Privacy Policy

In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you that the controller of your personal data is:

We collect the following categories of personal data when you register, browse, or transact on the AIPropHub platform:

We do not collect sensitive special-category data (health, ethnicity, religion) unless you explicitly provide it and consent.

Identity documents: why we ask, who sees them, how long we keep them. A passport or DNI/NIE copy is requested only to formalise a specific transaction: the reservation, the arras contract, or the deed. We share it with the estate agency handling that transaction and with the notary executing it, because those are the parties who need it to prepare the documents; nobody else, and we do not sell or transfer it for any other purpose. Lawful basis: performance of a contract you have asked us to help conclude (GDPR Art. 6(1)(b)). We delete the file automatically 12 months after upload, and you can delete it yourself at any time from your profile. If a confirmed anti-money-laundering duty applies to a specific transaction, the law may require us to keep the evidence longer; where that happens we will tell you.

We process your personal data for the following purposes, each based on a lawful basis under GDPR Article 6:

• ✓

  Property matching

  We use your budget, investment preferences, and location criteria to compute match scores and recommend relevant listings. Lawful basis: contract performance.

• ✓

  Communication

  We send transactional emails (booking confirmations, offer updates, account notifications). We may also send marketing emails with your consent, which you can withdraw at any time. Lawful basis: contract performance / consent.

• ✓

  Legal compliance

  We retain transaction records to comply with Spanish tax law (Law 58/2003, General Tax Law). Lawful basis: legal obligation. We do not currently operate a dedicated anti-money-laundering compliance programme; we do not process your data on that basis.

• ✓

  Platform security & fraud prevention

  We analyse technical data to detect abuse, suspicious activity, and protect the integrity of the marketplace. Lawful basis: legitimate interest.

• ✓

  Product improvement

  We use usage data, which may be linked to your account while you are logged in, to improve our matching algorithms and user experience. This data is pseudonymous, not anonymised; see the processors below. Lawful basis: legitimate interest.

We do not sell your personal data to third parties. We share data with the processors listed in the next section under data processing agreements that require them to protect your data.

We use the following processors to operate the platform. Each receives only the data needed for the purpose stated:

International transfers (GDPR Chapter V). Most of the processors above are US-based and may process your data outside the EU/EEA: Stripe, PostHog, Sentry, Groq, Replicate, Resend, Cloudflare, Expo, Google and MongoDB Atlas. Where a transfer occurs, it relies on the European Commission’s Standard Contractual Clauses, on the EU–US Data Privacy Framework where the recipient is certified under it, or on an adequacy decision. We are still confirming which of these applies to each processor individually, and the hosting region for some of them is not yet fixed on our side; we say so rather than state a basis we have not verified. You can ask us for the current position for any named processor at any time, and this section is updated as each is confirmed.

We use the following automated processes. None of them amounts to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, for the reasons explained below.

• ✓

  Property match score

  We automatically compute a compatibility score from your budget, preferences, and search criteria to recommend listings. It is purely informational: you decide which listings to view, contact, or dismiss.

• ✓

  AI-drafted ROI explanations

  Return-on-investment figures are always computed by deterministic rules in our code, never by an AI model. A language model (Groq) is used only to draft the explanatory text for those already-computed numbers; it does not decide or alter any figure.

• ✓

  Automated negotiation ("Let AI negotiate")

  If you turn this feature on, pricing decisions (offer, counter, withdraw) are computed by a deterministic rules engine within the maximum price you set yourself; an AI model only drafts the wording of each message; it never decides the price. These automated moves never close the deal by themselves: when the engine is ready to accept a price, the platform pauses and asks for your explicit confirmation before creating the deal and charging any commission. No deal is ever closed without that confirmation from you.

If you believe one of these automated tools produced an incorrect result, or you want a human explanation of how it was generated, contact us at privacy@aiprophub.com to request human intervention, express your view, or contest the result.

Under the GDPR, residents of the EU/EEA have the following rights with respect to their personal data:

To exercise any of these rights, contact us at privacy@aiprophub.com. We will respond within 30 days. Identity verification may be required.

We retain personal data only as long as necessary for the purpose it was collected, or as required by law:

Deleting your account deletes your account record and linked personal data (bookings, notifications, offers, saved searches, uploaded photos and identity documents) immediately; there is no recovery window. Any deal in progress with an agency is anonymised rather than deleted, so the agency retains its own record of the deal. The transaction ledger and security audit log rows described above are not deleted by account erasure; the audit log expires on its own 3-year schedule.

For any privacy-related request (access, deletion, portability, or complaint), please contact our Data Protection team:

This Privacy Policy is governed by Spanish law, including:

• Organic Law 3/2018 (LOPDGDD) on the Protection of Personal Data and Guarantee of Digital Rights
• EU Regulation 2016/679 (General Data Protection Regulation, GDPR)
• Law 34/2002 on Information Society Services and Electronic Commerce (LSSI)

Disputes arising from this policy fall under the jurisdiction of the AEPD and, where applicable, the competent courts of Spain.

We reserve the right to update this policy. Material changes will be communicated by email or prominent notice on the platform at least 15 days before taking effect.