Privacy policy
How we handle your data
DomiReno only processes the data strictly needed to run the wizard, save projects and unlock Pro features. No ad networks, no resale to third parties, no profiling for commercial purposes. This policy explains what we collect, why, for how long, and what your rights are.
Last updated: April 2026
1. Who is responsible for your data?
The data controller within the meaning of art. 4.7 GDPR is:
- Company:
- WR Consulting BV
- Address:
- Broustinlaan 36 bus Ssrc, 1090 Jette
- Company number:
- 1018.567.009
- Contact:
- contact@domireno.be
For all privacy-related questions you can reach us at contact@domireno.be. We have not appointed a data protection officer as the processing stays below the threshold of art. 37 GDPR; the contact address above is the permanent point of contact.
2. Which personal data do we process?
Summarised per category, each with purpose and legal basis.
| Category | Purpose | Legal basis (art. 6) |
|---|---|---|
| Email address, name (if you have an account) | Creating and managing your account, authentication via Clerk, communication about your projects. | Performance of contract (6.1.b) |
| Home address | Determining region-dependent subsidies and grants. Not shared with third parties. | Performance of contract (6.1.b) |
| Project choices (area, options, total) | Computing the renovation budget and saving as a snapshot so you can continue later. Anonymous wizard runs are stored locally in your browser (localStorage), not on our servers. | Performance of contract (6.1.b) |
| EPC certificate (optional, on upload) | Automated extraction of relevant fields (label, year built, heating) to refine the budget. The document is analysed once by an AI model and is not persistently stored afterwards. | Consent (6.1.a) |
| Payment data (Pro unlock) | Handling the one-off Pro payment via Stripe. We do not see any card data ourselves — it stays with Stripe. | Performance of contract (6.1.b) |
| Server logs (IP, user-agent, timestamp) | Technical operation, error tracking, abuse prevention. Rotated automatically and not fed into marketing databases. | Legitimate interest (6.1.f) |
3. How long do we keep your data?
We do not keep data longer than necessary for the purpose for which it was collected (art. 5.1.e GDPR).
- Account data: as long as your account exists. After deletion by you or by us (e.g. 2 years of inactivity), it is permanently deleted within 30 days.
- Saved projects: as long as you do not delete them yourself. Once deleted, they are irrevocably gone (no soft delete).
- EPC upload: the original PDF is not kept; only the extracted values (label, year built, heating) are stored with your project, and only if you save the project.
- Payment data: we keep invoice and transaction data for 7 years (mandatory accounting retention under art. III.86 of the Belgian Code of Economic Law).
- Server logs: at most 30 days, then automatically deleted.
4. Who processes your data on our behalf?
Processors (art. 28 GDPR) with whom we have concluded a data processing agreement.
| Party | Role | Region |
|---|---|---|
| Clerk Inc. | Authentication, account management, session cookies. | United States (with SCCs) |
| Stripe Payments Europe | Payment processing for Pro; fraud prevention; invoicing. | Ireland (EU) |
| Anthropic PBC | AI analysis of EPC documents. Uploads are not used for model training (API policy). | United States (with SCCs) |
| Neon (PostgreSQL) | Hosting our database (accounts, saved projects). | EU region (Frankfurt) |
| Vercel Inc. | Hosting the web application, edge caching, logs. | United States (with SCCs) |
5. Transfers outside the EEA
A number of our processors are established outside the European Economic Area (see §4). For those transfers, we rely on the European Standard Contractual Clauses (Commission Decision 2021/914), supplemented by the technical and organisational measures each provider applies by default (encryption at rest and in transit, role-based access restriction, audit logging).
For AI processing (Anthropic), no training data is built from your inputs; this is contractually excluded via the zero-retention API terms.
6. Automated analyses and AI
DomiReno uses automated text analysis (Anthropic Claude) to reduce an uploaded EPC PDF to a limited number of values: label, year built, heating type and a few related fields. This is an aid; the result is shown to you each time for confirmation before anything is computed with it.
No automated decision-making within the meaning of art. 22 GDPR takes place: the final choice of which figures you use and which subsidies you apply for stays with you. The budget calculation itself is a deterministic formula based on your own input — no AI, no scoring.
Beyond the extraction itself, we build up aggregate statistics (label distribution and average kWh-figures per region and construction period, always over groups of at least 10 certificates). These counts contain no individual extractions or identifiable data and are decoupled from your account at the moment of storage. We use them only to validate our estimates against reality (legal basis: legitimate interest, art. 6.1.f). If you want to object anyway (art. 21 GDPR), email us at the address in §10.
7. Your rights under GDPR
As a data subject, you have the following rights. A request can be sent to contact@domireno.be. We respond within one month (art. 12.3 GDPR).
- Access (art. 15): obtain a copy of the data we process about you.
- Rectification (art. 16): have inaccurate or incomplete data corrected.
- Erasure / “right to be forgotten” (art. 17): delete your account and linked projects. You can also do this yourself in one click from your profile page.
- Restriction of processing (art. 18): ask us to halt processing while a dispute is ongoing.
- Portability (art. 20): receive your data in a machine-readable format (JSON/CSV) or have it transferred to another provider.
- Objection (art. 21): object to processing that relies on our legitimate interest.
- Withdraw consent: for processing based on consent (e.g. EPC upload), you can withdraw it at any time, without affecting the lawfulness of prior processing.
Logged-in users can also download their data directly (access + portability in one click) via their data export page, or permanently delete their account (right to erasure) via the account deletion page. For the remaining rights (rectification, restriction, objection, withdrawing consent), the email route above still applies.
8. Lodging a complaint
If you believe we are processing your data unlawfully, we would first like to resolve it with you — an email to contact@domireno.be is enough.
You always retain the right to lodge a complaint with the Belgian Data Protection Authority (DPA):
Data Protection Authority
Rue de la Presse 35, 1000 Brussels
www.dataprotectionauthority.be
contact@apd-gba.be — +32 (0)2 274 48 00
9. Changes to this policy
We may adapt this policy as our processing evolves (new feature, new processor, changed retention period). Substantial changes are announced by email to existing accounts and via a visible notice in the app. Minor editorial updates (typos, clarifications) are made quietly — the date at the top of this page always shows the most recent change date.
10. Contact
Questions, requests or comments? Send an email to contact@domireno.be. For information on the specific cookies and local storage we use, see the cookie notice.