Ayla Data Processing Terms (annex to the Ayla Operator Terms)

Version: v1 · Last updated: 13 October 2026

These Data Processing Terms have two parts:

  • Part A sets out how the Clauses fit the Ayla portal. It sits outside the Clauses and never changes them.
  • Part B incorporates the Clauses themselves, unmodified, with Annexes I to IV filled in.

Part A. How these terms work

A1. Who is who. For the records you keep in the Ayla portal and the lease documents you send to Ayla, you (the operator) are the controller and Ayfinity Labs S.à r.l.-S ("Ayla") is your processor. Ayla's own purposes (your account, its flatmate service, its own WhatsApp conversations with seekers) are outside these terms and are covered by the Ayla Privacy Policy.

A2. When you act for an owner. You may manage a property on behalf of its owner. If, for a property, you process tenant data on the owner's instructions, then for that property:

  • the owner is the controller, you are its processor, and Ayla is your sub-processor;
  • you confirm that your agreement with the owner allows you to engage Ayla, and that you have passed on to the owner what it needs to know about Ayla and the sub-processors in Annex IV;
  • the Clauses apply between you and Ayla as written, with you in the controller's place towards Ayla, and you pass on to the owner any instruction, notice or information the Clauses give you, including the sub-processor notices under Clause 7.7(a);
  • Ayla accepts the same data-protection obligations towards you as the owner's contract places on you, as far as they concern Ayla's processing, in line with Article 28(4) GDPR; and
  • the owner may join these Clauses as a controller under the docking clause (Clause 5), by completing Annex I with you and Ayla.

A3. Requests from tenants. Under Clause 8(a), you authorise Ayla to acknowledge a request a tenant sends to Ayla and to tell the tenant that it has been passed to you. Ayla forwards the request to you within 3 working days. Ayla answers the substance of a request only on your written instruction.

A4. What Ayla never does with your data. Ayla does not use your records, lease documents, WhatsApp lease messages or chat history for matching, for profiles in its flatmate service, to contact your tenants, for its own analytics or product work, or to train AI. Doing so would make Ayla a controller (Article 28(10) GDPR) and breach Clause 7.2.

A5. Notices. Notices under the Clauses, including sub-processor changes (Clause 7.7(a)) and breach notices (Clause 9.2), go to the email address on your account. Publishing a change on the Ayla website alone is not notice.

A6. Order of documents. The Clauses prevail over Part A, the Operator Terms and any other agreement between us (Clause 4).

A7. Objecting to a new sub-processor. If you object to a change notified under Clause 7.7(a) and we cannot find a solution together, you can end the Operator Terms before the change applies, at no cost.

Part B. The Standard Contractual Clauses

B1. Incorporation. The parties agree to the standard contractual clauses between controllers and processors in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021, official text: eur-lex.europa.eu/eli/dec_impl/2021/915/oj. They are incorporated here by reference, word for word, and the parties will not modify them (Clause 2(a)). Only the choices in B2 and the annexes below are added.

B2. Choices made in the Clauses. Decision (EU) 2021/915 has no "modules"; modules exist only in the separate clauses for international transfers, Decision (EU) 2021/914. The choices are:

  • Clause 1(a), and each clause offering "OPTION 1 / OPTION 2" (Clauses 8(c)(4), 9.1(b), 9.1(c), 9.2): OPTION 1, Regulation (EU) 2016/679 (GDPR). Option 2 is for EU institutions and is not used.
  • Clause 5, docking clause: included, so an owner (Part A2) or a group company of the operator can join.
  • Clause 7.7(a), sub-processors: OPTION 2, general written authorisation for the agreed list in Annex IV. Time period: at least 30 days in advance, notified directly to the controller (Part A5).
  • Clause 7.8(b), transfers by sub-processors: where a sub-processor transfers data outside the EEA, Ayla and that sub-processor use the transfer safeguards shown for it in Annex IV, such as the Decision (EU) 2021/914 clauses, Module 3 (processor to processor).
  • Signature (Annex I): electronic acceptance in the portal, recorded in Ayla's acceptance log.

Annex I. List of parties

Controller(s):

  1. Name: [operator's legal or full name, filled from the account]. Address: [from the account]. Contact person's name, position and contact details: [the person who accepted, their role, email]. Signature and accession date: accepted electronically on [date and time], terms version [v1, version hash], acceptance log reference [id].
  2. Where Part A2 applies and the owner joins under Clause 5: the owner's name, address and contact.

