTPS); every account is kept apart from the others and every request touches only its own workspace's data; the exceptions are the links you share yourself (an invoice, a unit's calendar). Uploaded files are kept in a private store and served only to the workspace's members. A GPS tracker connects with its own secret key; your own WhatsApp number's token is stored encrypted. We report a security incident to the Personal Data Protection Service, and to you where needed, as the law requires.
Minors
Activo is not meant for people under 18, and we do not knowingly collect their data.
Changes
We publish any material change on this page before it takes effect. The policy exists in Georgian and English; if they differ, the Georgian version prevails.