Privacy Policy

Propelos Technology S.L. (“Propelos”, “we”, “us”, “our”) is a Spanish limited company with its registered office at The Pool Marbella, El Corte Inglés El Capricho, 1 planta Avda. Bulevar Príncipe Alfonso de Hohenlohe 2, Marbella, 29602, Spain. We operate the website propelos.com and provide AI property search technology to real estate agencies. For the personal data described in this policy, we are the controller.

If you have questions about this policy or how we handle your data, contact us at: privacy@propelos.com

When you use the AI Property Finder on an estate agency’s website or on its hosted search page, or send the agency an enquiry through it, the agency decides how your data is used: it is the controller, and Propelos processes the data on its behalf, as its processor, under our Data Processing Agreement. Please read that agency’s privacy policy and contact the agency to exercise your rights. If you contact us instead, we will pass your request to the agency.

The rest of this policy covers the data Propelos is responsible for: visitors to propelos.com, people who contact us or request an AI Visibility audit, and the people who use our customers’ accounts.

When you use our contact or demo request form:

• Full name
• Email address
• Agency name
• Website URL (optional)
• Phone number (optional)
• Message content (optional)

When you request a free AI Visibility audit:

• Your agency’s website and name, and the area you sell in
• The competitors and specialisms you enter (optional)
• Your email address, to receive the report (optional)

When you create and use a customer account:

• Work email address and password (we store only a bcrypt hash of the password)
• Agency name, website, country and language
• Whether you want product news (optional)
• The users you invite, your settings and branding, your listing sources, and your plan and billing status
• Login sessions

When you pay: you enter your card details on a checkout page run by Stripe, our payment provider. We never see or store your card number. Stripe tells us whether a payment succeeded and gives us your invoices. Stripe collects your billing address and, if you give it, your VAT number, for tax and invoicing.

When you sign up or reset your password: Cloudflare Turnstile checks that the request comes from a person and not an automated program. To do this it processes your IP address and technical information about your browser and device.

If you connect Google Search Console (optional, for AI Visibility customers): you can connect your own Google Search Console property to your AI Visibility account, so that we can show its search performance in the AI Visibility portal. You approve the connection on Google’s own consent page and give us read-only access (the webmasters.readonly permission); we cannot change anything in your Search Console. For the property you name, we request your search performance data from Google day by day: the search queries, pages, countries and device types, with the clicks, impressions and average position for each. We store the property address you entered, the access and refresh tokens Google gives us, the permissions you granted and the search data we read. The tokens are stored encrypted with AES-256-GCM and are never kept in the clear. To end the connection, remove Propelos’s access in your Google Account settings: our tokens then stop working. You can also ask us to delete the stored connection and the search data we hold by writing to privacy@propelos.com.

When you use our demo property search tool:

• Search queries you enter
• Interactions with search results

Automatically when you visit our website:

• IP address
• Browser type and version
• Device type
• Pages visited and time spent
• Referring website
• Cookies and similar technologies (see section 6)

• To answer your enquiry or audit request and follow up about our services: our legitimate interest in responding to business enquiries, and steps you ask for before a contract (Article 6(1)(f) and 6(1)(b) GDPR).
• To create and run your account, provide the Services and bill your business: performance of our contract with your business, and our legitimate interest in providing it to the people who use your account (Article 6(1)(b) and 6(1)(f)).
• To send you service emails (verification, trial, payment and listing notices): performance of the contract.
• To keep the website and the Services secure and prevent fraud and abuse, including the Turnstile check and rate limits: our legitimate interest (Article 6(1)(f)).
• To keep invoices and accounting records: legal obligation (Article 6(1)(c)).
• To send you product news: your consent, which you can withdraw at any time with the unsubscribe link or by writing to us (Article 6(1)(a)).
• Analytics and advertising measurement cookies: your consent (Article 6(1)(a)); see section 6.
• To improve our website and products using usage statistics: our legitimate interest (Article 6(1)(f)).

We do not sell your personal data.

• Contact, demo and audit requests: up to 24 months after our last contact with you, unless you ask us to delete them sooner.
• Account data: while your account is open. When your subscription ends, we keep it for 90 days so that you can restart, and then delete it.
• Signup requests that are never confirmed are deleted after 7 days, and password reset links expire after 1 hour.
• Invoices and accounting records: for the periods Spanish tax and commercial law require, currently up to six years.
• Analytics data: kept in anonymised or aggregated form.
• Demo search queries: not linked to your identity and kept in anonymised form to improve the product.