Processor(s):

  1. Name: Ayfinity Labs S.à r.l.-S (trading as Ayla), RCS Luxembourg B309934. Address: 13A, Avenue Guillaume, L-1651 Luxembourg. Contact person's name, position and contact details: François de la Caffinière, gérant, privacy@ayla.lu. No data protection officer is designated (not required; Ayla's written assessment is on file). Signature and accession date: accepted electronically on the same date as the controller.

Annex II. Description of the processing

Scope. This annex covers three things only: (1) the portal records, (2) lease documents sent to Ayla by upload or on WhatsApp, and (3) the Ayla chat and lease reading over those records. It does not cover Ayla's flatmate matching, any tenant household profile, or messages Ayla sends on its own account. Messages to tenants on the operator's behalf are not part of the service today (see "Nature", point 6).

Categories of data subjects

  • Tenants and co-tenants
  • Guarantors
  • Household members named in a lease or inventory
  • Applicants, where the operator records them
  • Owners, where the operator manages for an owner
  • The operator's own staff or contacts named in documents
  • The private landlord, where the operator is a private person

Categories of personal data

  • Identity: name, date of birth where a lease states it, nationality or ID details where a lease states them
  • Contact: phone number, email, postal address
  • Tenancy: property, room, lease dates, rent, charges, notice dates, move-in and move-out dates
  • Payments: rent received, arrears, deposits (amount, how held, date received and returned)
  • Documents: leases, addenda, inventories, insurance certificates and other files the operator uploads or sends, including signatures and bank details they contain
  • WhatsApp lease messages: the operator's sending number, the time sent, the message text and the attached files
  • Chat: the operator's questions to the Ayla chat and the AI's answers

Sensitive data, and safeguards. Ayla does not ask for sensitive data. Lease documents can still contain it, for example a disability adaptation or a health reason for a lease ending. Safeguards: the data is used only for the purposes below; no AI provider may train on it; staff access is limited to support the operator asks for, and staff access as the operator is logged; it is never used in matching or profiling; it is deleted with the record.

Nature of the processing

  1. Hosting, storing, organising and showing the operator's records in the portal.
  2. Receiving lease documents uploaded in the portal or, once Ayla offers it, sent to Ayla's WhatsApp number +352 404 002, filing them in the operator's account, and keeping them.
  3. Reading lease documents with AI to suggest lease details (names, dates, rent, deposit) for the operator to check and save.
  4. Answering the operator's questions in the Ayla chat with AI, using the operator's records and lease documents.
  5. Sending the operator reminders about their own records (in the portal, and on WhatsApp once Ayla offers it).
  6. Not today: sending tenancy messages to tenants on the operator's behalf. This will be added only by a written instruction in this annex, limited to tenancy content, with the WhatsApp opt-in Meta requires.
  7. Backup and restore; export to the operator; deletion; support at the operator's request.

Purposes. To provide the Ayla portal to the operator: keeping and organising the operator's rental records, reading lease documents for the operator, and answering the operator's questions about them. No other purpose (Part A4).

Duration. For as long as the Operator Terms run. Within that time, each record is kept for the period the operator sets. Chat history is kept while the operator's account exists, then deleted with it.

End of contract. At the operator's choice (Clause 10(d)), Ayla returns the records as an export and deletes them, or deletes them, within 30 days of the end. Copies in backups are gone within about 35 days after that. Ayla confirms the deletion in writing on request.

Processing by sub-processors (subject matter, nature and duration): see Annex IV.

Annex III. Technical and organisational measures

Encryption and pseudonymisation

  • All traffic uses TLS (HTTPS for the portal, TLS to the database, storage and AI providers).
  • Data at rest is encrypted by each provider (Neon, Cloudflare R2, AWS). The most sensitive fields, tenant names and phone numbers, are also encrypted by Ayla at application level.

Confidentiality, integrity, availability, resilience

  • Every record belongs to one operator account; every database query is scoped to that account, so one operator cannot see another's data.
  • The AI chat sees only the records of the account that asks; no context is shared across accounts.

Restoring access after an incident

  • Database backups with point-in-time restore; an encrypted copy of the database is kept for 26 days in AWS Frankfurt. Backups roll over within about 35 days.

Regular testing

  • Automated tests on each code change; regular security reviews of the code and the systems; an annual review of these measures.

User identification and authorisation

  • Operators sign in with Google or a one-time code sent on WhatsApp, with rate limits on code attempts.
  • Ayla staff reach operator data only through admin tools, only to support the operator or keep the service running. Every time a staff member acts as an operator, it is logged with who did it and why.

