Privacy policy

The data controller is [Company name], whose details are set out in the legal notice.

Contact for personal data: privacy@globalestateconnect.com.

We only collect data needed to run the service:

• Account: email, password (hashed), name, photo, language.
• Professional profile: company, website, country, city, specialities, languages, bio, phone numbers.
• Listings and Live sessions: content, images and videos you publish.
• Communications: messages exchanged in messaging and Live chat.
• Billing: subscription and transaction history (processed by Paddle).
• Technical: IP address, user-agent, connection logs, anonymised audience data.

• Contract performance: account creation, connections, messaging, Live, subscription.
• Legal obligation: billing, accounting, fraud prevention.
• Legitimate interest: service security, abuse prevention, product improvement.
• Consent: audience-measurement cookies, marketing notifications, SMS/WhatsApp.

Your data is accessible to our authorised teams and to the following processors, all bound by an Article 28 GDPR contract:

• Supabase — database hosting, authentication, storage (EU).
• Cloudflare — CDN and serverless execution.
• Paddle — merchant of record: payments, billing, VAT.
• Google Analytics 4 — audience measurement (consent only).
• Twilio — SMS and WhatsApp notifications (if enabled).
• Lovable AI Gateway — chat translation, AI summaries (messages sent for processing, no long-term storage).

Some transfers outside the EU may occur, covered by the European Commission's Standard Contractual Clauses.

• Active account: for as long as the service is used.
• Inactive account: deleted after 3 years without login.
• Messages and Live sessions: 3 years after the last exchange.
• Billing: 10 years (accounting obligation).
• Technical logs: 12 months maximum.

By default, the Site only uses strictly necessary cookies. Audience-measurement cookies (Google Analytics 4) are set only after your explicit consent via the cookie banner, which can be withdrawn at any time.

No third-party advertising cookies are used.

Under Articles 15 to 22 of the GDPR, you have the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

To exercise them: privacy@globalestateconnect.com. You may also lodge a complaint with the French data protection authority CNIL (cnil.fr).

Data is encrypted in transit (TLS) and at rest on our infrastructure. Access is restricted through authentication and Row-Level Security at the database level. Passwords are hashed (bcrypt).

We may update this policy. Any material change will be notified by email or in the application.