Privacy policy
Last updated: 11 August 2026
Who processes your data
Yasser Santiago, tax ID Y4869602X, based in Barcelona, Spain. For anything about this policy or about your data: hola@habitio.co.
There are two kinds of data, and they aren’t treated alike
Your data as a customer — name, email, phone and billing details — is processed by us as controller, to provide the service and to charge for it.
The data you enter about your tenants — name, email, phone, identity document, payment history, repairs and messages — remains yours. There you are the controller and we are the processor: we store and process it following your instructions, and we use it for nothing else. We don’t sell it, we don’t share it and we don’t train models on it.
What we use each thing for
To provide the service and maintain your account (performance of the contract). To send you the emails it needs to work: password recovery, invitations and the summaries you switch on (performance of the contract). To reply to whoever leaves their details in the website form, only to talk about Habitio (consent, which you can withdraw at any time). To meet accounting and tax obligations (legal obligation).
Who we share it with
Only with the providers Habitio needs in order to work. All of them act as sub-processors, under contract:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication and file storage | United States (us-west-2) |
| Vercel | Web application hosting | European Union / United States |
| Resend | Transactional email | European Union (Ireland) |
| Microsoft Azure OpenAI | Estimates in the investment evaluator | Per resource configuration |
| Google Maps Platform | Address lookup (geocoding) | United States |
| OpenStreetMap | Maps on property pages | European Union |
Transfers outside the European Union
Our database is hosted in the United States. That transfer relies on the standard contractual clauses approved by the European Commission, included in the contract with the provider. You can ask us for a copy of those safeguards by writing to us.
How long we keep it
Your account and property data, for as long as you are a customer. If you close your account we delete it after 30 days — time enough for you to request an export — except for anything we are legally required to keep, such as invoices. Leads from the form, one year from the last contact.
Your rights
You can ask us for access to your data, for it to be corrected or deleted, to restrict or object to its processing, and to have it handed over in a reusable format. Write to us at hola@habitio.co and we’ll reply within one month at the latest. If you think we’ve got it wrong, you can complain to the Spanish Data Protection Agency (aepd.es).
Cookies
This website uses no analytics, advertising or tracking cookies. The application stores in your browser only what it needs to keep your session open and to remember whether you prefer the light or dark theme. None of that requires consent and none of it is shared with anyone.
Security
Each organisation can only reach its own data, and that is enforced in the database itself, not just in the application. Connections are encrypted and the documents you upload are served through links that expire. If a breach affecting you did happen anyway, we will tell you.
Which version prevails
This is a translation, provided so it can be read in English. Habitio operates under Spanish law and the Spanish version of this policy is the one that governs: if the two ever differ, the Spanish version prevails.