Home Space ("we", "us") provides a household and travel preparation application. This policy explains what personal data we collect, why we collect it, and how we protect it.
1. Data we collect
You may provide, directly or through the people and things you add to your household:
- Account data: name, email address, password (stored as a salted hash).
- Household data: family members, pets, cars, houses, and the documents, identifiers and dates attached to them (e.g. passport, driving licence, vehicle registration, insurance and vaccination records).
- Sensitive data: health facts and medical information you choose to record, and government identifiers such as passport, national ID, chip, GHIC or policy numbers.
- Trip data: itineraries, bookings, accommodation, routes, and travel documents.
- Files you upload: scans, photos, tickets and other documents attached to your household or trip records.
- Usage data: log data such as IP address, browser type, and pages visited.
2. How we use your data
We use your data to:
- Generate and maintain your household and trip-readiness checklists.
- Send reminder emails about upcoming deadlines and expirations.
- Provide document scanning, booking extraction and route-building features.
- Operate account authentication and connected integrations (e.g. Google Calendar) you choose to enable.
- Maintain the security, integrity and audit trail of the service.
3. Sensitive data and encryption
Health facts, government identifiers (passport, chip, GHIC and policy numbers) and your home address are encrypted at rest with AES-256-GCM before they are stored. We do not use this data for any purpose other than generating your checklists and displaying it back to you.
4. Third-party processors
We share data with the following processors, only as needed to provide the service:
- Supabase — database hosting and file storage.
- Anthropic (Claude) — rephrasing checklist text, extracting structured data from uploaded booking documents, and looking up regional travel information and document renewal details. Anthropic does not decide your checklist status.
- Resend — delivery of reminder and notification emails, and inbound booking-forward email processing.
- Google — sign-in and, if you connect it, Google Calendar synchronisation.
- Pexels — stock cover photos for trips (no personal data is sent to Pexels).
- Serper — web search used to look up renewal and expiry information you request.
- RDW (Dutch vehicle authority) — public vehicle data lookups for cars you register, where applicable.
- Upstash — rate-limiting infrastructure; does not store personal content.
- Vercel — application hosting and scheduled jobs.
5. Data retention
We retain your data for as long as your account is active. You may delete individual records, or request deletion of your account and all associated data, at any time (see Section 8).
6. Your rights
Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You may exercise these rights by contacting us using the details in Section 9.
7. Data security
We use industry-standard measures including encryption in transit (TLS), encryption at rest for sensitive fields, row-level database access controls, and rate limiting. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. Account deletion
You can request deletion of your account and all associated household, trip, and document data by contacting us. We will process the request within a reasonable time, subject to any legal retention obligations.
9. Contact
Questions about this policy, or requests to exercise your rights under section 6, can be sent to info@colorcity.nl. We respond to data subject requests within 30 days.
10. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.