← Back to Arbicle

Privacy Policy

Last updated: 2 May 2026

1. Who We Are

Arbicle Limited ("Arbicle", "we", "us") is a private limited company incorporated in Ireland. We operate the rental marketplace at arbicle.com.

Data Controller: Arbicle Limited · hello@arbicle.com

2. Data We Collect

Account

Name, email, hashed password
Profile photo (optional)
Role (Renter/Landlord)
Phone/WhatsApp number (landlords, optional)

Listing Data (Landlords)

Address, Eircode, photos, description
Rent, bedrooms, property type
RTB registration number (optional)

Usage Data

Pages visited, searches, filters
Device, browser, IP address
Actions: enquiries, viewings, listings

Messages & Enquiries

Platform messages between renters and landlords
Applications and enquiry content
Support emails sent to us

Payments

Processed by Stripe — we do not store card numbers
Transaction records (amount, date, status) retained for legal compliance

3. Legal Basis for Processing

Purpose	Legal Basis
Providing the platform and services	Contract (Art. 6(1)(b))
Processing payments	Contract (Art. 6(1)(b))
Fraud prevention and security	Legitimate interests (Art. 6(1)(f))
Transactional emails (reminders, alerts)	Contract (Art. 6(1)(b))
Analytics (PostHog) — consent-gated only	Consent (Art. 6(1)(a))
Legal compliance (tax, CRO)	Legal obligation (Art. 6(1)(c))
Platform improvement	Legitimate interests (Art. 6(1)(f))

4. Third-Party Processors

Processor	Purpose	Location
Vercel	Hosting and CDN	USA (SCCs)
Neon (PostgreSQL)	Database	EU (Ireland)
Stripe	Payments	USA (SCCs)
Bunny.net	Media storage and CDN	EU
Resend	Transactional email	USA (SCCs)
PostHog (consent-gated)	Analytics	EU
Sentry	Error monitoring	USA (SCCs)
Mapbox	Maps and location	USA (SCCs)
Upstash	Rate limiting	EU

SCCs = Standard Contractual Clauses (GDPR Art. 46(2)(c)). We do not sell your data.

5. Data Retention

Account data: retained for account lifetime + 12 months after deletion
Messages and enquiries: 12 months after last activity
Payment records: 7 years (Irish Revenue requirement)
Analytics: 12 months if consent granted
Fraud flags: up to 3 years for platform safety

6. Your Rights (GDPR)

Right of Access (Art. 15): request a copy of your data
Right to Rectification (Art. 16): correct inaccurate data
Right to Erasure (Art. 17): request deletion of your data
Right to Restriction (Art. 18): limit how we process your data
Right to Portability (Art. 20): receive your data in machine-readable format
Right to Object (Art. 21): object to processing based on legitimate interests
Right to Withdraw Consent: manage via cookie settings at any time

Exercise rights via the Your Data page or email hello@arbicle.com. We respond within 30 days.

7. Cookies

See our Cookie Policy for full details. Manage preferences via the cookie banner.

8. Security

Passwords hashed with bcrypt — never stored in plain text
All data transmitted over HTTPS (TLS 1.2+)
Database access restricted by IP allowlist
Two-factor authentication (TOTP) available for landlords
Automated error monitoring via Sentry

9. Children

Arbicle is not directed at children under 18. If you believe a child has submitted data, contact us at hello@arbicle.com.

10. Changes

We may update this policy and will notify registered users of material changes by email. Continued use after changes constitutes acceptance.

11. Contact & Complaints

Contact: hello@arbicle.com

Complaints may also be lodged with the Data Protection Commission (DPC), Ireland.