Privacy policy
What data Pisopedia collects, what it uses it for, how long it keeps it and what rights you have over it. No fine print.
Last updated:
Who is the data controller
The controller of your data is Javier García, with Spanish tax ID (NIF) 50897627F.
For any privacy matter you can write to [email protected].
What data we process
This is the data Pisopedia processes, depending on how you use the site:
- Account: your email address, the account type (tenant or professional) and the date you accepted this policy.
- Professional account: also the company name and, for agencies, the Spanish tax ID (CIF, validated automatically), the properties you claim and the replies you publish.
- Reviews: the address and the flat, the rent and the contract dates, whether you shared the home, your ratings and your texts.
- Photos: the ones you attach to your reviews. On upload we re-encode them, which removes their location, date and camera data, and they are not published until we have checked them.
- Letting agency: if you say which agency you rented through, its name, its address and the identifier Google gives it.
- Drafts: when you are signed in, we save your unfinished review and current step so you can continue on another device and we can send you one email reminder. We also store your email language and whether you have turned these reminders off.
- Notifications: a history of alerts about your drafts, the moderation of your reviews, questions and answers, landlord replies and the buildings you follow, including their read state.
- Questions and answers about buildings: the text you write and its date. We moderate them before publication and they are shown without your email or name, but do not include personal data in the text.
- Buildings you follow: the address and the date, to tell you about news in your account. We send no emails for this.
- Sign-in codes: to log in we email you a one-time code; it expires after one hour and is deleted when used or when you request a new one.
- Reading history: which reviews you read each month, to apply the reading limit of free accounts.
- Anonymous visitor: the kvid cookie, a random identifier used to roll out features gradually.
- Server logs: technical records that may include your email, your IP or the sign-in code in specific events (errors, request limits, admin-panel access, email sending). Your IP address is also used transiently, in memory only, to limit the number of requests; it is not stored in the database.
What we use it for and on what legal basis
We use your data for these purposes:
- Providing the service: creating your account, publishing your reviews and showing you content (performance of a contract, art. 6.1.b GDPR).
- Service emails: sign-in codes and notices needed to use the account (performance of a contract, art. 6.1.b GDPR).
- Security and abuse prevention: request limits, sign-in attempt lockouts and technical logs (legitimate interest, art. 6.1.f GDPR).
- News list: only if you tick the news checkbox when registering; every email includes an unsubscribe link you can use at any time (your consent, art. 6.1.a GDPR).
Who receives your data
The site is hosted on a server operated by the owner in Spain. We also work with these providers:
- Brevo: sends our transactional email (sign-in codes and draft reminders).
- Cloudflare: the site's traffic passes through its network before reaching our server. We also use Cloudflare Web Analytics to count visits and measure load times: it sets no cookies and stores nothing on your device. It also stores the review photos in the European Union (Cloudflare R2).
- Google: your browser contacts Google to load the embedded maps, and our server sends it the addresses and the text you type in the search box to show maps and nearby transport, and the agency name you type when writing a review.
- Telegram: the team's internal alerts are sent to a private Telegram channel. They include activity notices, such as a new registration, with the account's internal number and without its email, and content awaiting moderation: the text of reviews, questions and answers, and photos. Alerts already sent are not removed from that channel when you delete your account.
How long we keep it
We keep each piece of data only for as long as its purpose requires:
- Account: while your account is active; if you delete it from your dashboard it goes at once, and if you ask us to delete it, within 30 days.
- Published reviews: while they are published; if you delete your account, your reviews are deleted with it.
- Drafts: deleted when submitted or discarded, and after 30 days without changes.
- Photos: while the review exists; deleted when rejected in moderation, when you remove them, or when you delete the review or your account.
- Notifications: while your account is active; they are deleted with it.
- Questions and answers: while your account exists; deleted when rejected in moderation or when you delete your account. If a question is deleted, its answers go with it.
- Buildings you follow: until you unfollow them or delete your account.
- Reading history: while your account is active.
- Server logs: a few days, at most about a month.
- Sign-in codes: they expire after one hour and are deleted when used or when you request a new one.
- Backups: we keep encrypted copies on Google Drive for 30 days, so what you delete also disappears from them within 30 days.
Your rights
art. 15–21 · RGPDart. 77 · RGPD
You can download your data and delete your account yourself under «Your data» in your dashboard. For that and every other right, you can also write to [email protected] from your account's email address:
- Access: know which of your data we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: have your data deleted.
- Restriction: have us stop using it except to store it.
- Portability: receive the data you gave us in a structured format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent at any time, without affecting what was processed before.
Cookies and local storage
Pisopedia uses technical and preference cookies, and browser local storage. You have the full list, one by one, in the cookie policy.