Privacy Policy

1. Information We Collect

We collect information you provide directly when registering, publishing a listing, or contacting an agent: name, email, phone number (optional), property photos, and payment data (processed by Stripe — we never store card numbers).

We also automatically collect usage data: IP address, browser type, pages visited, and in-platform actions for security and service improvement purposes.

2. How We Use Your Information

• Operate and improve the platform (search, listings, messages, tours)


• Send transactional notifications (new inquiries, tour confirmations, renewals)


• Prevent fraud and protect platform security


• Comply with applicable legal obligations

We do not sell your personal information to third parties.

3. Information Sharing

We share personal data only with the recipients below, each for the stated purpose. This list names every live recipient; we update it in the same change that adds a new one.

• Stripe (US/IE) — card payments and subscriptions: name, e-mail, billing details, IP at checkout. We never store card numbers.


• PayPal (US/LU) — PayPal payments: name, e-mail, transaction data.


• Google (US) — "Sign in with Google" only (e-mail, name, Google account id); web fonts on some agent-branded pages (your IP at font download).


• OpenAI and Anthropic (US) — optional AI drafting of listing descriptions: listing text only, never your contact details; API mode, not used for training.


• Cloudflare Turnstile (US) — bot check on sign-in and contact forms: IP and browser signals at the moment of the check. We do not use Cloudflare as a CDN or proxy.


• OpenStreetMap Nominatim and Photon (DE) — address geocoding: the address or coordinates you type and your IP.


• CrowdSec (FR) — blocking of malicious IPs: hashed IPs of attackers only.


• Contabo GmbH (DE) — hosting of our servers, database, media storage (self-hosted Garage object store), mail server and error tracking (self-hosted GlitchTip). For these functions no data leaves our own servers.


• Competent authorities — when required by law.

Visitor IP-to-country lookup uses a MaxMind GeoLite2 database on our own server — nothing is sent to MaxMind. Recipients outside the EU/EEA are covered by Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework.

Agent and user contact details are never exposed directly between parties — all communication flows through the platform.

Agents and agencies receive statistics about their own listings (views, saves, inquiries, tours) in aggregate or pseudonymous form — session identifiers are hashed and no visitor name, email, phone number or IP address is disclosed to them.

4. Cookies

We use essential cookies for site operation (session, country preference, consent) and first-party analytics cookies (no third-party transfer). In the EU/EEA, the United Kingdom, Switzerland and Brazil your IP address, browser signature and location are only recorded in our analytics after you opt in via the cookie banner — it never accepts on your behalf, and you can reject everything except essential cookies. Elsewhere the banner accepts after a short countdown unless you choose otherwise. You can change your choice at any time via "Cookie settings" in the page footer.

5. Data Retention

We retain your data while your account is active. When you delete your account it is disabled immediately and your personal data is anonymized or removed after a 15-day grace period during which you can cancel, except where law requires longer retention (e.g., billing records for 5 years). Security exception: sign-in attempt records keep only a one-way hash of the e-mail address (no readable address) for up to 180 days and are deleted after 365 days; we keep them to detect attacks on the credentials of erased accounts.

Abuse-prevention suppression list. When an account is erased — at your request, or by us for abuse or fraud — we keep a salted one-way hash (HMAC-SHA-256 with a secret key held outside the database) of the e-mail address, the phone number and, for real-estate professionals erased for abuse or fraud, the licence number per country, for 365 days. It only lets us recognise the same identity if it tries to register again; it holds no readable data and cannot be reversed without our key. Legal basis: our legitimate interest in preventing abuse (GDPR Art. 6(1)(f)); it is an Art. 17(3)(e) exception and is therefore not erased with the account. Entries expire automatically after 365 days; a wrongly listed identity can be lifted through the account appeal form. Chargeback-related entries are kept separately for payment-dispute defence.

Permanent market records. When a property is listed publicly, its listing facts (asking price, price changes, dates on/off market, property type, size, and approximate location) become part of a permanent, anonymized market record — the same model used by major international portals. This record survives unlisting, listing removal, and account deletion, and powers price-history graphs and market statistics. It contains no name, contact detail, or other personal data. Photos and free-text descriptions are NOT part of the market record and are permanently deleted when you clear a listing or erase your account.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the data we hold about you


• Request correction or deletion


• Object to processing or request portability

To exercise these rights, write to us at privacy@prix.casa (data subject requests under GDPR / LGPD / Costa Rica Ley 8968) or contact@prix.casa for any other matter.

7. Security

We use HTTPS throughout the site, encryption at rest for sensitive documents, HttpOnly tokens for authentication, and CrowdSec for malicious IP blocking. No system is 100% secure — we will notify you of any breach affecting your data.

8. Changes to This Policy

When we update this policy, we will post the new version here and, if changes are significant, notify you by email.