Data controller: Mlau ApS, c/o Mark Laursen, Denmark. Contact: privacy@mlau.dk.
1. What we collect
When you use Mlau, we collect:
Account data: name, email address, the company you work for, language preference, and an encrypted password.
Tenancy data: your assigned room, building, move-in date, optional move-out date, and signature of house rules.
Photos: images you submit for defect reports, move-out reports, and reference photos taken by Mlau staff in your room.
Communications: messages you send to Mlau via in-app tickets, and any reply we send back.
Device + technical data: anonymised device identifier for push notifications, language setting, and error/crash diagnostics via Sentry.
2. Why we collect it
We process this data to:
Operate the rental service (assign rooms, manage move-outs).
Enforce the house rules you accepted on move-in.
Triage defect reports and respond to service requests.
Send transactional emails (account invites, password resets, status updates).
Detect and fix bugs in the app via anonymised crash reports.
3. Legal basis
Contract performance for tenancy data (article 6(1)(b) GDPR).
Legitimate interest for crash reports (article 6(1)(f)).
Consent for push notifications (revocable in your phone settings).
4. Who sees it
Mlau staff (internal).
Your employer's customer-admin (limited: name, email, room assignment, defects + move-outs you file).
Third-party processors strictly necessary for service:
Postmark (USA) — transactional email delivery.
Firebase Cloud Messaging (Google, USA) — push notifications.
AWS S3 (eu-north-1, Stockholm) — photo + backup storage.
Sentry (USA) — error tracking. PII stripped from event payloads.
International transfers rely on Standard Contractual Clauses.
5. How long we keep it
Tenancy + account data: while you have an active assignment, plus 12 months after move-out for dispute handling.
Defect + move-out photos: 24 months after the event.
Crash reports: 90 days.
Backups: 30 daily snapshots, then deleted.
6. Your rights
You can ask us to:
Access the data we hold about you.
Correct inaccuracies.
Delete your account ("GDPR forget"). This removes name, email, tenancy history, and anonymises photos. Some financial records may be retained for legal compliance.
Export your data in a portable format.
Email privacy@mlau.dk to exercise any of these rights. We respond within 30 days.
7. Complaints
You can complain to the Danish Data Protection Authority: datatilsynet.dk.
8. Cookies on mlauliving.dk
Our website mlauliving.dk uses cookies in three categories:
Necessary — make the site work (session cookie) and remember your cookie choice in the mlau_consent cookie for 12 months. These need no consent.
Statistics — Google Analytics (via Google Tag Manager) measures anonymously how the site is used so we can improve it. Set only with your consent.
Marketing — Google Ads measures whether an enquiry came from an ad. Set only with your consent.
You choose in the cookie banner, and you can change or withdraw your consent at any time via the "Cookie settings" link at the bottom of the page. Google Analytics and Google Ads data is processed by Google Ireland Ltd. under Google's terms and deleted after at most 14 months.
9. Changes
We post material changes here and notify you in the app at least 30 days before they take effect.