Privacy Policy
Last updated: 15 October 2026
This policy explains how propia processes your personal data when you use propia.it and the Service, under articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”). Read it together with the Terms of Service and the Cookie Policy. The Italian version prevails in case of conflict.
1. Data controller
The data controller is:
For any request about your personal data, including the rights described in section 9, write to info@propia.it. We are not required to appoint a data protection officer (DPO) and have not appointed one.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Account data | Email address, password (stored only as a hash), language, name and profile picture if you sign in with Google, user identifier, sign-up and login dates. | Provided by you or by the sign-in provider |
| Search preferences | Mode (buyer or investor), municipalities and areas, budget, property type and features, horizon and goals, scan frequency, saved results, favourites and notes. | Provided by you |
| Notification contact details | WhatsApp number, only if you enter it to receive alerts; notification preferences. | Provided by you |
| Usage data | Pages visited, actions in the app, device and browser, IP address, technical identifiers; session recordings with text and media masked, only with your consent. | Collected automatically |
| Signup source | The campaign that brought you (UTM parameters), the landing page and the referring site, saved with your account when you sign up, in our legitimate interest (art. 6(1)(f)) in knowing which campaigns bring new users. Only with your consent to the Marketing category: your choice for that category, the ad click identifier (fbclid), the browser identifiers for Meta (_fbp, _fbc) and the browser used, which we need to measure our ads. | Collected automatically |
| Payment data | Stripe customer and subscription identifiers, subscription status, amounts and dates, last four digits and expiry of the card, receipts. Full card numbers are processed exclusively by Stripe and are never shared with us. | From you, via Stripe |
| Documents and cadastral data | Documents you upload (for example floor plans, appraisals, listings), cadastral identifiers, cadastral extracts and document checks you request, with the data they contain, which may also concern third parties (for example the registered owners). | Provided by you; public sources and providers |
| Support | Messages sent through the support and bug-report forms, emails and our replies. | Provided by you |
| Email answers and interactions | Your optional answer to “how did you hear about us?”, given by clicking a link in the welcome email; data about the emails we send you (sending, delivery, any bounces or spam complaints, unsubscribe requests) and the choices you make about these emails at signup or in Settings, needed to honour your opt-outs. | Provided by you; collected automatically |
| Technical and security logs | Access and error logs, notification sends and deliveries, security events. | Collected automatically |
3. Why we process it and on what legal basis
| Purpose | Legal basis (article 6 GDPR) |
|---|---|
| Create and manage your account, run scans, generate reports and scores, send you results by email and, if requested, WhatsApp, provide document checks and support. | Performance of the contract (art. 6(1)(b)) |
| Manage subscriptions, payments, refunds and receipts; prevent payment fraud. | Contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) |
| Issue and keep invoices and accounting records. | Legal obligation (art. 6(1)(c)) |
| Keep the Service secure and stable: error monitoring (without screen recording), abuse prevention, technical logs. | Legitimate interest (art. 6(1)(f)) in a secure, working service |
| Measure and improve the Service with usage statistics (PostHog) and session recording (Sentry Session Replay). | Consent (art. 6(1)(a)), revocable at any time from the cookie preferences |
| Send you service communications (confirmations, renewals, changes to the Terms, security notices). | Contract (art. 6(1)(b)) and legitimate interest (art. 6(1)(f)) |
| Send you service emails (welcome, account and report notifications) and, if you are a registered user, occasional emails about propia’s own services similar to the ones you use and about the paid plans, which you can refuse when you sign up and turn off at any time from the link in every email or from Settings → Notifications; use your optional answer to “how did you hear about us?” only for aggregate marketing statistics. | Service emails: contract (art. 6(1)(b)). Emails about similar services and paid plans: legitimate interest (art. 6(1)(f)) within the limits of article 130(4) of the Privacy Code (soft opt-in), with the right to object at any time, free of charge. Answer to “how did you hear about us?”: legitimate interest (art. 6(1)(f)). |
| Send you news and offers about propia. | Consent (art. 6(1)(a)); for existing customers, legitimate interest within the limits of article 130(4) of the Privacy Code, with an opt-out in every message |
| Establish, exercise or defend our rights; respond to authorities. | Legitimate interest (art. 6(1)(f)) and legal obligation (art. 6(1)(c)) |
Analytics and session recording are only captured after you grant explicit consent via the cookie banner: recordings mask all text and media and stop as soon as you decline or revoke consent from the cookie preferences. Error reports (no page content) are collected regardless, to keep the Service working.
Providing account data and search preferences is necessary to use the Service; the WhatsApp number, documents and consents are optional and, without them, the related features are not available.
4. Automated processing and artificial intelligence
Matching your criteria against listings, ranking the results, scores, valuations and summaries are produced automatically by statistical and language models, including those of OpenAI and Anthropic, which receive your search criteria and the listing data, never your payment data. This processing only decides which listings to show you and in what order: it produces no legal effects and does not similarly significantly affect you, and we take no decisions of that kind about you (article 22 GDPR). You can nevertheless object, ask for a human review of the results or change your criteria at any time.
