Validum

Privacy Policy

This policy explains how Validum processes personal data when you visit our website or use the Validum service. Validum is intended for accommodation operators who organize property compliance records. Validum is operated by AM2PM bv, a Belgian company (VAT BE 0746.685.016), registered with RPR Antwerp, Mechelen division. Its postal address is Hanswijk de Bercht 41, 2800 Mechelen, Belgium. The contact email is hello [at] validum.app.

Who is responsible

The operator of Validum is the data controller for the personal data described here. Contact the controller at: AM2PM bv, VAT BE 0746.685.016, RPR Antwerp, Mechelen division, Hanswijk de Bercht 41, 2800 Mechelen, Belgium; email hello [at] validum.app. For questions about processing or to exercise your rights, use those contact details.

Personal data we process

When an account is created or used, we process the email address, account identifier, preferred language, account status and relevant account timestamps. Sign-in uses one-time email links; security records include the hashed link token, its expiry and use, session information and login history. We also use limited request information, such as email address and IP address, for rate limiting and service security.

Users may enter property details such as name, address, location, description and website; compliance check schedules; logbook entries, notes, dates, status and performer details; and information about users with whom a property is shared. Uploaded property images and inspection evidence may contain personal data. We store file metadata and private file objects. If you contact support, we process the details and content of your message.

If a property owner buys a paid subscription, we process subscription and billing records such as the customer email, subscription and product identifiers, status, billing-period dates and cancellation date. Payment checkout is handled by Creem. We do not receive or store full payment-card details through Validum. Creem processes information under its own terms and privacy policy.

Why we use data and our legal bases

We process account and property information to provide the service, authenticate users, store and display logbooks, enable authorized sharing, generate reports, send requested service messages and reminders, and manage subscriptions. These activities are necessary to perform our contract with the account holder or to take steps requested before entering into a contract.

We process security, login and operational records to protect accounts, prevent misuse, maintain and troubleshoot the service, and keep it reliable. Where required, we rely on legitimate interests, balanced against the rights and expectations of affected people. We use email addresses for sign-in links and service-related notices; optional marketing is not described here and should not be sent without an appropriate legal basis.

We may process or retain records to comply with legal obligations, establish or defend legal claims, and respond to lawful requests. Where we rely on consent, you may withdraw it without affecting processing already carried out. The specific legal basis depends on the processing and applicable law.

Service providers and sharing

Validum runs on Cloudflare services, including Pages/Workers for hosting and application execution, D1 for database records, KV for operational data such as rate limits and reminder delivery, and R2 for private uploaded files. Depending on the live configuration, email is delivered through AgentMail or another configured email provider. These providers process information as needed to provide their services. Their locations, applicable transfer safeguards and the exact live configuration must be confirmed by the operator and are available in the providers’ current privacy information and contractual terms.

Creem receives information needed to create and manage a checkout or subscription, including the customer email, product identifier and transaction metadata linking the subscription to the relevant property/account. Creem sends signed subscription events to Validum; Validum records subscription identifiers, customer details, status and period information. Creem acts under its own terms for its services. Check Creem’s current privacy information for its processing and international-transfer details.

When a property owner shares access, the invited account holders can see or edit the property information according to the assigned role. The owner controls access and can revoke a share. We do not sell personal data. We may disclose information when required by law or when reasonably necessary to protect people, the service or legal rights.

International processing

Cloudflare, Creem and the configured email provider may process data in countries outside your country. The operator must verify the actual locations, transfer mechanisms and safeguards applicable to the production configuration. Contact the controller for information about safeguards relevant to a specific transfer.

Cookies and similar storage

Validum uses an HTTP-only session cookie to keep signed-in users authenticated and a language-preference cookie when a language is selected. The session cookie is configured to expire after 30 days; the language preference may remain for up to one year. Essential technical storage is used to provide the service. This codebase does not include an analytics SDK; infrastructure or provider logs may still be generated according to their configuration and policies.

Retention and deletion

We keep data while needed to provide the service, meet legal obligations, resolve disputes and protect the service. The application does not define a single fixed deletion schedule for all account, security, billing, email-provider and backup records. Deleting a property from the service deletes its property records and associated uploaded files from the active application storage. Archiving a property because of subscription status does not itself delete its data. Some records may remain in backups or provider systems for periods set by those providers or applicable law.

There is no self-service account-wide deletion or data-export function. To request access, correction, a copy, restriction, objection or deletion, or to close an account, contact the controller using the details above. A property report can be downloaded from the service, but it is not a complete account-data export. We may need to verify your identity and may retain information where the law permits or requires it.

Your rights and complaints

Depending on applicable data-protection law, you may have the right to access, correct, erase or restrict personal data, object to certain processing, receive data in a portable format, and complain to your supervisory authority. If processing is based on consent, you may withdraw consent. These rights are subject to legal conditions and exceptions. Contact the controller first if you have a question or concern.

Children

Validum is a business service for accommodation operators and is not intended for children. Do not submit children’s personal data unless it is necessary for a legitimate service purpose and you have authority to do so.

Changes

We may update this policy when the service or our processing changes. The current version is published on this page. Please review it periodically.