Privacy Policy
How InmoMatch IA processes your personal data under the GDPR and Spanish data-protection law: controller, purposes, legal bases, recipients, retention and rights.
Last updated: 29/10/2026
1. Data controller
Owner: InmoMatch IA.
Email: info@inmomatch-ia.com.
Website: https://www.inmomatch-ia.com.
For any question about your personal data you can write to info@inmomatch-ia.com.
2. What data we process
- Account: name or company, email address, password (stored only as an irreversible encrypted hash), plan, sign-up date and temporary verification codes.
- Payments: charges are processed by Stripe. We only receive the customer and subscription identifiers, the amount, the date and the payment status; we never see or store your card details.
- Alerts: email address, province, asset type, maximum budget and confirmation status.
- Enquiries: name, email, reason and text of the message you send us.
- Property listings: cadastral reference, price and the contact detail you provide when publishing.
- Technical data: IP address (to limit abusive requests and protect the service), the technical session cookie and your cookie preferences.
- Analytics (only if you accept it): Google Analytics cookie identifiers, page views and usage events (for example choosing a plan, downloading a dossier, creating an alert or starting a payment).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account and providing the contracted service | Performance of a contract (Art. 6(1)(b)) |
| Charging licences and invoicing | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Sending the auction alerts you request | Consent with double opt-in (Art. 6(1)(a)), withdrawable in one click |
| Answering your enquiries | Your request and pre-contractual steps (Art. 6(1)(b)) |
| Security and prevention of fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
| Audience measurement with Google Analytics 4 | Consent (Art. 6(1)(a) and Art. 22.2 of the Spanish e-commerce law, LSSI-CE) |
| Showing official auction notices that may contain data about debtors | Legitimate interest in reporting on public auctions and reuse of public-sector information (Law 37/2007) |
Auction notices are published by public administrations and courts in the BOE. We show them as published, only while the auction is active, and remove them when it ends. If you appear in one you can object by writing to us.
The affinity score only sorts search results; no automated decisions with legal effects on you are taken.
4. Recipients and data processors
We do not sell or share your data with third parties for commercial purposes. To run the service we rely on these providers, which act as data processors under a contract compliant with Art. 28 GDPR:
- Stripe Payments Europe, Ltd. (Ireland): payment gateway and subscription management.
- Supabase, Inc.: database and hosting of application data (accounts, orders, alerts and enquiries).
- Resend: delivery of transactional emails (verification codes, confirmations and alerts).
- Vercel Inc.: website hosting and delivery.
- Google Ireland Limited: Google Analytics 4, only if you accept analytics cookies.
5. International transfers
Some of these providers or their groups are based in the United States. Any transfer of data outside the European Economic Area relies on the EU-US Data Privacy Framework (where the provider is certified) or on the standard contractual clauses approved by the European Commission, with any additional safeguards required.
6. Retention periods
- Account: while it remains active. After closing it, data is kept blocked only for the limitation periods of possible liabilities.
- Invoicing: 6 years (Art. 30 of the Spanish Commercial Code) and any periods required by tax law.
- Alerts: until you unsubscribe or withdraw consent.
- Enquiries: as long as needed to answer them and then for the applicable limitation periods.
- Analytics: 14 months at most.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent at any time, by writing to info@inmomatch-ia.com and stating the right you are exercising. If needed to verify your identity we will ask you to write from your account email. We will reply within one month at the latest.
You also have the digital rights recognised in Title X of Spanish Organic Law 3/2018 (LOPDGDD), insofar as they apply to this service.
If you believe we have not handled your rights correctly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Security and minors
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored as irreversible hashes, signed sessions, a single active session per licence and restricted access to data.
The service is intended for people aged 18 or over. We do not knowingly collect data from minors.
9. Changes to this policy
We may update this policy to reflect legal or service changes. The version in force is always the one published on this page. Last updated: 29/10/2026.