Who we are
PropertyAxis is a real-estate management software operated by a Spanish company. For the purposes of data protection law (GDPR and the Spanish LOPDGDD), we are the data controller for the personal data you provide when signing up, subscribing to a plan, joining the waitlist or contacting us.
If you have any questions about this policy or about how we handle your data, write to privacidad@propertyaxis.io. We always reply — and it's a person, not an automated ticket.
What we collect
We only ask for what's necessary for the service to work. Depending on how you use PropertyAxis, we may process:
Data you give us directly
- Account and billing. Name, email, agency name, Tax ID, billing address, language.
- Agent profile. Optional photo, contact phone, short bio if you choose to display it on your site.
- Content you publish. Listings, photographs, descriptions, blog posts and any material you upload to your site.
- Communications. Emails, support messages and forms you send us.
Data we collect automatically
- Usage data. Pages visited in the admin panel, actions taken, errors and response times — to debug and improve the product.
- Technical data. IP address, browser type, operating system, session identifier.
- Cookies and similar. See our Cookie Policy for the full breakdown.
Data about your contacts (leads)
When a visitor to your site fills out a form, their data (name, email, phone, message, property of interest) is saved in your PropertyAxis account. For that data, you are the data controller and PropertyAxis acts as processor: we handle it under your instructions and under the Data Processing Agreement (DPA) you sign on subscription.
Why we use it and the legal basis
We process your data for the following purposes, each with its legal basis:
We do not sell your data or your contacts' data to third parties. We do not use your content to train third-party AI models. We do not hand your leads to other agencies or to property portals.
Who we share it with
We work with service providers (processors) strictly necessary to run the product. All of them are bound by contract and GDPR-compliant:
- Hosting and infrastructure — within the EU (AWS Ireland / Hetzner Germany).
- Database and image storage — Supabase (EU) and a CDN provider.
- Transactional email delivery — Resend / Postmark (EU).
- Payment processor — Stripe Payments Europe, Limited.
- Customer support — ticketing tool (EU).
- Product analytics — our own cookieless analytics + Plausible (EU).
We may update this list; we will publish changes at least 30 days in advance so you can object if you wish.
International transfers
By default, your data is stored and processed within the European Union. If a specific provider operates outside the European Economic Area, we apply the European Commission's Standard Contractual Clauses and additional security measures.
How long we keep it
The specific periods appear in the table above. As a general rule, we keep your data for the duration of the contract and, after termination, only for as long as strictly necessary to meet legal obligations (mainly tax and accounting).
Once the applicable period has elapsed, data is securely deleted or irreversibly anonymised. You may request early deletion at any time by following the steps in the next section.
Your rights
As the data subject, you may exercise the following rights at any time:
- Access — know what data of yours we hold and receive a copy.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data («right to be forgotten»).
- Objection — object to processing based on legitimate interest.
- Restriction — ask us to pause processing while a complaint is resolved.
- Portability — receive your data in a structured format (JSON/CSV) to port it to another provider.
- Withdraw consent — when processing is based on your consent.
To exercise any of these, write to privacidad@propertyaxis.io from the address linked to your account. We will respond within one month at most.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Security
We apply technical and organisational measures proportionate to the risk:
- Encryption in transit (TLS 1.3) and at rest (AES-256).
- Two-factor authentication available for every account.
- Internal access follows least-privilege with full traceability.
- Encrypted backups and periodic restore tests.
- Security reviews and pentests at least once a year.
If we detect a security breach that may affect you, we will notify you without undue delay and, in any case, within 72 hours of detection, as required by art. 33 GDPR.
Minors
PropertyAxis is a professional service aimed at real-estate agencies. We do not offer the service to people under 16 and do not knowingly collect their data. If you believe a minor has provided us with information, contact us and we will delete it.
Changes to this policy
We may update this policy to reflect legal, technical or functional changes to the service. We will publish the updated version on this page, indicating the effective date. If changes are substantial, we will notify you by email at least 30 days in advance.
If you represent an agency and need to sign a Data Processing Agreement (DPA) or an impact assessment, write to privacidad@propertyaxis.io. We have templates ready and we adapt to your corporate framework when needed.