New: paste a tenant email and watch Colively handle it in 60 seconds. No account needed.Try the demo →
Colively
FRENNL
Demo
Security & data

Tenants and co-owners write to you in confidence. Here is exactly what we do with their messages.

Not a compliance page written for lawyers: who reads what, where it is stored, and what will never leave Europe.

Scope

What Colively reads. And what it doesn't.

Colively does not plug into your office mailbox or phone. Your organisation gets a dedicated email address, and we only read what arrives there: report emails (tenants, owners, residents), their photos, contractors' PDF quotes and invoices, and WhatsApp exchanges with the contractors who prefer it.

Your other emails, your contracts, your accounting, your exchanges with landlords: we simply have no access to them.

Artificial intelligence

European AI, end to end.

Report emails and PDF quotes and invoices are read by Mistral, an open source AI model, running on Scaleway, a French cloud provider, in a Paris datacenter.

In practice

Hosted and processed in the European Union.

AI processing happens in France, not on an American cloud. The application and your case files are also hosted at Scaleway.

Your messages never train a model.

Scaleway contractually commits to never collecting, reading, or reusing the content processed by its APIs. And we don't use them to train anything either.

An open model, not a black box.

Mistral is an open source model: how it works is publicly documented, and we don't depend on the shifting terms of a tech giant.

Human validation

AI proposes. You decide.

AI reads, structures, and prepares the case. It never contacts a contractor, never approves a quote, never decides on insurance coverage and never commits your office without a manager having clicked.
No automated decision produces legal effects for your tenants or co-owners (Article 22 GDPR). And every case keeps a full audit trail: who approved what, when, based on which message.
Hosting

Hosting and sub-processors.

Application and data hosted at Scaleway, in the European Union.
All our sub-processors are established in the EU or provide adequate safeguards under GDPR. No transfer outside the EU/EEA without appropriate safeguards.
Our analytics tools (Plausible for the website, PostHog for the application) are self-hosted on our Scaleway servers. No visit or usage data goes to any third party.
Data encrypted in transit (TLS) and at rest on Scaleway volumes and object storage.
A dedicated security contact: hello@colively.app. Every reported vulnerability gets a reply within 2 working days.
If an incident affects your data, you are notified within 72 hours, with the scope and the measures taken.
GDPR

Your obligations as a manager, covered.

You are the data controller for the data of your tenants, owners, occupants and co-ownership council members. Colively acts as a processor, and we equip you to keep it simple:

DPA (data processing agreement, Art. 28 GDPR) ready to sign on request.
A ready-to-copy description for your record of processing activities.
A standard information paragraph to include in your communications to residents.
Controlled retention: case data is kept for the duration of the contract, then 5 years (legal obligations), and deleted on request at termination.
Individuals' rights: access, rectification, erasure, portability, objection. One request to privacy@colively.app, answered within 30 days.

Supervisory authority: Data Protection Authority (APD), Belgium.

Sub-processors

Who touches your data, and what for.

The full list of our sub-processors. It is kept up to date here and any change is notified to you 30 days in advance, as set out in the DPA.

Sub-processorRoleLocation
ScalewayApplication hosting, database, attachment storage, AI API (Mistral)Scaleway SAS, France, Paris data centres (EU)
LettermintSending and receiving email on the dedicated addressLettermint B.V., Netherlands (EU)
InfobipSending and receiving WhatsApp messagesInfobip Ltd, United Kingdom (EU adequacy decision). Messages stored and processed in its EU/EEA data centres.
MapTilerMap tiles loaded by the manager's browser: IP address and viewed area sent, no case contentMapTiler AG, Switzerland (EU adequacy decision)

Last updated: 21 September 2026

Our commitments

Three simple promises.

Your data is hosted and processed in the EU/EEA.

AI processing included. No transfer outside the EU without an adequacy decision or appropriate safeguards.

Your messages will never train an AI model.

Not ours, not a third party's.

No action towards a resident or a contractor without human validation.

Frequently asked questions about security and data

No. Your organisation has a dedicated email address and we only process the messages that arrive there (or that you forward to us). Your office mailbox and phone stay yours.
Ready to stop chasing contractors?

Try it on your own requests. Free, no credit card.

Forward a real email from a tenant or co-owner and watch what it becomes. Your first cases are on us: judge the result before you pay.

Try it free →Talk to a human
Try it with a real tenant emailNo account, 60 seconds