ProtokeyProtokey Privacy Policy
Last Updated: October 26, 2026
Qubin GmbH ("we", "our" or "us") provides the Protokey mobile application ("App") for handover reports and key registers. This Privacy Policy explains which personal data we process when you use the App or one of its web pages (signing link, key finder page), and for what purpose.
1. Who is responsible
For your account and the operation of the App, Qubin GmbH is the controller. The data that a landlord, property manager or other business ("Business") records about tenants, key holders and other parties in the App is processed by us on behalf of that Business: the Business decides what is recorded and why, and is the controller for it. If you are a tenant or key holder and have questions about a report or a key receipt, please contact the Business first.
2. Data we process
2.1 Account and business profile
- Name, email address, sign-in method (email, Google or Apple), profile photo if you add one
- Business details you enter for documents: company name, address, contact details, logo
- Team members you invite, their role and the times they were invited or joined
2.2 Properties, keys and handover reports
- Properties and units: names, addresses, notes
- Key register: label, number, type and storage place of each key; the holder's name, email address and phone number; dates of issue, transfer and return, due dates; the holder's signature (as drawn strokes); receipts as PDF
- Handover reports: type and date of the handover; the parties (name, role, email address, phone number, optionally a new address); rooms, items and their condition; notes and agreements; meter readings; photos; keys handed over or returned; signatures (as drawn strokes) with name and time, or the note that a party was not present; the finished report as PDF with its number and a checksum
- Photos: taken in the App or selected from your library for a report. Photos can show people or personal belongings; please take only the photos the report needs.
2.3 Signing link and emails
If the Business sends a report for signature by link, we store the link token, its expiry date (14 days) and the time of opening, signing or objecting. The signing page shows the report summary and stores the signature or the objection with its text. Finished reports and key receipts are sent by email to the parties whose email address was entered.
2.4 Key finder page
A QR label links to a public page (protokey.app/k/…). It shows no data about the key, the property or the Business. If a finder sends a message, we store the message, the optional contact details the finder enters and the time, and forward them to the Business. Messages are limited per label and day to prevent abuse.
2.5 Collected automatically
- Device information (model, operating system, app version), crash reports and error logs
- Usage data (features used, screens opened), only with your consent where required
- Push notification token, if you allow notifications
The App does not use your location for its features and does not show advertising.
3. Purposes and legal bases
- Providing the App, your account and the documents you create: performance of the contract (Art. 6(1)(b) GDPR)
- Processing of report and key data on behalf of the Business: Art. 28 GDPR; the Business relies on its own legal basis, usually the performance of the rental or service contract
- Sending reports, receipts and reminders by email or push: performance of the contract
- Security, abuse prevention and crash analysis: legitimate interests (Art. 6(1)(f) GDPR)
- Analytics: consent where required (Art. 6(1)(a) GDPR)
- Keeping invoices and accounting records: legal obligation (Art. 6(1)(c) GDPR)
4. Service providers
| Service | Purpose |
|---|---|
| Firebase / Google Cloud (data centres in the EU) | Sign-in, database, file storage, server functions, push notifications, crash reports, analytics |
| Resend | Sending emails (reports, key receipts, signing links, reminders) |
| RevenueCat | Managing in-app purchases and subscriptions |
| Apple App Store / Google Play | Payment of purchases and subscriptions |
| Apple Sign-In / Google Sign-In | Sign-in, if you choose it |
Our service providers process data only on our instructions. Where data is transferred outside the EU/EEA, we rely on adequacy decisions or Standard Contractual Clauses.
5. Who can see the data
- Properties, keys and reports are visible only to the Business and the team members whose role allows it.
- Parties of a report receive the finished PDF by email; a party signing by link sees the report summary on the signing page.
- Key holders receive their receipt by email.
- Nothing is published or shown to other users of the App.
6. Retention
- Handover reports and key records are kept as long as the Business keeps them in the App; by default we suggest deleting reports three years after the move-out (typical limitation period).
- A finished report cannot be changed, only deleted by the Business.
- Signing links expire after 14 days.
- When you delete your account, we delete your account, your properties, keys, reports, photos and files within 30 days. Invoices and other records we must keep by law are retained for up to 10 years. The other parties keep the PDFs they received by email.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent at any time. You can delete your account in the App settings. Tenants and key holders can exercise their rights towards the Business; we support the Business in doing so. You also have the right to lodge a complaint with a data protection supervisory authority.
8. Security
Data is encrypted in transit and at rest. Access is restricted by sign-in and by team roles. Finished reports carry a checksum so that later changes can be detected.
9. Children
The App is intended for businesses and adults. It is not directed at children under 16.
10. Changes
We may update this Privacy Policy. We will inform you about material changes in the App or by email.
11. Contact
Qubin GmbH
Email: privacy@qubin.de
Support: support@qubin.de
Website: qubin.de
Data Protection Officer: dpo@qubin.de