1. Controller and EU representative
The controller for the websites and apps of ResidencyHub and ResidencyCommunity is MAXVALUETECH LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, represented by Arian Maxhera. Privacy requests: via the support form or the e-mail address in the legal notice.
Representative in the EU (Art. 27 GDPR): will be appointed and added here.
2. Scope and international focus
This policy covers both platforms – ResidencyHub (comparing and connecting relocation service providers) and ResidencyCommunity (forum, feed, members, events, library) – which share one account.
We are a US-based company and therefore also process data in the USA. Users in the EU/EEA have the rights under the GDPR; for users in other countries we apply the same principles unless stricter local law applies.
3. Principles and legal bases
Depending on the purpose, we rely on:
- Consent (Art. 6(1)(a) GDPR) – e.g. phone calls, newsletter, sharing with agencies, location in the community. You can withdraw it at any time with effect for the future.
- Contract and pre-contractual steps (Art. 6(1)(b) GDPR) – e.g. your account, your requests, community membership, agency accounts.
- Legal obligations (Art. 6(1)(c) GDPR) – e.g. keeping invoices, handling reports of illegal content.
- Legitimate interests (Art. 6(1)(f) GDPR) – e.g. secure operation, abuse prevention, automated pre-checks of posts, event notices to members.
4. Service providers (processors)
We use the following providers under data processing agreements (concluded or being concluded). Where they are outside the EU, transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.
- Supabase (Supabase, Inc., USA): database, sign-in by e-mail code, file storage (profile pictures, photos, videos, PDFs). The database is operated via Lovable Cloud.
- Lovable (Lovable Cloud): hosting of the websites, provision of the database and the AI gateway.
- AI services via the Lovable AI Gateway (currently a model by OpenAI): automated pre-checks of posts and images, review and summary of submitted PDFs, translations, suggestions for agency profiles and newsletter drafts. Content is only transmitted for this purpose and not stored for training where the provider commits to this.
- Anthropic (Claude, Claude Code): AI-assisted development, maintenance and troubleshooting of the platform. Stored data may be accessed in individual cases, solely for maintenance and on the team's instructions.
- Resend: sending e-mails (codes, notifications, event notices, newsletter) – only once sending is enabled.
- Phone verification service (SMS/WhatsApp/Telegram) when you confirm your number.
- Unsplash (images) and Google Fonts (fonts) are loaded from their servers; your IP address is transmitted to these providers.
5. Visiting the website
When you visit, our hosting processes technically necessary data (IP address, time, page, browser, operating system) for secure and stable operation (Art. 6(1)(f) GDPR). Server logs are deleted after a short time.
6. Cookies and local storage
We do not use advertising or tracking cookies. In your browser we only store what is needed: your sign-in, your matcher progress until you register and a queue of interests (e.g. countries viewed) that is linked to your account only after you sign in. For visitor statistics we set no cookies: we count page views with page, referring site, campaign parameters, country and device type and, to count unique visitors, a daily rotating salted hash of IP address and browser identifier – we never store the IP address itself (Art. 6(1)(f) GDPR). With “Do Not Track” we do not count you. Your star favourites on the world map are stored in your browser and, when signed in, in your account. Newsletter clicks are counted via signed links; we do not measure opens.
If you arrive via a campaign link (e.g. with utm_source), we keep these campaign parameters and the landing page only in the memory of the open page – not in cookies or browser storage; they are gone when you reload or close it. If you submit an inquiry, a registration or a booking, we store them with it to evaluate which campaign leads to inquiries (Art. 6(1)(f) GDPR). With “Do Not Track” we do not record them.
7. Relocation Matcher, registration and requests
In the matcher you voluntarily enter destinations, situation, timeline and wishes. When you register, we store your name, email, phone number and matcher answers in your account to show you suitable countries, steps and providers (Art. 6(1)(b) GDPR).
When you request a service, we check the request and forward it only to the agency you chose. Agencies do not receive your contact details without your request.
8. Phone consultation (only with consent)
Unlike many portals, we call you on request to clarify your needs. We only do this if you have given explicit, separate consent – e.g. by ticking the box when registering or by requesting a callback (Art. 6(1)(a) GDPR). Consent is voluntary and not required to use the platform.
We log the time and outcome of calls and notes on your needs in our customer CRM. Calls are not recorded. If we cannot reach you, a short email offering a callback may follow.
