Privacy policy

1. Who we are and what this policy covers

The FiBace service (fibace.com). The service is operated by a sole proprietor (ФОП), details available on request: support@fibace.com. Contact for any question about personal data: support@fibace.com.

FiBace is a dashboard for owners of rental property in Ukraine. Only owners use the service; tenants have no accounts and never log in to FiBace. This policy explains what data we process on the fibace.com website and in the fibace.com/cabinet dashboard. We follow the Law of Ukraine “On Personal Data Protection” and, where applicable, Regulation (EU) 2016/679 (GDPR).

• Your data as the account owner: the controller is the operator of FiBace.
• Tenant data you enter in the dashboard: you are the controller, and FiBace processes it on your behalf as a processor. See section 5.

2. What data we process

• Account data: first name, last name, email, phone number and profile photo (optional). The password is stored only as an irreversible hash.
• Dashboard data: properties (address, details, photos), leases and documents, payments, expenses, utility readings and bills, inventory, notes.
• Tenant data you enter: full name, date of birth, phone, email, messengers, emergency contact, passport details, tax ID (РНОКПП), registered address, lease terms, documents.
• Subscription payment data: plan, amount, currency, payment status and date, invoice number. You enter card details on the payment provider’s page — we never receive or store the card number. For automatic renewal the provider gives us a card token (not the card number); we store it encrypted and forget it when the subscription drops to Free.
• Technical data: IP address and browser (protection against password guessing, rate limiting, the log of sign-ins and file access), server logs.

3. Why we use it

• Providing the service: running your dashboard, storing your records and files.
• Sign-in and security: email confirmation, password reset, protection against break-ins and abuse.
• Taking out, renewing and accounting for paid subscriptions.
• Answering your support requests.
• Finding and fixing errors.
• Complying with the law.

We do not sell your data, do not share it for advertising or marketing, and do not use it to show ads.

4. Legal bases

• Performance of a contract: processing without which we cannot provide the service under the Terms of use.
• Legitimate interest: security of the service, fraud prevention, error monitoring, backups.
• Legal obligations: keeping payment records and answering lawful requests from authorities.

5. Tenant data

You enter tenant data into the dashboard. For this data:

• You are the controller of the personal data and decide what to enter and why.
• You must have a lawful basis for processing it (for example, a lease or the tenant’s consent) and inform the tenant about the processing, as the law requires.
• FiBace processes this data only to store it and show it to you in the dashboard. We do not contact tenants and do not use their data for our own purposes.
• You can correct or delete a tenant record in the dashboard at any time. How long copies are kept is in section 8.
• If a tenant contacts us about their data, we will forward the request to you as the controller and help you fulfil it.

6. Who we share data with

To run the service we use providers who process data on our behalf and only for the stated purpose.

• Vercel — hosting of the website, the dashboard and the API. The servers that handle requests run in Frankfurt (EU); the website’s static files (images, scripts, styles) are served by Vercel’s global delivery network. Data: everything that passes through the service, server logs.
• Vercel Blob — storage for the files you upload (photos, leases, bills). Files are kept there only in encrypted form (section 7).
• Neon — PostgreSQL database (Frankfurt, EU). Account, dashboard and tenant data; personal data in encrypted form.
• Upstash — Redis (Frankfurt, EU). Request and sign-in attempt counters, IP addresses, temporary service data.
• Resend — service emails (email confirmation, password reset, subscription payment emails). Email and name.
• Payment provider (LiqPay, WayForPay or monobank — whichever payment page opens) — subscription payments. Amount, description and invoice number; card details are processed only by the provider.
• Sentry — error monitoring. Technical data about an error: description, page, browser.
• GitHub — storage of daily database backups. Backups are encrypted before transfer, so GitHub cannot access their contents.
• Apple iCloud — an extra copy outside the service’s infrastructure: encrypted database backups and encrypted copies of uploaded files in the operator’s iCloud storage. Apple cannot access their contents.

