Privacy policy

1. Who is responsible

The controller is NREAL ESTATE L.P..

• Address: Bochali 107, 115 24 Athens, Greece
• General Commercial Registry (ΓΕΜΗ) no.: 196604203000, VAT no. (ΑΦΜ): 803422609
• Email for any privacy matter: hello@nreal-estate.eu

We have not appointed a data protection officer, because the law does not require one for our activity. Write to the email address above with any question.

2. What we collect about you

• Account: your name, email address and sign-in details. Passwords are handled by our sign-in provider and stored only as secure hashes. If you sign in with another account, such as Google, we receive your name and email address from it.
• Profile and preferences: what you tell us during onboarding and in settings, such as your role, areas, property types and cost assumptions.
• Use of the app: the reports you open, notes you write, feedback you send, plan limits used and when you last signed in.
• Team plans: the names and email addresses of people you invite, and their membership status.
• Billing: name, billing address, VAT number if you give one, your plan, invoices and payment status. Card details are entered on Stripe's page; we see only the card type, its last four digits and its expiry date.
• Communications: the messages you send us and our replies.
• Technical data: IP address, browser and device type, and request logs, which our hosting and sign-in providers record to run and protect the service.

You give us most of this data directly. Some comes from the services we use (for example payment status from Stripe). You do not have to give us your data, but without an email address and payment method we cannot provide a subscription.

3. Why we use it, and on what legal basis

• To provide the service you signed up for: your account, brief, reports, team seats and support. Basis: performance of our contract (Art. 6(1)(b) GDPR).
• To bill you, issue invoices and keep accounting and tax records. Basis: our contract, and our legal obligations under Greek tax law (Art. 6(1)(c)).
• To send emails about your account and subscription, such as receipts, payment problems and important changes. Basis: our contract.
• To keep the service secure and prevent fraud, abuse and repeat free trials. Basis: our legitimate interest in protecting the service and our customers (Art. 6(1)(f)).
• To understand how the product is used and improve it, mainly from aggregated figures. Basis: our legitimate interest in improving the service.
• To send news and offers, only if you have opted in. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time with the link in every email.
• To meet legal requests and to establish, exercise or defend legal claims. Basis: legal obligation or legitimate interest.

We do not make decisions about people by automated means that have legal or similarly significant effects on them. Our scores and valuations are about properties, not about you.

4. People mentioned in property listings

To build the brief we read for-sale listings that third parties have published on public property portals. Besides the property itself (location, size, price, description, history), a listing can include the name, phone number or agency of the person who posted it.

• We use those contact details only internally: to tell agency listings from owner-direct ones and to spot the same property listed twice. We do not show them to subscribers, and we never use them to contact anyone.
• Each listing in the app links back to the original listing on the portal, where its publisher controls what is shown.
• Basis: our legitimate interest in providing a market information service, balanced against the fact that the data was published by the person themselves or their agent for a commercial purpose (Art. 6(1)(f) GDPR).
• We keep listing records for as long as we need them to show price histories and market trends.
• We do not inform each person individually, because we do not use their contact details to reach anyone, and contacting each of them would involve disproportionate effort. This notice is published instead (Art. 14(5)(b) GDPR).

If your details appear in a listing, you may ask us at hello@nreal-estate.eu to tell you what we hold, to correct or delete it, or object to our use of it. We will act on your request as described in section 9.

5. Who receives your data

We do not sell personal data. We share it only with providers that process it for us under a data processing agreement, and only as far as each one needs:

• Vercel Inc.: hosting of the site and app, on servers in Frankfurt, Germany.
• Neon Inc.: our database, on servers in Frankfurt, Germany.
• Clerk Inc.: sign-in and account security (United States).
• Stripe Payments Europe Ltd. (Ireland): payments, invoices and tax calculation. For some purposes, such as fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
• Cloudflare Inc.: domain name and network services that protect the site.
• Brevo SAS (France): service emails such as the confirmation of a withdrawal, and our newsletter only if you subscribe to it.
• Our email provider, for messages you send us.

When you open the comparables map in a report, your browser loads the map tiles directly from OpenFreeMap (openfreemap.org), a free map service built on OpenStreetMap data. As with any request on the internet, OpenFreeMap receives your IP address, your browser type and which tiles were requested, and so the area of the property you are viewing. We send it nothing else about you or your account. OpenFreeMap does not process data on our behalf; it handles these requests under its own terms. Basis: our legitimate interest in showing comparables on a street map (Article 6(1)(f) GDPR). If you prefer not to, don't open the map; the comparables table works fully without it.

We may also disclose data to our accountants and legal advisers, to public authorities when the law requires it, and to a buyer or successor if the business is transferred, who would then be bound by this policy.

6. Transfers outside the EU

Some providers, or their support teams, are based in the United States. Where data is transferred outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses with additional safeguards. You can ask us for details at hello@nreal-estate.eu.

7. How long we keep it

• Account, preferences, notes, report history and team data: while your account exists. When you delete it, we delete them from our database; copies in backups are overwritten within 30 days.
• Invoices and payment records: as long as Greek tax and accounting law requires, normally 5 years from the end of the tax year, and longer if an audit or dispute is pending.
• Withdrawal records (date and time, plan, any refund): 5 years, as proof of how we handled the withdrawal.
• Messages to us: as long as needed to deal with them and up to 2 years afterwards.
• Server and security logs: up to 30 days, unless needed to investigate an incident.
• Newsletter: until you unsubscribe.

8. Cookies and similar technologies

We use only what the site needs to work:

• Sign-in cookies set by Clerk, which keep you signed in securely.
• ue_locale, which remembers your language, for 1 year.
• ue_consent, which remembers your cookie choice, for 6 months.
• Your browser's local storage, for display preferences such as table sorting. It stays on your device.

We do not currently use analytics or advertising cookies. If we add them, they will load only after you allow them, and this list will name them. You can change your choice at any time from “Cookie settings” at the bottom of every page. The checkout page is run by Stripe, which uses its own cookies to process payments and prevent fraud.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it;
• receive the data you gave us in a common machine-readable format, or have it sent to another provider;
• object to processing based on our legitimate interest, and to direct marketing at any time;
• withdraw your consent at any time, without affecting what we did before.

You can change most details yourself in your account settings. To delete your account or exercise any other right, email hello@nreal-estate.eu. We reply within one month. If a request is complex, we may extend this by up to two more months and will tell you why. We may ask you to confirm your identity first.

You also have the right to complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr. We would appreciate the chance to deal with your concern first.

10. Security

We protect data with encryption in transit, access limited to the people who need it, separate credentials for each system, and providers that hold recognised security certifications. No system is completely secure. If a breach puts your rights at risk, we will tell you and the authority as the law requires.

11. Children

Nreal Estate is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.

12. Changes to this policy

We update this policy when our processing or the law changes. The date at the top shows the current version. If a change materially affects you, we will email you before it takes effect.