You can withdraw consent at any time – via the link in every email, in your customer account or during the call. We will then stop calling.
10. Customer and agency accounts
Sign-in uses one-time codes or links by email; we do not store passwords for customers. For agencies we store company and profile data, verification documents and the approval history. Only profile data the agency publishes is shown publicly.
11. Data about listed providers
We may create provider profiles from publicly available sources (website, registers) to give people an overview (Art. 6(1)(f) GDPR). Publicly we only show company details and initials, never full names of individuals. Providers can claim, correct or object to their listing.
12. Reviews
Registered users can review. We store stars, text, optional sub-ratings, the displayed name (first name and initial), your account and, to detect abuse, country, city and a salted hash of your network (not the IP address). The ResidencyBot checks the text and whether a booking through ResidencyHub is on record ("Verified booking" badge). Agencies can release unverified reviews or ask support to delete them within 14 days. Support checks unusual clusters (Art. 6(1)(f) GDPR – protection against fake reviews and defamation).
13. ResidencyCommunity
We process your community profile, your member ID (e.g. @HansPeter) with QR code, posts, topics, replies, images, videos, likes, direct messages, event RSVPs and reports. Your name (first name and last-name initial) is always visible; you decide on every other profile detail and on showing your activity on your profile. Financial details from the matcher are never shown.
Search: members can only find you by your member ID or your full first and last name – you can switch off the latter in your profile.
Verified badge: if members are or were ResidencyHub customers (booked or completed service), we automatically match this with our customer records and show a badge. We do not store ID cards or documents for this.
Location: only if you turn it on do we store a position rounded to approx. 1 km. Others never see coordinates, only an approximate distance (Art. 6(1)(a) GDPR).
Direct messages are only visible to the members involved. When abuse is reported, moderators can view the reported content. We do not currently offer end-to-end encryption.
14. Automated pre-check (ResidencyBot)
Every post and every image is automatically checked by our ResidencyBot before publication for breaches of the community rules (including links, nudity, glorification of violence, drugs, alcohol, nicotine). Text and images are transmitted to the AI service for this (Art. 6(1)(f) GDPR – protecting members, especially families and children).
If a post is blocked, you see the reason and can revise it; rejected images are deleted immediately. New topics and videos are also looked at by a person. You can always ask for a human to review a decision.
15. Library and submitted works
If you submit an e-book or PDF, we store the file, title, description and proof of your rights grant: exact wording, version and checksum of the declaration, time, IP address, browser, name and e-mail (Art. 6(1)(b), (c) and (f) GDPR – proof of rights). The bot checks and categorises the work and writes an internal summary; it is only published after approval by the team.
Library files can only be downloaded by signed-in members via time-limited links; downloads are counted anonymously.
16. Event notices, newsletter and news channels
Event notices: members interested in a country or living there receive at most two e-mails (announcement and reminder) about events in that country as part of the membership (Art. 6(1)(b) or (f) GDPR). Switch them off in your profile or via the link in every e-mail.
You only receive the e-mail newsletter with consent (Art. 6(1)(a) GDPR). We store time, wording, language, IP and device as proof. Content may be prepared by an AI assistant; every issue is approved by a person. Unsubscribe any time with one click.
WhatsApp and Telegram channel: we only link to our channels. You join and leave them yourself in the app; the privacy policies of WhatsApp (Meta) or Telegram apply. We receive no contact details from there beyond what the platform technically shows channel owners, and we do not import contacts.
17. Payments and invoices
Agencies receive invoices for booked services; invoice data is kept for the statutory periods (usually 10 years). Once customers can book services directly on the platform, we will use payment providers (e.g. PayPal, Klarna, card payments) and add them to this policy.
18. Processing in the USA
As a US company we process your data (also) in the USA. We only use providers in third countries with appropriate safeguards (EU-US Data Privacy Framework or standard contractual clauses). You can request a copy of the safeguards through support.
19. Retention
We keep data only as long as needed for the purpose or required by law. Proof of consent and of rights grants is kept as long as we must be able to demonstrate it. If you delete your account, we remove your profile data; community posts are deleted or anonymised unless rights exist under our terms of use or legal obligations prevent it.
20. Your rights
You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw consent at any time.
You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence or of the alleged infringement.
21. No personal data in links
Personal data never appears in web addresses or query strings. Links in emails (e.g. to unsubscribe) contain only signed, unreadable identifiers.
Questions about privacy or want a copy of your data? Contact us through support.