Privacy Policy

1. Data controller

The controller of your personal data is:

Controller

[LEGAL NAME] ([LEGAL FORM])

Tax ID (NIF / CIF)

[NIF/CIF]

Address

[REGISTERED OFFICE], Spain

Privacy email

[PRIVACY EMAIL]

Data Protection Officer (DPO)

[DPO EMAIL, if appointed - otherwise state «not appointed»]

2. Scope and applicable law

We process your data in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 of 5 December on the protection of personal data and the guarantee of digital rights (LOPDGDD) and the LSSI-CE as regards electronic communications. This policy explains what data we process, for what purpose and on what legal basis, for how long, with whom we share it, and what rights you have.

3. Categories of data we process

Depending on how you use the Platform, we may process the following categories of data:

Category

Data

Source

Account data

Email address, user identifier, language, country of residence and default tax status, authentication credentials.

The user

Property and analysis data

Address, autonomous community, price, area, calculation assumptions and the results of analyses you create or save.

The user / user-initiated import

Financial inputs

Rents, expenses and financial assumptions you enter to run an analysis.

The user

Documents (document vault)

Files you choose to store in your private, encrypted space.

The user

Payment and billing data

Subscription status and customer identifiers. Payment is processed through Stripe; we do not store full card details.

The user / Stripe

Bank data (later phase)

When bank connectivity is enabled, account and transaction information is obtained, with your consent, through a licensed provider (AISP).

Licensed AISP provider

Usage and analytics data

Minimal product events (pages, actions, language, segment) to measure how the service performs.

Automatic

Communication data

The content of your support enquiries and contact preferences.

The user

4. Purposes and legal bases

Purpose

Legal basis (Art. 6 GDPR)

Providing the service: creating the account, running analyses, saving properties, generating reports and managing the subscription.

Performance of a contract (Art. 6(1)(b))

Handling payment and complying with accounting and tax obligations (including VAT).

Performance of a contract and legal obligation (Art. 6(1)(b) and (c))

Handling support requests and the exercise of rights.

Performance of a contract and legal obligation (Art. 6(1)(b) and (c))

Product analytics to maintain and improve the service, in a privacy-respecting way.

Legitimate interest (Art. 6(1)(f)), after balancing

Sending commercial communications and the newsletter.

Consent (Art. 6(1)(a))

Use of non-essential cookies and similar technologies.

Consent (Art. 6(1)(a)) - see the Cookie Policy

Fraud prevention and Platform security.

Legitimate interest (Art. 6(1)(f))

Where the basis is legitimate interest, we have assessed that it does not override your rights and freedoms; you may ask us for information about that balancing test. Where the basis is consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

5. Retention periods

Data

Retention

Account data and associated content (properties, analyses, documents)

For as long as the account is active; deleted or anonymised after closure, unless a retention obligation applies.

Billing and tax data

For the periods required by commercial and tax law.

Data processed on the basis of consent (marketing)

Until consent is withdrawn or you unsubscribe.

Analytics data

For limited periods and, wherever possible, in aggregated or anonymised form.

6. Recipients: processors and third parties

We do not sell your data. To provide the service we use providers acting as processors on our behalf and under a contract compliant with Art. 28 GDPR. The list of processors and sub-processors is set out in Annex A. We may also disclose data to public authorities where there is a legal obligation to do so.

7. International transfers

The main data infrastructure is hosted in the European Union (Frankfurt region, Germany). Where a provider processes data outside the European Economic Area, we require appropriate safeguards under Chapter V GDPR, in particular the Standard Contractual Clauses approved by the European Commission or an adequacy decision. You may request information about those safeguards.

8. Automated decisions

The Platform's calculations are automated using the data and assumptions you provide, but they produce informational estimates and not a decision producing legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR. You retain control over the decisions you make.

9. Your rights

You may exercise the following rights: access, rectification, erasure («right to be forgotten»), objection, restriction of processing, portability and the right not to be subject to automated individual decision-making. You may also withdraw your consent at any time.

You have the right to lodge a complaint with the competent supervisory authority. The reference authority is the Spanish Data Protection Agency (AEPD) - C/ Jorge Juan, 6, 28001 Madrid - www.aepd.es; you may also contact the authority in your country of residence.

10. How to exercise your rights

You may exercise your rights by writing to [PRIVACY EMAIL], providing proof of identity. Your account also offers export and deletion functions for your data. We will handle your request within the legal time limits (generally one month, extendable in cases of particular complexity).

11. Information security

We apply appropriate technical and organisational measures, including: row-level access control so that each user can access only their own data, encryption of the document vault with short-lived signed links, EU hosting and minimisation of the data collected. No system is infallible, but we work continuously to protect your information.

12. Minors

The Platform is intended for adults. We do not knowingly collect data from minors; if you become aware that a minor has provided us with data, please contact us for its deletion.

13. Data used for market estimates

If you expressly opt in (the "Contribute anonymous data to the market" checkbox on each property, off by default), Yald may use that property’s aggregated, anonymised data (characteristics, reference price and rent) to improve price and rent estimates for the area.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unticking the box; the property stops being used at the next update.

Only aggregated statistics by area, type and size band are published (medians and sample counts). An individual property, address or specific price is never shown or shared.

k-anonymity is applied: cells with fewer than 5 samples are suppressed and never published.

Retention: source data is kept while your account exists and is deleted with it; the aggregated statistics contain no identifiable data.

Estimates are for orientation only and are not a valuation (tasación).

14. Changes to this policy

We may update this Privacy Policy. The version in force is the one published on the Site; if the changes are substantial, we will notify you by appropriate means.

Version [VERSION] - last updated: [DATE].

Annex A - Processors and sub-processors

The following list identifies the main providers that process data on our behalf. It is kept up to date; names marked as pending must be completed before go-live.

Provider

Function

Location / safeguards

Supabase

Database, authentication and storage (document vault).

EU (Frankfurt)

Vercel

Hosting and delivery of the web application.

EU / SCCs where applicable

Stripe

Payment processing and billing.

EU / SCCs

[EMAIL PROVIDER]

Sending transactional emails and, where applicable, the newsletter.

[EU / SCCs]

[ANALYTICS PROVIDER]

Privacy-respecting product analytics.

[EU / cookieless]

[AISP PROVIDER] (later phase)

Bank-account aggregation under its own licence, subject to consent.

[EU / EEA]