Privacy Policy

EstateAL — operated from Ljubljana, Slovenia. Contact for any data question: hello@estateal.eu.

EstateAL is currently operated by a natural person, not yet a registered company. When a company is registered, this section will be updated with its full details.

When you simply browse: the page path, your language, and the referring website's host name (for example "google.com"). We do not store your IP address, the full URL, or query strings for this purpose. We also record coarse engagement with listings — that a card was opened, a listing page or gallery viewed, a location explored, a listing favourited, an enquiry or viewing started — so we can see which properties are genuinely useful. A random anonymous identifier is kept in your browser's local storage to count visitors and to hold your advisor conversation together; it contains no personal details.

When you give us something: your email and any details you submit when you create an account, send a property enquiry, book a viewing, subscribe to new-listing alerts or a newsletter, or contact us. Depending on the form this may include your name, phone number, and what you are looking for.

If you are a partner: your business profile, the listing materials and ownership or authorisation documents you submit, and a record of your acceptance of our partner rules — which includes the version accepted, the date and time, your IP address and browser identification, kept as evidence of that acceptance.

The AI Advisor is a chat assistant built on a large language model. When you use it we process what you type and the content of the conversation, a session identifier that holds the conversation together, and context such as the page or property you are viewing. From the conversation we derive a coarse profile of what you are looking for — budget range, regions, type of property, intent — so the advisor can be useful rather than generic.

Your conversation is stored so the advisor can continue where you left off on a later visit. Before anything is written, an automatic filter strips out high-sensitivity details, and only the most recent part of the conversation is retained. Conversation data is deleted automatically after 90 days.

To run the advisor we use an external provider of AI models. Your messages are sent to that provider to generate a reply. We have a data-processing agreement in place and, where data leaves the European Economic Area, appropriate safeguards (see section 6).

Using the advisor is entirely voluntary. Please do not enter other people's personal data, health information, financial account details or other sensitive information into the chat — describe your situation in general terms instead.

To operate the site and keep it secure — legitimate interest (Art. 6(1)(f) GDPR).

To answer your enquiry and route it to the relevant verified partner — steps taken at your request / performance of a contract (Art. 6(1)(b)).

To run your account and the partner cabinet — performance of a contract (Art. 6(1)(b)).

To send the alerts or newsletter you asked for — your consent (Art. 6(1)(a)), given by double opt-in and withdrawable at any time; every email carries an unsubscribe link.

To provide the AI Advisor and remember your conversation — steps taken at your request (Art. 6(1)(b)) and, for retention between visits, your consent where asked.

To understand which listings and pages are useful, in aggregate — legitimate interest (Art. 6(1)(f)).

To keep a record that a partner accepted our rules — legitimate interest in being able to evidence that acceptance (Art. 6(1)(f)).

We do not sell personal data and we do not share it for advertising. Your data is shared only in these ways:

The verified partner handling your request. When you send an enquiry or book a viewing, the content of that request and your contact details go to the specific partner responsible for that property — and to no one else. Partners never see other partners' enquiries, and buyer data is never passed between partners.

Service providers acting on our instructions, each under a data-processing agreement: Supabase (database and authentication, hosted in Ireland), Vercel (website hosting and privacy-friendly, cookieless traffic measurement), Anthropic (the AI model behind the Advisor), Resend (sending our emails), Mapbox (maps).

Authorities, where we are legally required to disclose data or need to establish or defend a legal claim.

Some of the providers above process data outside the EEA. Where the European Commission has not adopted an adequacy decision for the country concerned, the transfer is covered by appropriate safeguards — in practice the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified under it. You may ask us for details of the safeguards used for a specific provider.

Advisor conversations — 90 days, then deleted automatically.

Page views and listing engagement events — 14 months, after which only aggregate figures remain.

Enquiries, viewing requests and related correspondence — for as long as the matter is live, and then up to 3 years, so we can deal with questions or claims arising from it.

Account data — until you delete your account or ask us to delete it.

Alerts and newsletter — until you unsubscribe.

Partner data — for the duration of the partnership. Records of accepting our partner rules are kept as evidence of that acceptance, and survive the end of the partnership.

We take appropriate technical and organisational measures to protect your data. Traffic to and from the site is encrypted with HTTPS/TLS. Your data is stored with a hosted database provider in the European Union (Ireland) behind row-level access controls, so each record is reachable only by those entitled to it. Administrative and database access is restricted, and sensitive keys are held on the server side only. The site applies modern security headers, including a Content-Security-Policy and HTTP Strict Transport Security.

No online service can be guaranteed perfectly secure, but if a breach affecting your rights occurs we will notify you and the competent supervisory authority as required by law.

You may ask for access to your data, correction, deletion, restriction of processing, and portability. You may object to processing based on our legitimate interest. Where processing rests on consent, you may withdraw it at any time — withdrawal does not affect what was lawful before it.

To exercise any of these, email hello@estateal.eu. We answer within one month. You also have the right to complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec) or to the supervisory authority where you live.

We use only what is needed to run the site — your sign-in session and your language preference — plus the anonymous visitor identifier described in section 2. We use no advertising cookies, marketing pixels or third-party cross-site trackers. Details, including what is stored and for how long, are in our Cookie Policy.

EstateAL is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, write to hello@estateal.eu and we will delete it.

We update this policy as the service develops; the version and date above always reflect the current text. If a change materially affects how we use your data, we will say so clearly rather than quietly amending the page.