1. Who this policy covers
This Privacy Policy explains how Shy Core handles personal data when you visit the website, create or use an account, contact support, submit an issue report, or otherwise interact with the service.
For account administration, billing, website, and support data, Shy Core generally acts as a data controller. For property, tenant, and issue information processed for a landlord, property manager, or organisation, Shy Core may act as a processor on that customer’s instructions. The customer remains responsible for its own lawful basis, notices, and decisions about that data.
2. Personal data we may collect
- Account data: name, email address, organisation, role, authentication and account settings.
- Billing data: plan, invoices, transaction status, billing contact details, and limited payment metadata. Full card details are normally handled by the payment provider.
- Property and issue data: property details, tenant or reporter contact details, issue descriptions, urgency, access availability, notes, photographs, videos, status, assignments, contractor details, and activity history.
- Support data: contact-form messages, emails, attachments, and troubleshooting information.
- Technical data: IP address, device and browser information, logs, security events, timestamps, and cookie or local-storage information.
3. Where the data comes from
We receive data directly from account holders, team users, tenants or other reporters, invited contractors, payment and authentication providers, integrations selected by customers, and automatically from devices when the website or service is used.
4. Why we use personal data
- To create and administer accounts and organisations.
- To receive, organise, assign, track, resolve, and retain property issue reports.
- To send service, security, issue-status, appointment, billing, and support communications.
- To process subscriptions and prevent fraud or abuse.
- To secure, troubleshoot, analyse, and improve the service.
- To comply with law, enforce agreements, and protect users and third parties.
5. Legal bases
Depending on the activity, we rely on performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests such as operating and securing the service, and consent where the law requires it—for example, for certain cookies or optional marketing.
Where Shy Core acts as a processor, the customer determines the applicable legal basis for the underlying property and tenant processing.
6. Who data may be shared with
We may share personal data only as needed with authorised customer users; service providers for hosting, security, email, support, analytics, storage, and payments; contractors or marketplace services chosen by the customer; professional advisers; and public authorities where legally required.
We do not sell personal data. Third parties may only use data for their own independent purposes where you or the customer choose to use their service, or where the law permits it.
7. International transfers
Some service providers may process data outside Ireland or the European Economic Area. Where required, appropriate safeguards are used, such as an adequacy decision or approved contractual protections, together with relevant technical and organisational measures.
8. How long data is kept
We retain personal data only for as long as reasonably necessary for the purpose collected, including account operation, issue history, support, security, tax, accounting, legal claims, and regulatory obligations.
Specific retention depends on the plan, customer instructions, the type of record, and applicable law. Deleted data may remain temporarily in backups until overwritten under the backup cycle.
9. Your data-protection rights
Subject to applicable law, you may have rights to access, correct, erase, restrict, object to, or receive a portable copy of personal data, and to withdraw consent without affecting earlier lawful processing.
If Shy Core processes your property or tenant data for one of our customers, contact that customer first because it controls the record. We will support valid requests as required. You may also lodge a complaint with the Irish Data Protection Commission or your local supervisory authority.
10. Security
We use reasonable technical and organisational safeguards designed to protect personal data, including access controls, secure transport, monitoring, and data-minimisation practices. No internet service can promise absolute security, so users must also protect passwords, devices, and account access.
11. Children
Shy Core is intended for property professionals, authorised team users, contractors, and people reporting property issues. It is not directed to children. Do not submit a child’s personal data unless it is necessary, lawful, and appropriately protected.
12. Contact and updates
Privacy questions and rights requests can be sent to support@shycore.com. We may ask for information needed to verify identity and protect other people’s data.
We may update this policy as the service and legal requirements change. The “Last updated” date at the top shows the latest version.