Essential: needed for the website and your account to work, and used without asking: the login session for your account (kept in your browser’s local storage and in a cookie named partnerSession), and the record of your cookie choice.

Analytics and advertising measurement: we use Google Tag Manager to load Google Analytics and, when we run advertising campaigns, Google Ads measurement. These are used only if you accept them in our cookie banner. Until you do, we tell Google’s tags that consent is denied, using Google Consent Mode, so they do not store or read analytics or advertising cookies on your device.

Your choice is kept in your browser for 12 months, after which we ask again. To change it sooner, clear this website’s data in your browser settings and reload the page: the banner will ask you again.

These tags never load inside the Finder widgets that agencies place on their own websites.

We use the following service providers, who process personal data on our behalf under contracts that require them to protect it. Where they act as sub-processors for the agencies we serve, the same providers are listed in our Data Processing Agreement.

• Replit (United States): hosts the application on Google Cloud and relays our requests to OpenAI and OpenRouter
• Neon (United States): runs our database, provided through Replit on Amazon Web Services (us-east-1)
• OpenAI (United States): AI models that understand searches, write answers and enquiry summaries, transcribe voice input and look up places a buyer mentions; also used for AI Visibility reports
• OpenRouter (United States): routes some AI requests to Google’s Gemini models and to TypeSafe AI’s Jev model
• Google (United States): Gemini AI models, reached through OpenRouter (and directly for AI Visibility reports), and Google Maps Platform, which receives only the name of a place a buyer mentions
• TypeSafe AI (United States): the Jev AI model, reached through OpenRouter, which ranks and classifies search results
• Resend (United States): sends our emails, including account emails and enquiry notifications to agencies
• Sentry (Germany, EU): error monitoring; contact details and message content are filtered out before an error report is sent
• Stripe (Ireland and United States): payments, subscriptions, invoices and tax calculation; card details are entered on Stripe’s page and never reach us
• Cloudflare (United States): Turnstile, which checks that a signup or a password reset comes from a person
• Google Tag Manager (United States): loads our analytics and advertising measurement tags on our marketing website, only as your cookie choice allows
• Google Analytics (United States): measures visits to our marketing website and, when we run campaigns, the results of our Google Ads; only with your consent
• Google Search Console (United States): only if an AI Visibility customer chooses to connect its own property: read-only access to that website’s search performance data, shown in the AI Visibility portal
• Anthropic (United States): an AI model used for AI Visibility reports; it receives questions about property markets and agencies, never contact details
• DataForSEO: collects the answers AI assistants and Google give to questions about property markets and agencies, for AI Visibility reports; it never receives contact details

We may also disclose data when the law requires it, or to protect our rights. We do not sell personal data.

Some of these providers process data outside the European Economic Area, mainly in the United States: our database and our application hosting are in the United States. We transfer data only with a safeguard recognised by the GDPR: the Standard Contractual Clauses adopted by the European Commission or, where the provider is certified, the EU-US Data Privacy Framework. You can ask us for a copy of these safeguards at privacy@propelos.com.

Under the GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (“right to be forgotten”).
• Restriction: Request that we limit how we use your data.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to our processing of your data based on legitimate interest.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at: privacy@propelos.com

We will respond to your request within one month. If your data reached us through an agency’s Property Finder, see section 2.

If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or your local supervisory authority.

We protect your data with technical and organisational measures, including encryption in transit (HTTPS, and encrypted connections to our database), password hashing, encrypted storage of the credentials you give us for your CRM, access control and rate limits. No method of transmission over the internet is 100% secure, however, and we cannot guarantee absolute security.

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If you have an account and a change affects you significantly, we will also tell you by email. We encourage you to review this policy periodically.

For any questions or requests regarding this Privacy Policy or your personal data:

Email: privacy@propelos.com

Company: Propelos Technology S.L.

Tax ID (NIF): B27624980

Registered in the Mercantile Registry of Málaga, sheet MA-197845 (electronic volume and folio), IRUS 1000471597682

Address: The Pool Marbella, El Corte Inglés El Capricho, 1 planta Avda. Bulevar Príncipe Alfonso de Hohenlohe 2, Marbella, 29602, Spain