Protection during transmission and storage

  • Lease documents are stored in Cloudflare R2 buckets created in the EU jurisdiction. Data is held in the EU: Neon in Frankfurt (AWS eu-central-1), the portal on Vercel in Frankfurt (fra1).
  • AI runs in the EU only: Google Vertex AI in EU locations; AWS Bedrock, once used for lease reading, in eu-central-1 (Frankfurt).
  • WhatsApp: media retention at Meta set to "No Storage" (about 1 hour).

Physical security

  • Ayla has no servers of its own. Physical security is that of the sub-processors' data centres, covered by their certifications (ISO 27001 and SOC 2 reports, per each provider's DPA).

Events logging

  • Staff access as an operator, sign-ins and errors are logged. Error reports (Sentry) are scrubbed of personal details before they leave the portal.

System configuration

  • EU regions are pinned in configuration; Google Search grounding is off.

Governance and staff

  • Everyone at Ayla with access is bound to confidentiality in writing. Access is removed the day someone leaves.

Certification and assurance

  • Ayla holds no certification itself. It relies on its sub-processors' certifications and keeps each one's DPA on file.

Data minimisation and quality

  • Lease reading only suggests details; the operator checks and saves them. The portal asks only for the fields tenancy management needs.

Limited retention

  • Retention periods set by the operator; chat history deleted with the account (Annex II); WhatsApp media at Meta per the setting above; backups roll over within about 35 days.

Accountability

  • Acceptance log for these terms; register of processing kept per operator (Article 30(2) GDPR); sub-processor DPAs on file.

Portability and erasure

  • A copy of an operator's records, including the original files, on request; deletion on request or at the end of the contract, confirmed in writing.

Assistance to the controller (Clauses 8 and 9)

  • Tenant requests: forwarded to the operator within 3 working days (Part A3); the portal's editing tools, and a copy of the records on request, let the operator answer them.
  • Impact assessments: on request, Ayla gives the operator a short pack describing the system, data flows, AI settings and these measures.
  • Breaches: Ayla notifies the operator without undue delay, aiming for within 48 hours of becoming aware, with the content listed in Clause 9.2, by email, and keeps the operator updated as facts come in.

Annex IV. Sub-processors

This is the agreed list under Clause 7.7(a), Option 2. Annex IV is mandatory only under Option 1. Here it holds the agreed list that Option 2 refers to. Changes: at least 30 days' notice by email, with a right to object (Part A7).

1. Neon (Databricks, Inc., the parent company of Neon, LLC), 160 Spear Street, 15th Floor, San Francisco, CA 94105, USA

  • What it does for the portal: database for all portal records and chat history.
  • Where: AWS eu-central-1, Frankfurt.
  • Transfers outside the EEA: possible remote access from the US, under the standard contractual clauses in its DPA (Modules 2 and 3).

2. Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA

  • What it does for the portal: storage of lease documents and files (R2, EU jurisdiction); the admin worker that serves AI settings.
  • Where: EU.
  • Transfers outside the EEA: under the transfer terms of Cloudflare's DPA (standard contractual clauses).

3. Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA

  • What it does for the portal: runs the portal web app; data passes through it.
  • Where: Frankfurt (fra1).
  • Transfers outside the EEA: under the transfer terms of Vercel's DPA (standard contractual clauses).

4. Google Cloud EMEA Limited, Ireland

  • What it does for the portal: Vertex AI (Gemini), the Ayla chat and lease reading. No training on the data. Requests may be kept up to 90 days for abuse monitoring unless Google grants Ayla an exception.
  • Where: EU locations.
  • Transfers outside the EEA: Google LLC and other Google sub-processors, under Google's DPA.

5. Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg

  • What it does for the portal: the encrypted database copy (26 days). Bedrock (Anthropic Claude Haiku) for lease reading, from the date Ayla starts using it for that. No training on the data, not kept by AWS.
  • Where: eu-central-1, Frankfurt.
  • Transfers outside the EEA: none intended.

6. Meta Platforms Ireland Limited, Dublin, Ireland

  • What it does for the portal: WhatsApp Business Cloud API. Once Ayla offers it, it carries lease documents and messages the operator sends to Ayla, and reminders Ayla sends the operator. Media kept by Meta for about 1 hour ("No Storage"). Meta may act as an independent controller for the safety and integrity of its platform, as its own terms set out.
  • Where: messages pass through Meta's global systems.
  • Transfers outside the EEA: Meta Platforms, Inc. (US), under Meta's own transfer safeguards, including standard contractual clauses.

7. Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA

  • What it does for the portal: error monitoring for the portal; personal details are scrubbed before sending.
  • Where: EU (Frankfurt).
  • Transfers outside the EEA: under the transfer terms of Sentry's DPA (standard contractual clauses).
Talk to Ayla