Privacy Policy

Last updated 13 October 2026

Wonu helps you find a rental home. To do that we need some information about you and what you are looking for. This page explains what we use, why, who helps us process it, and what you can do about it.

1. Who is responsible

Zal Digital, trading as Zal Group, runs Wonu and is the controller of your personal data under the General Data Protection Regulation (GDPR). KvK 95920064, [address], the Netherlands. For anything about privacy, mail amir@zal-group.nl.

2. The short version

• We use your data to search for homes for you and to prepare your inquiries. We don’t sell it and we don’t show ads.
• Nothing goes to an agency unless you send it yourself.
• Your account data is stored in the EU (Frankfurt).
• You can see, download and delete your data.

3. What we collect

• Account: your name, email address and Google account ID from Google Sign-In, and your phone number if you add it.
• Your searches: cities and areas, rent range, filters, and what you write in your own words about the home you want.
• Your rental profile: details you choose to add so Wonu can write to agencies for you, such as move-in date, household, pets, work and gross income, and whether you have a guarantor.
• Documents: files you choose to upload, such as payslips or ID. They are kept in private storage and only leave it when you send them to an agency.
• Activity: the homes that matched, the inquiries you prepared and sent, agencies you hid, and your settings.
• Device: a push notification token, if you allow notifications, and basic technical data such as app version.
• Payments: whether you have a trial or subscription and until when. Payment details are handled by the App Store, Google Play or Stripe; we never see your full card number.
• Messages to us: what you send when you mail us.

4. Why we use it, and on what basis

• To provide Wonu (performing our contract with you): run your searches, show matches, draft inquiries and fill agency forms, manage your trial and subscription.
• To keep Wonu safe and working (our legitimate interest): prevent abuse, fix errors and improve how well matches fit.
• Website analytics (your consent): if you accept analytics on wonu.app, we measure how people find and use the website. See section 10.
• Notifications (your consent): we send push notifications only if you allow them, and you can turn them off at any time in your phone’s settings.
• Legal duties: we keep payment and tax records as Dutch law requires.

5. How we use AI

Wonu uses AI models, through the provider OpenRouter, for these tasks:

• reading the text of public listings, to pick out facts such as pets, income rules and contract length;
• turning what you write about your search into filters, and checking your wishes against each home;
• drafting an inquiry or filling an agency’s form, when you ask for it. For this the AI receives the listing and the relevant details from your rental profile.

Your documents are never sent to AI. We don’t use your data to train AI models, and we choose providers that don’t either. AI makes mistakes, so you always see and can change what it wrote before anything is sent.

6. Who processes your data for us

We use these providers. Each processes data only on our instructions, under a data processing agreement.

• Supabase: database, sign-in and file storage, hosted in Frankfurt, Germany (EU).
• Hetzner: servers that run Wonu’s app, website and search, in Germany (EU).
• Google: Google Sign-In, and push notifications on Android (Firebase Cloud Messaging).
• Apple: push notifications on iPhone, and payments through the App Store.
• OpenRouter and the AI model providers it routes to: AI processing as described above. These may be outside the EU.
• RevenueCat and Stripe: managing subscriptions and payments, once paid plans start.
• Cloudflare: DNS for our domains.
• PostHog: analytics and error reports for this website, hosted in the EU, only if you accept analytics.

When data goes outside the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

We share data with an agency only when you send it yourself, by email from your own mail app or through the agency’s own form. From then on, the agency’s privacy policy applies to it.

7. How long we keep it

• Your account, searches, profile and documents: as long as you have an account. When you delete your account we delete them within 30 days, including from backups as they roll over.
• Payment and invoice records: 7 years, as Dutch tax law requires.
• Website analytics: at most [number] months.
• Server logs: a short period for security, at most [number] days.
• Emails with us: as long as needed to help you, and at most 2 years after our last contact.

8. Your rights

Under the GDPR you can:

• see the data we have about you, and get a copy;
• take it with you in a common, machine-readable format;
• correct data that is wrong;
• delete your account and data, from your profile in the app or by mailing us;
• object to or limit how we use your data, and withdraw consent you gave.

Mail amir@zal-group.nl for any of these. We answer within one month. If you’re not happy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

9. Security

Data travels encrypted, is stored encrypted, and is protected by access rules so you can only reach your own. Documents are kept in private storage and opened only through short-lived links. Only the people who build Wonu can reach the systems, and only when needed.

10. This website and cookies

When you first visit, we ask whether we may use analytics. Until you say yes, nothing is tracked and no analytics code loads.

If you accept, PostHog stores a random ID in your browser’s local storage, so we can recognise your visits. We then see which pages you view, what you click on the page, how you arrived (such as the referring site), your browser and device type, your approximate location based on your IP address, and errors the page runs into. We use this to understand which parts of the site work and to fix problems. We don’t use it for ads and don’t sell it.

You can change your mind at any time with “Cookie settings” at the bottom of every page. If you decline after accepting, we stop the analytics and delete the ID from your browser.

Two choices are always saved in your browser’s local storage and never sent to us: your answer to the analytics question, and light or dark mode if you switch it. Fonts are served from our own servers. Our servers keep standard access logs, including IP addresses, for security.

If you describe the home you want on the home page, your text is kept in your browser’s local storage so it is still there when you come back. While you type, it is sent to our server and read by AI (through OpenRouter, see section 6) to show the filters it found. We don’t store it on our server. If you use the microphone button, your browser’s own speech recognition turns your voice into text; depending on your browser, that may happen at Google or Apple, not at Wonu.

The web app at app.wonu.app uses only the cookies needed to keep you signed in.

11. Children

Wonu is for people aged 18 and over. We don’t knowingly collect data from children.

12. Changes

When we change this policy, we update the date at the top. If a change matters for you, we tell you in the app or by email before it applies.

13. Contact

Zal Digital (Zal Group), [address], the Netherlands
KvK 95920064
amir@zal-group.nl