Privacy Policy

Captemos ("we," "our," or "us") operates a luxury real estate management platform serving leasing advisors and property professionals in Marbella, Spain. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Spanish data protection laws.

This policy explains what data we collect, why we collect it, how we use it, and what rights you have over your information.

1. Data We Collect

We collect personal data that you provide directly and data generated through your use of our platform:

• Identity & Contact Information — name, email address, phone number, and professional details you provide during registration or correspondence.
• Property Data — property listings, descriptions, images, pricing, and availability details entered into the platform.
• Lead & Tenant Information — prospect names, contact details, budget preferences, location preferences, and search criteria.
• Communication Data — messages exchanged via WhatsApp Business integration, including conversation history used for lead management and follow-ups.
• Usage Data — how you interact with the platform, including pages visited, features used, and device information.

2. How We Use Your Data

We process your personal data for the following purposes:

• Service Delivery — managing property portfolios, matching tenants with properties, and facilitating leasing workflows.
• Communication — sending property updates, follow-up reminders, and notifications through WhatsApp and email.
• AI-Powered Features — generating property descriptions, lead insights, qualification scores, and suggested responses using artificial intelligence.
• Analytics & Improvement — understanding platform usage to improve features, performance, and user experience.
• Legal Compliance — fulfilling legal obligations and responding to lawful requests from authorities.

Legal bases for processing: contract performance (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR), and consent (Art. 6(1)(a) GDPR) where applicable.

3. Third-Party Services

We share data with trusted third-party providers who help us operate the platform. We do not sell your personal data to any third party.

All third-party providers are bound by data processing agreements and are required to handle your data in accordance with GDPR.

4. Data Storage & Security

Your data is stored on secure servers provided by Supabase (PostgreSQL) and Vercel, with infrastructure located in the European Union where possible. We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Role-based access controls and authentication via Supabase Auth.
• Regular review of access permissions and security practices.
• Communication records retained for up to 2 years; account data retained for the duration of your use of the service.

5. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights regarding your personal data:

• Right of Access — request a copy of the personal data we hold about you.
• Right to Rectification — request correction of inaccurate or incomplete data.
• Right to Erasure — request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.
• Right to Restrict Processing — request that we limit how we use your data in certain circumstances.
• Right to Data Portability — receive your data in a structured, machine-readable format.
• Right to Object — object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@captemos.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

6. Cookies

Captemos uses only essential cookies required for the platform to function. We do not use tracking, advertising, or third-party analytics cookies.

Because we use only strictly necessary cookies, no cookie consent banner is required under GDPR. No personal data is shared with advertisers or analytics providers through cookies.

7. Contact Us

For any questions about this Privacy Policy or to exercise your data protection rights, please contact us:

8. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or through the platform.