Privacy policy

1. Data controller

The controller of the personal data collected via the MORYA platform (websites, applications and Chrome extension) is:

Paul Fournier
Email: [email protected]

Exception: for the guest data that hosts manage in MORYA Stay, the data controller is the host, and MORYA acts as a processor. See the MORYA Stay guests annex.

2. Data collected

2.1 Authentication data

When you create your account, we collect your email address and a password (stored in hashed form). JWT authentication tokens are generated to maintain your session. A single sign-on (SSO) system allows you to access all the MORYA modules with a single account.

2.2 User preferences

Your calculation preferences (tax regime, financing parameters, display options) are stored in order to personalise your analyses. For the Chrome extension, this data is also stored in chrome.storage.sync. This data contains no personally identifiable information.

2.3 Property data

Depending on the modules used, we collect and process various property data:

• Invest: public property listing data (price, floor area, DPE, address, photos), DVF data (Demandes de Valeurs Foncières, land value requests), rental yield analyses.
• Listings imported from a link (Invest): when you import a listing from its link, we read the public page of that listing to extract its features (price, floor area, rooms, DPE, address, photos). The page may be loaded through a technical intermediary that only receives the listing's public address; if the page cannot be read directly, its text may be analysed by our AI provider. The technical copy of the page is deleted after 7 days; the features kept and the estimates calculated by our models remain in your favourites until you delete them. These listings stay private: they never join MORYA's listings.
• Home: photos of rooms uploaded for AI home staging, style preferences, generated furnishing recommendations.
• Pilot: property portfolio data (properties, tenants, tenancy agreements, rent receipts, documents, due dates, financial and accounting data).
• Radar: off-market prospecting data, predictive signals, generated client files.
• Stay: accommodations, calendars and bookings, and the guest data that the host manages there on their own behalf (see the MORYA Stay guests annex). Guests' payments are collected by the host on the host's own Stripe account.

2.4 Error logs

When an error occurs on our servers, its type, its message, the file involved and the page address are sent to our error-tracking tool (Sentry, hosted in Germany) so that we can fix it. Your identity, your cookies and the content of your requests are removed before sending.

2.5 Temporary caches

City, DVF and geographical data are cached temporarily and automatically cleared when the session ends.

3. Purposes of processing

• Rental yield analysis: calculation of yields, cash flows, taxation and wealth accumulation for properties.
• Home staging by artificial intelligence: generation of furnished images from photos of empty rooms, with furniture purchase recommendations.
• Property portfolio management: tracking of properties, tenants, tenancy agreements, accounting and legal documents.
• Professional property prospecting: identification of off-market opportunities from cross-referenced public data.
• Aggregation of market data: building a database of prices and transactions in order to provide comparative analyses.
• Service improvement: error analysis and, if you accept it, audience measurement, to improve the platform.

4. Legal basis

• Consent (Article 6.1.a of the GDPR): only for audience measurement (PostHog) and the measurement of our advertising campaigns (Google Ads), collected through the banner shown on your first visit, separately for visit statistics, session replay and advertising. You can withdraw it at any time, as easily as you gave it; withdrawal does not affect what was measured before.
• Performance of a contract (Article 6.1.b of the GDPR): creating and managing your account, and providing the services you have subscribed to.
• Legal obligation (Article 6.1.c of the GDPR): invoicing and the retention of accounting records.
• Legitimate interest (Article 6.1.f of the GDPR): the security of the platform, the prevention of fraud and abuse, and the tracking of technical errors.

5. Recipients of your data

We do not sell your data. It is transmitted only to the providers strictly necessary for the operation of the service, listed below; each acts as a processor, on our instructions and solely for the stated purpose. The only exception, and only if you accept the “Advertising” category: Google, to measure our Google Ads campaigns, which receives this data as a separate controller.

5.1 Transfers outside the European Union

MORYA's artificial intelligence features rely on specialised providers established in the United States. The content you submit to them is transmitted there for the duration of the processing, and the result is then returned to you.

Our main provider is OpenAI (United States), in particular for generating MORYA Home renderings from your photos.

These transfers are based on the European Commission's standard contractual clauses, supplemented where applicable by the provider's participation in the EU-US Data Privacy Framework. We contractually require that the content transmitted is not used to train their models.

All other processing — your account, your project data, your payments — remains within the European Union. If you do not wish any transfer outside the Union to take place, do not use the artificial intelligence features: the rest of the platform works without them.

6. Retention period

Only one free trial is granted per person and per module, and a given payment card can open only one per module: if it has already been used for a MORYA trial, the subscription starts immediately, with no trial period. To prevent it from being obtained more than once, after your account is deleted we keep an irreversible fingerprint (from which the data cannot be recovered in clear) of your email address and, where applicable, of the payment card used, linked to the module concerned, for no more than three years. Legal basis: our legitimate interest in preventing fraud.

7. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request the deletion of your data.
• Right to data portability: receive your data in a structured format.
• Right to object: object to the processing of your data.
• Right to restriction: request the restriction of processing.
• Withdrawal of consent: withdraw your consent to audience measurement at any time, without affecting what was done before.

To exercise these rights, contact us at [email protected]. We undertake to respond within 30 days.

8. Data security

We implement the following technical measures to protect your data:

• Encryption in transit: all communications take place over HTTPS (TLS 1.2+).
• Secure authentication: passwords are hashed (bcrypt) and authentication uses time-limited JWT tokens.
• Single sign-on (SSO): a centralised system allows you to move between modules without re-entering your credentials, while maintaining session security.
• No password stored in plain text: neither on the server, nor in the extension, nor in the applications.

10. Complaints

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French supervisory authority for data protection.

CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Tel: 01 53 73 22 22 — www.cnil.fr

11. Changes to this policy

We reserve the right to amend this privacy policy at any time. In the event of a substantial amendment, we will inform you by email or by an in-app notification. The date of the last update is shown at the top of this page.

Annex — Company contact details displayed in MORYA Radar

This annex informs people who are not MORYA users but whose professional contact details may appear in MORYA Radar (Article 14 GDPR). The data controller is the one stated in Article 1.

• Data: email addresses and telephone numbers published on company websites, linked to the SIREN number printed on those websites. Some addresses identify a person (firstname.lastname@…): these are personal data.
• Source: publicly accessible web pages, read by our crawler or in the public Common Crawl web archives. Each value is kept together with the address of the page where it appears, a short excerpt and the date it was read.
• Purpose: professional networking — enabling Radar subscribers to know how to reach a company in the context of real estate prospecting.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR), limited to contact details that the company itself has made public on its website.
• Recipients: MORYA Radar subscribers, who view them in the application together with their source. MORYA sends no message to these addresses and generates none.
• Retention: records (value, source page, excerpt, date) are automatically deleted 36 months after they were read.

Objection: you can object to the display of your email address or telephone number, without creating an account, using the objection form. Requests are handled within one month at most.

For any other request (access, rectification, erasure), write to [email protected].