Privacy Policy

Elena Bashinskaya, NIF Y1337474S

Bilbao 19, Girona, Spain

Privacy contact: privacy@bildior.com

Bildior is a product under development and testing. As of today, no estate agency uses the service.

Self-serve sign-up is closed: it is not possible to register or subscribe to a plan from the website. This means the only person who accesses your conversation is the controller named in section 1. We do not pass your enquiry to any agency or any commercial third party.

When the first agency starts using the product, this will change for conversations you hold with that agency's assistant: the agency will decide what your data is used for — that is, it will act as the data controller — and Bildior will become a processor acting on its behalf. We will update this policy before that happens and state the date here.

When you talk to our assistant (website widget or WhatsApp):

• Contact details you give us: name, phone number and, optionally, email address.
• Your property requirements: whether you want to buy, rent or are an owner; budget, areas, number of rooms, size, timing, and any personal circumstances you choose to tell us.
• The full content of your conversation with the assistant.
• The language detected in your messages.
• A session identifier. On WhatsApp, that identifier is your phone number.
• Technical timestamps for messages.

If you write to us through the feedback form — in the chat widget, on the contact page, or from the management dashboard — we process the name, email address and message you provide, together with the language and session identifier, so that we can read and reply to you.

On the website we use browser local storage and first-party cookies. None of them are advertising or analytics cookies:

• "bildior_locale": a cookie remembering the language you pick in the footer switcher, lasting one year.
• "chatSessionId": a random conversation identifier kept in local storage so the assistant still recognises your conversation if you reload the page.
• If you sign in to the management dashboard, strictly necessary technical cookies that keep your session open, managed by our authentication provider, plus interface preferences such as the sidebar state or notices you have already dismissed.

We do not use any third-party analytics or tracking tools, we set no advertising cookies, and we do not build profiles from this information.

If you sign in to the management dashboard, we process your email address and password to authenticate you. The password is stored hashed by our authentication provider, Supabase, and we have no access to it in plain text.

If in future you subscribe to a paid plan as an agency, billing and card data is handled directly by our payment provider, Stripe. We do not store full card details.

We do not ask for special category data (health, beliefs, ethnic origin, etc.). Please do not include such information in the conversation.

• To handle the enquiry you send us and reply to you — legal basis: pre-contractual steps taken at your request, Art. 6(1)(b) GDPR.
• To develop, test and improve how the assistant works, as it is still in a testing phase — legitimate interests, Art. 6(1)(f) GDPR.
• To moderate content and prevent abuse of the service — legitimate interests, Art. 6(1)(f) GDPR.
• To keep the service secure — legitimate interests, Art. 6(1)(f) GDPR.
• To read and answer messages you send through the feedback form — legitimate interests, Art. 6(1)(f) GDPR.
• To authenticate access to the management dashboard and maintain authorised users' sessions — legitimate interests, Art. 6(1)(f) GDPR.
• To manage subscriptions, invoicing and payment for paid plans — performance of a contract, Art. 6(1)(b) GDPR, and compliance with accounting and tax obligations, Art. 6(1)(c) GDPR.

To be clear about the second point: because the service is in a testing phase, your conversation also helps us check that the assistant works correctly. We do not use it to build advertising profiles, and we do not share it with third parties for commercial purposes.

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You may object at any time (see section 9).

The assistant you are talking to is an automated system built on several language models, which do not all come from the same provider. The content of your messages is sent to:

• OpenAI — to classify your intent, extract the details you provide, compute semantic representations of your enquiry, and moderate inappropriate content.
• Mistral AI — to generate the replies you read and, where relevant, to score which properties fit what you are looking for.

The conversation summary is generated by one of those two providers. While the service is in testing, the exact split between them may change; both are listed in section 6 and both process the data solely on our behalf.

The assistant does not make decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR. It decides nothing about your access to any good or service: it only converses with you and records what you tell us.

Enquiries received are reviewed personally by the controller named in section 1. You can ask to communicate directly with a person at any time by writing to privacy@bildior.com.

We use the following providers, who act as processors and handle your data only on our instructions:

• OpenAI — classification, extraction, semantic representations and moderation of message content.
• Mistral AI (France) — generation of the assistant's replies and scoring of property matches.
• Supabase — hosting of the database storing your enquiry and transcript.
• Upstash — temporary cache of conversation state.
• Vercel Inc. — hosting of the web application. Its technical logs include the IP address your browser connects from, which is used to operate and protect the service.
• Meta Platforms Ireland Ltd. — only if you write to us through WhatsApp, for message delivery via the WhatsApp Business API.
• Resend — delivery of the email generated by the feedback form.
• Stripe Payments Europe, Ltd. — only where a paid plan is taken out, to process payment and invoicing.

We use no other provider to process your conversation data. We do not sell your personal data or share it with third parties for advertising purposes.

Some of these providers are established in the United States or may process data outside the European Economic Area. Where that happens, the transfer relies on each provider's data processing agreement, which incorporates the Standard Contractual Clauses approved by the European Commission, or on an applicable adequacy decision.

You can request details of the specific safeguards by writing to privacy@bildior.com.

• Temporary conversation state (cache): automatically deleted within a maximum of 7 days.
• Your enquiry record and transcript: kept for as long as the service remains in its testing phase, because they are the material we use to check that the assistant works. We have not yet set an automatic deletion period; when we do, we will state it in this section.
• Feedback form messages: kept in our mailbox for as long as they remain useful for dealing with what you raised.
• Billing data, where a plan has been taken out: for the periods required by commercial and tax law.
• Data needed to meet legal obligations or to establish or defend legal claims: for the period required by law.

You can ask us to delete your data at any time by writing to privacy@bildior.com, and we will act on it even if none of those periods has elapsed.

You may exercise the following rights at any time:

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure (right to be forgotten).
• Restriction of processing.
• Data portability.
• Objection to processing based on legitimate interests.
• Withdrawal of consent, where processing is based on it, without affecting the lawfulness of processing carried out beforehand.

To exercise them, write to privacy@bildior.com stating which right you wish to exercise. We will respond within one month.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.

We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS), cryptographic verification of the authenticity of incoming WhatsApp messages, access control on the management dashboard, and storage of credentials outside the source code.

No system is completely secure. Should a breach occur that presents a high risk to your rights, we will notify you in accordance with Art. 34 GDPR.

The service is intended for people aged 18 and over. We do not knowingly collect data from minors. If we find we have processed a minor's data without a legal basis, we will delete it.

We may update this policy to reflect changes to the service or to applicable law. The current version will always be published on this page, with the date it was last updated.