Privacy Notice
Effective 2026-10-15 · Download a copy
Who provides the service
HopHop Casa is operated by IngenLogics, Truus van Lierpad, 2331GL Leiden - NL. KvK: 93563450. VAT ID: NL866450993B01. Contact: business@ingenlogics.com.
Data we use and why
| Data | Purpose and GDPR basis |
|---|---|
| Email, password hash, verification status, account profile, device name and connection configuration | Registration, sign-in and delivery of your remote-access service: performance of our contract or steps you request before a contract (Article 6(1)(b)). |
| Billing name and address, company, country, VAT/KvK details, payments and invoices | Collecting subscriptions: contract. Keeping required tax and accounting records: legal obligation (Article 6(1)(c)). Card or bank details are entered with Mollie; our app keeps payment references and status. |
| IP addresses, connection timestamps, login attempts and administration/security events | Preventing fraud, investigating abuse and securing the service: our legitimate interests (Article 6(1)(f)), with limited retention and access. Email codes are used to protect administrator sign-ins. |
| Support correspondence and information you choose to send | Answering service and rights requests: contract, legitimate interests or applicable legal obligations depending on the request. |
Name and billing address are needed for proper invoices. Company, VAT, KvK and phone fields are optional unless relevant to your business invoice. Do not provide a BSN. An account email and device configuration are necessary to supply remote access; without them we cannot provide the service. We do not sell personal data, send marketing through this app, profile you for advertising or make decisions with legal effects solely by automated processing.
Remote-access traffic
Your public connection uses HTTPS. HopHop Casa terminates public HTTPS and forwards HTTP/WebSocket traffic through an encrypted tunnel to your Home Assistant client. The service operator can technically access traffic at the server. Our service policy prohibits inspecting household traffic except when strictly necessary, lawfully authorised and limited to resolving a security or service incident. The application does not intentionally store forwarded request or response bodies. Your Home Assistant instance controls its own login and local data.
Recipients, providers and international transfers
Only authorised personnel may access account data for support, security and administration. Invoices may be supplied to our accountant or public authorities where required. Our infrastructure and email providers process the data necessary for their services under applicable agreements. Mollie processes payments under its own privacy notice.
- Hosting and infrastructure
- The application database and service backups are stored on our Contabo server in Germany. Transactional email delivery through Namecheap Private Email may involve processing email addresses, message content and delivery metadata outside the European Economic Area, including in the United States. Namecheap's Data Processing Addendum provides for European Commission Standard Contractual Clauses for applicable international transfers. Information about these safeguards is available from Namecheap's published Data Processing Addendum and may also be requested through our privacy contact.
- Transactional email
- Transactional emails are sent through Namecheap Private Email. This includes account verification, password resets, administrator security codes and service notifications. Email processing involves recipients' email addresses and message content.
- Other recipients and transfers outside the EEA
- The application database and service backups are stored on our Contabo server in Germany. Transactional email delivery through Namecheap Private Email may involve processing email addresses, message content and delivery metadata outside the European Economic Area, including in the United States. Namecheap's Data Processing Addendum provides for European Commission Standard Contractual Clauses for applicable international transfers. Information about these safeguards is available from Namecheap's published Data Processing Addendum and may also be requested through our privacy contact.
Any transfer outside the EEA requires an applicable GDPR safeguard, such as an adequacy decision or approved standard contractual clauses with any necessary additional measures. Contact us for information about the safeguards that apply to your data.
How long we keep data
Operational account and device information is kept while your account is active. Unverified registrations without devices, subscriptions or financial records are removed after seven days. Removing an account revokes its credentials and devices, removes its operational profile and starts retention-limited handling of financial information. Dutch basic accounting records are retained for at least seven years after the financial year; OSS records require ten years. Our configured financial period is 7 years after the relevant year. Legal holds can extend this where needed for a specific legal obligation or dispute. Restricting an account is different from deleting it.
Application login, device-connection and audit records in our database are kept for 30 days. Administrator email challenges are removed after one day, codes expire after 10 minutes and expired verification/reset links are removed by maintenance. Registration terms evidence is kept while the account exists; evidence related to billing is restricted with the financial archive after deletion. Managed deployment backups expire after 30 days. Restored backups must have deletion and retention controls reapplied before the site is reopened. Container diagnostic logs are size-rotated and handled under the operator’s documented retention schedule. External/provider backups and support records are subject to the provider details and documented operator retention schedule.
Your rights and how to exercise them
You can request access, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. Download an account-data copy from Account. Contact business@ingenlogics.com for other requests, including deletion or a human-readable copy. We normally respond within one month; where the GDPR permits an extension, we will explain it within that month. We may ask for proportionate identity verification. Erasure does not override required tax retention or justified legal claims: we explain what remains, why and until when, and restrict its use.
You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local EEA supervisory authority. Where we rely on consent for a future optional feature, you can withdraw it without affecting earlier lawful processing. This app currently has no optional tracking or marketing consent.
Security, cookies and changes
We use encrypted connections, password hashing, access controls and mandatory email verification for administrator sign-ins. No system can guarantee absolute security. Read the Cookie Notice for the essential cookies used. Material changes to this notice will be announced on the site or by email where appropriate; its effective date appears above.