PropScan

    Privacy Policy

    Last updated: April 2026

    1. Who we are

    PropScan ("we", "us", "our") operates the propscan.eu website and related services. We provide real estate investment analysis tools for properties in Barcelona, Spain.

    Contact: support@propscan.eu

    2. What data we collect

    • Account data: Email address, hashed password (or Google OAuth profile).
    • Analysis data: Listing URLs you submit, parsed property details (price, area, features), generated reports and scores.
    • Usage data: Analysis count, subscription status, language preference.
    • Technical data: IP address, browser type, device info — collected automatically by our hosting provider (Supabase, Vercel).

    We do not collect payment card details — payments are processed securely by Stripe.

    3. Why we collect it (legal basis)

    • Contract performance: To provide the analysis service you signed up for.
    • Legitimate interest: To prevent abuse, improve the service, and ensure security.
    • Consent: For optional cookies and marketing communications (if any).

    4. How long we keep it

    • Account data: Until you delete your account.
    • Analysis data: 12 months from creation, then automatically deleted.
    • Technical logs: 90 days.

    5. Who has access

    • Supabase (database hosting) — EU region.
    • Vercel (frontend hosting).
    • Stripe (payment processing).
    • ScraperAPI (listing data retrieval) — receives only the listing URL, not your personal data.

    We do not sell or share your personal data with advertisers or third parties.

    6. Your rights (GDPR)

    As an EU resident, you have the right to:

    • Access your personal data.
    • Rectify inaccurate data.
    • Delete your account and all associated data.
    • Export your data in a portable format.
    • Object to processing based on legitimate interest.
    • Withdraw consent at any time for consent-based processing.

    To exercise any of these rights, email us at support@propscan.eu. We will respond within 30 days.

    7. Cookies

    We use the following cookies and local storage:

    • Authentication session (Supabase) — essential, required for login.
    • Language preference (localStorage) — functional, remembers your language choice.
    • Session ID (localStorage) — functional, tracks anonymous usage before registration.

    We do not use advertising or tracking cookies.

    8. Data security

    All data is transmitted over HTTPS. Database access is protected by Row Level Security (RLS) policies. Passwords are hashed using bcrypt. We follow industry-standard security practices.

    9. Changes to this policy

    We may update this policy from time to time. We will notify registered users of significant changes via email. The "last updated" date at the top indicates the latest revision.