The database and the servers that handle requests are in the EU (Frankfurt). Some providers, including Vercel, GitHub, Apple and Sentry, may also process data in the USA. We may disclose data to authorities when the law requires it.

7. How we protect data

• All connections to the service are encrypted (HTTPS/TLS). Passwords are stored only as a hash.
• Database encryption. Personal data — your name, email and phone; tenants’ names, contacts, passport details, tax IDs and addresses; property addresses, notes, IP addresses in logs, the card token — is stored encrypted with AES-256-GCM.
• File encryption. Files are encrypted with AES-256-GCM in your browser, before upload; the storage only ever holds the encrypted file. A file can be opened only from the dashboard, through a temporary link.
• The FiBace server holds the keys. Data keys are kept in the database in encrypted form, and the master key separately, in the hosting’s protected settings. This is encryption at rest, not end-to-end encryption: the FiBace server can decrypt your data — that is how the dashboard shows it to you. Encryption protects the data if someone obtains a copy of the database, the file storage or a backup without the keys.
• Who has access. Only you log in to your dashboard. Only the operator of FiBace has access to the servers, the database, the keys and the backups. We do not look at your records or files unless you ask us for help, it is needed to fix a fault, or the law requires it. The providers that store the database, the files and the backups receive personal data only in encrypted form.

8. How long we keep data

• Dashboard data is kept for as long as your account exists.
• What you delete in the dashboard stays in the Bin («Кошик») for 30 days, where it can be restored, and is then deleted from the database for good.
• Database backups are made every day when the data has changed, and are encrypted. Daily copies are kept for 90 days and monthly copies for 1 year; older ones are deleted automatically.
• Uploaded files have encrypted backup copies. Files deleted from the service are also removed from the backups within 90 days.

Backups are used only to recover from a failure or an accidental deletion, and for no other purpose.

Deleting your account. When you delete your account in your profile, the account and all its data — properties, tenant data, payments, expenses, documents, utility records — are deleted at once from the live database, and the files from the live storage. Their encrypted copies remain in the backups for the periods above. An account with a paid subscription that renews can be deleted once the subscription is cancelled. If you cannot log in, write to support@fibace.com and we will delete the data within 30 days. Subscription invoices are kept, no longer linked to the account, for as long as accounting and tax rules require.

9. Cookies and local storage

• Sign-in cookie (refresh_token): a secure httpOnly cookie that keeps you signed in for up to 7 days; sent only to the dashboard. The dashboard does not work without it.
• Device cookie (fibace_device): a secure httpOnly cookie for 365 days. It marks a browser you have signed in from before, so the protection against password guessing does not lock you out; sent only when you sign in or change your password.
• Browser local storage: theme, language, text size, the hide-amounts mode, the chosen currency, minimal session data (signed-in flag, name, email), temporary file links, marks of reminders you have sent.

The fibace.com website sets no cookies. We use no advertising or analytics cookies. You can clear cookies and local storage in your browser settings; you will then need to sign in again.

10. Your rights

Under Ukrainian law and the GDPR you have the right:

• Of access: to find out what data of yours we process.
• To rectification: to correct inaccurate data (most of it yourself, in your profile and dashboard).
• To erasure: to delete your account and data, as described in section 8.
• To portability and a copy of your data: on the Pro and Business plans, export (CSV, JSON, a ZIP archive with files) is available in your profile. On any plan, including the free Free plan, you can get a copy of your personal data in a machine-readable format free of charge: write to support@fibace.com from the address your account is registered to, and we will send the copy within 30 days.
• To restriction and to object to processing based on legitimate interest.
• To complain: to the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, to the data protection authority of your country.

To exercise a right, write to support@fibace.com. We will reply within 30 days.

11. Changes to this policy

We may update this Privacy policy. We will announce material changes by email or on the website at least 14 days before they take effect.

12. Contact

For privacy and personal data questions: support@fibace.com. See also the Terms of use.

This is a translation; if it differs from the Ukrainian version, the Ukrainian version prevails.