Privacy policy

Last updated: 31 August 2026.

Who processes your data

The controller is Housefolio. You can exercise your rights from your account (export or delete).

What data we use

• Account: email, password (hashed by the authentication provider) and the name you give us.
• Shared workspace: members, invitations (including an email if you enter one) and search criteria.
• Listings: imported or hand-created adverts, notes, visits, scores, price history, and agency or private-seller contacts that come from the listing or that you save.
• Minimal technical session data to keep you signed in.

Why, and on what basis

We process this data to provide the service: storing your search, sharing it with people you invite, and letting you import listings. The legal basis is performance of that service (GDPR art. 6.1.b) and, for advertiser contacts and invitations, the legitimate interest of managing a property purchase (art. 6.1.f). By creating an account you accept this policy.

Who it is shared with

You and the people you invite can see the workspace. We do not sell data. Necessary processors do take part in running the service:

• Supabase, for authentication and the database.
• Nominatim / OpenStreetMap, with the listing address only, to place it on the map.
• The host where this Housefolio instance is published.
• Google Ireland Limited (Google Analytics 4), only if you accept analytics cookies. Google may process the data in the United States under the EU-US Data Privacy Framework.

Analytics

If you accept, we measure visits in aggregate (pages, device, referrer and an approximate location). We do not send Google your email, your listings or workspace content. The legal basis is your consent (GDPR art. 6.1.a), which you can withdraw on the cookies page. The Google tag is on the page with consent denied by default; analytics cookies are only stored if you accept.

How long

For as long as the account exists. Invitations expire after 14 days. If you close the account and you are the only person in the workspace, we delete the workspace and the listings. If there are other members, you leave the workspace: your notes and visits stay without your name, and your scores are removed. Technical logs on the server and at the provider may be kept for the usual operations and security period.

Your rights

Access, rectification, erasure, portability, restriction and objection. From your account you can export a JSON of your data and delete the account. You have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Other people's data

If you save an agency or private seller's phone or email, or invite someone with their email, that is also personal data. Use it only for the search and do not share it outside the workspace.