5. Third-party data contained in listings
The listings we analyse come from publicly accessible sources and may contain third-party data, such as the agency name or the property address. We neither store nor display the personal contact details of private sellers. We process this data in our legitimate interest in providing the Service (article 6(1)(f) GDPR); anyone who believes a listing concerns them can object by writing to us. Likewise, the cadastral documents you request may show the names of the registered owners: we use them only for the check you asked for and do not reuse them for any other purpose.
6. Who receives your data
Data is processed by our authorised staff and by the providers that help us deliver the Service, appointed as processors (article 28 GDPR) or acting as independent controllers (for example Stripe for payments). We do not sell personal data.
| Provider and purpose | Location and place of processing |
|---|---|
| Supabase (database, authentication, file storage) | Supabase Inc., USA; data hosted in the European Union (Frankfurt or Ireland) |
| Stripe (payments, subscriptions, receipts, fraud prevention) | Stripe Payments Europe Ltd, Ireland; Stripe Inc., USA |
| Resend (email delivery) | Resend Inc., USA; sending from the European Union region |
| Meta Platforms (WhatsApp notifications through the WhatsApp Business Platform, only if you enable WhatsApp alerts) | Meta Platforms Ireland Ltd, Ireland; Meta Platforms Inc., USA |
| Meta Platforms (measuring our ads on Facebook and Instagram through the Meta Pixel and the Conversions API, only with your consent to the Marketing category, revocable from the cookie preferences; email and user identifier sent only in hashed form) | Meta Platforms Ireland Ltd, Ireland, joint controller for the collection and transmission and then independent controller; Meta Platforms Inc., USA |
| OpenAI (language and vision models for analysing listings, photos and documents and for report text; data sent through the API is not used to train the models) | OpenAI Ireland Ltd, Ireland; OpenAI LLC, USA |
| Anthropic (language models for deep dives and summaries; data sent through the API is not used to train the models) | Anthropic Ireland Ltd, Ireland; Anthropic PBC, USA |
| Mapbox (maps and geocoding in the app) | Mapbox Inc., USA |
| PostHog (product usage statistics, only with consent) | PostHog Inc., USA; data hosted in the European Union (Frankfurt) |
| Sentry (error monitoring and, with your consent, session recording) | Functional Software Inc., USA; data hosted in the European Union (Germany) |
| Vercel (website hosting and content delivery network) | Vercel Inc., USA; global network |
| Fly.io (hosting of the analysis engine) | Fly.io Inc., USA; servers in the European Union (Frankfurt) |
| Cloudflare (DNS and email routing) | Cloudflare Inc., USA; global network |
| openapi.it (cadastral extracts and document checks) | Openapi S.r.l., Italy |
| Google (Sign in with Google, only if you choose it) | Google Ireland Ltd, Ireland; Google LLC, USA |
Data may also be disclosed to legal and accounting advisers, to public authorities where the law requires it and, in case of a business transfer or reorganisation, to the successor, in line with this policy.
7. Transfers outside the European Union
Some providers are established in, or process data in, the United States. In those cases the transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for certified providers, and in any case on the Standard Contractual Clauses approved by the Commission (article 46 GDPR), supplemented by additional measures where necessary. You can ask for a copy of the safeguards applied by writing to info@propia.it.
8. How long we keep your data
| Data | Retention |
|---|---|
| Account, preferences, reports, favourites, uploaded documents | For the life of the account; erased within 30 days of account deletion (backup copies are overwritten in the following cycles) |
| Technical and security logs | 12 months |
| Logs of notifications sent or suppressed (email, WhatsApp) | 12 months |
| Invoices, receipts and accounting records | 10 years (article 2220 of the Italian Civil Code and tax law) |
| Usage statistics (PostHog) | Up to 12 months, in pseudonymous form |
| Session recordings (Sentry) | At most 90 days |
| Support messages | 24 months after the request is closed |
| Data needed to establish, exercise or defend a right | Until the dispute is settled |
9. Your rights
Under articles 15-22 GDPR you have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing and portability, to object to processing based on legitimate interest and to direct marketing, to withdraw any consent at any time (without affecting the lawfulness of processing already carried out), and not to be subject to decisions based solely on automated processing.
- You can delete your account and export your data from Settings → Account; notifications are managed from Settings → Notifications; consent to analytics is withdrawn from the cookie preferences.
- For any other request write to info@propia.it from your account email address (or give us enough details to identify you). We reply within one month, extendable by two months in complex cases, free of charge unless the request is manifestly unfounded or excessive.
- If you believe the processing breaches the law, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live, or seek a judicial remedy.
10. Minors
The Service is for people aged 18 or over. We do not knowingly collect data from minors; if we learn that an account belongs to a minor, we delete it.
11. Security
We protect data with appropriate technical and organisational measures: encrypted connections (TLS), encryption of data at rest and of backups, per-user access control at database level, passwords stored only as hashes, access monitoring and logging. In the event of a personal data breach likely to result in a high risk to your rights, we inform you as required by articles 33 and 34 GDPR.
12. Cookies and similar tools
The use of cookies, localStorage and similar technologies is described in the Cookie Policy, where you can also change your choices.
13. Changes to this policy
We may update this policy; the date at the top shows the version in force. Material changes are notified by email or in the app.