Privacy Policy

Last updated 16 October 2026

Wonu helps you find a rental home. To do that we need some information about you and what you are looking for. This page explains what we use, why, who helps us process it, and what you can do about it.

1. Who is responsible

Zal Digital, trading as Zal Group, runs Wonu and is the controller of your personal data under the General Data Protection Regulation (GDPR). KvK 95920064, VAT NL005178047B39, the Netherlands. For anything about privacy, mail [email protected].

2. The short version

• We use your data to search for homes for you and to prepare your inquiries. We don’t sell it and we don’t show ads.
• Nothing goes to an agency unless you send it yourself.
• Your account data is stored in the EU (Frankfurt).
• You can see, download and delete your data.

3. What we collect

• Account: your name, email address and Google account ID from Google Sign-In, and your phone number if you add it.
• Your searches: cities and areas, rent range, filters, and what you write in your own words about the home you want.
• Your rental profile: details you choose to add so Wonu can write to agencies for you, such as move-in date, household, pets, work and gross income, and whether you have a guarantor.
• Documents: files you choose to upload, such as payslips or ID. They are kept in private storage and only leave it when you send them to an agency.
• Activity: the homes that matched, the inquiries you prepared and sent, agencies you hid, and your settings.
• Device: a push notification token, if you allow notifications, and basic technical data such as app version.
• Payments: whether you have a trial or subscription and until when. Payment details are handled by the App Store, Google Play or Mollie; we never see your full card or bank details.
• Messages to us: what you send when you mail us.

4. Why we use it, and on what basis

• To provide Wonu (performing our contract with you): run your searches, show matches, draft inquiries and fill agency forms, manage your trial and subscription.
• To keep Wonu safe and working (our legitimate interest): prevent abuse, fix errors and improve how well matches fit.
• Website analytics (your consent): if you accept analytics on wonu.app, we measure how people find and use the website. See section 10.
• Notifications (your consent): we send push notifications only if you allow them, and you can turn them off at any time in your phone’s settings.
• Legal duties: we keep payment and tax records as Dutch law requires.

5. How we use AI

Wonu uses AI models, through the provider OpenRouter, for these tasks:

• reading the text of public listings, to pick out facts such as pets, income rules and contract length;
• turning what you write about your search into filters, and checking your wishes against each home;
• drafting an inquiry or filling an agency’s form, when you ask for it. For this the AI receives the listing and the relevant details from your rental profile.

Your documents are never sent to AI. We don’t use your data to train AI models, and we choose providers that don’t either. AI makes mistakes, so you always see and can change what it wrote before anything is sent.

6. Who processes your data for us

We use these providers. Each processes data only on our instructions, under a data processing agreement.

• Supabase: database, sign-in and file storage, hosted in Frankfurt, Germany (EU).
• Hetzner: servers that run Wonu’s app, website and search, in Germany (EU).
• Google: Google Sign-In, and push notifications on Android (Firebase Cloud Messaging).
• Apple: push notifications on iPhone, and payments through the App Store.
• OpenRouter and the AI model providers it routes to: AI processing as described above. These may be outside the EU.
• Mollie: web payments and subscriptions, in the Netherlands (EU). Mollie is responsible for the payment details you give it.
• RevenueCat: managing app-store subscriptions, once the apps sell them.
• Resend: sending Wonu’s emails, such as new-home alerts and trial reminders. This may be outside the EU.
• Cloudflare: DNS for our domains, and serving images (R2); no personal data.
• PostHog: analytics and error reports for this website, hosted in the EU, only if you accept analytics.

When data goes outside the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

We share data with an agency only when you send it yourself, by email from your own mail app or through the agency’s own form. From then on, the agency’s privacy policy applies to it.

7. How long we keep it

• Your account, searches, profile and documents: as long as you have an account. When you delete your account we delete them within 30 days, including from backups as they roll over.
• Payment records (amount, date, plan and Mollie’s payment reference): 7 years from the end of the year of the payment, as Dutch tax law requires. If you delete your account we keep these without your account, name or email, and delete them when the 7 years are up. Mollie keeps its own records of your payment as the law requires of it.
• Website analytics and server logs: only as long as we need them to understand how the site is used and keep it secure.
• Emails with us: as long as needed to help you, and at most 2 years after our last contact.

8. Your rights

Under the GDPR you can:

• see the data we have about you, and get a copy;
• take it with you in a common, machine-readable format;
• correct data that is wrong;
• delete your account and data, from your profile in the app or by mailing us;
• object to or limit how we use your data, and withdraw consent you gave.

Mail [email protected] for any of these. We answer within one month. If you’re not happy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

9. Security

Data travels encrypted, is stored encrypted, and is protected by access rules so you can only reach your own. Documents are kept in private storage and opened only through short-lived links. Only the people who build Wonu can reach the systems, and only when needed.

10. This website and cookies

When you first visit, we ask whether we may use analytics. Until you say yes, no analytics code loads and nothing is stored in your browser. The only thing we note without asking is that someone arrived: when you come to the site from elsewhere, we send our team a short message with the page, the site you came from, any campaign tags in the link, and your browser’s time zone. It carries no ID, so we can’t tell whether two visits are the same person, and we don’t keep it in our database.

If you accept, PostHog stores a random ID in your browser’s local storage, so we can recognise your visits. We then see which pages you view, what you click on the page, how you arrived (such as the referring site), your browser and device type, your approximate location based on your IP address, and errors the page runs into. We use this to understand which parts of the site work and to fix problems. We don’t use it for ads and don’t sell it.

You can change your mind at any time with “Cookie settings” at the bottom of every page. If you decline after accepting, we stop the analytics and delete the ID from your browser.

Two choices are always saved in your browser’s local storage and never sent to us: your answer to the analytics question, and light or dark mode if you switch it. Fonts are served from our own servers. Our servers keep standard access logs, including IP addresses, for security.

If you describe the home you want on the home page, your text is kept in your browser’s local storage so it is still there when you come back. While you type, it is sent to our server and read by AI (through OpenRouter, see section 6) to show the filters it found. We don’t store it on our server. If you use the microphone button, your browser’s own speech recognition turns your voice into text; depending on your browser, that may happen at Google or Apple, not at Wonu.

The web app at app.wonu.app uses only the cookies needed to keep you signed in, and to remember your choices there (such as the search you last opened and your message language). Your home description from the home page is also put in a cookie for a day, so the web app can start your first search from it after you sign in; the web app removes it as soon as it has read it.

11. Children

Wonu is for people aged 18 and over. We don’t knowingly collect data from children.

12. Changes

When we change this policy, we update the date at the top. If a change matters for you, we tell you in the app or by email before it applies.

13. Contact

Zal Digital (Zal Group), the Netherlands
KvK 95920064 · VAT NL005178047B39
[email protected]