Privacy Policy

1. Who we are

Habiata S.A. ("Habiata", "we", "us") is a public limited liability company registered in Luxembourg (RCS B305375), with its registered office at 55, rue de la Vallée, L-2661 Luxembourg. We operate the Habiata platform, an AI-powered B2B collaboration workspace for the real estate industry.

For the purposes of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"), Habiata acts as a data controller for the personal data described in Sections 2–3 below, and as a data processor on behalf of our Customers for Customer Data as further described in our Data Processing Agreement.

Data Protection Contact: legal@habiata.lu

2. Personal data we collect

2.1 Account data (collected directly from you)

• Full name and email address
• Password (stored as a salted hash; we never see it in plain text)
• Company name, role, team size
• Phone number (optional)
• Profile picture (optional)
• Billing information and payment method (processed by Stripe; we do not store full card numbers)

2.2 Platform usage data (collected automatically)

• IP address and approximate geolocation
• Browser type, operating system, device identifiers
• Pages visited, features used, timestamps, and session duration
• Error logs and performance telemetry
• Anonymised behavioural analytics such as clicks and scroll patterns (only with your cookie consent)

2.3 Customer Data (processed on behalf of our Customers)

When you or your organisation use the Platform, you may upload or generate data including property listings, contact records, deal information, documents, media, messages, electronic signatures, KYC/AML files, and AI-generated outputs. This data is processed by Habiata strictly on behalf of the Customer (data controller) under our DPA. We do not use Customer Data for our own purposes, except in anonymised and aggregated form as described in Section 5.

2.4 Cookies and similar technologies

We use strictly necessary cookies to keep you logged in and remember your preferences, as well as optional analytics and experience-improvement cookies. You can manage your preferences at any time via the cookie settings accessible from the privacy policy page. For full details, see Section 10 below.

3. Why we process your data (legal bases)

4. Who we share your data with

We do not sell personal data. We share data only with carefully selected third-party service providers that are contractually bound to process your data solely on our instructions and in compliance with applicable data-protection laws. These providers fall into the following categories:

• Cloud infrastructure and hosting providers: for securely storing and serving the Platform and your data
• Authentication and identity services: to manage secure login and account verification
• Payment processors: to handle subscription billing and transactions (we never store full card numbers)
• AI and machine-learning providers: to power the Platform's AI features such as property descriptions, image generation, and document analysis
• Electronic signature providers: to facilitate simple, advanced, and qualified electronic signatures
• Email and calendar integration providers: when you choose to connect your email or calendar accounts
• Analytics and error-monitoring services: to improve the reliability and usability of the Platform (analytics only with your cookie consent)
• Internal communication tools: for our engineering team's incident-response workflows (no customer personal data is shared)

The complete and up-to-date list of sub-processors is maintained in our Data Processing Agreement and is available to Customers upon request.

We may also disclose personal data when required by law, regulation, or court order, or where necessary to protect the rights, property, or safety of Habiata or others.

For data we receive from Google, Microsoft, and Apple when you connect an email or calendar account, the additional disclosures in Section 5 apply.

If you connect an AI assistant such as ChatGPT or Claude to your Habiata account, data is sent to that assistant at your request, as described in Section 6.

5. Email and calendar integrations

When you choose to connect a Gmail, Outlook, Google Calendar, or Apple iCloud Calendar account to the Platform, Habiata processes additional data from those services on your behalf. This section sets out, with full transparency, exactly what we access, why we access it, and what we do with it.

5.1 Use of Google user data: Limited Use disclosure

Habiata's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we confirm that:

• We only use Google user data to provide and improve the user-facing features described in section 5.2 below
• We do not transfer Google user data to third parties, except as necessary to provide or improve the user-facing features that you have requested, to comply with applicable law, or as part of a merger, acquisition, or sale of assets where you receive prior notice
• We do not use Google user data for serving advertisements
• We do not allow humans to read Google user data unless: (a) we have your affirmative agreement for specific messages, (b) it is necessary for security purposes (such as investigating abuse or resolving a support request you have opened), (c) to comply with applicable law, or (d) the data has been aggregated and anonymised so that no individual or message can be identified
• We do not use Google user data to train, develop, or improve general-purpose artificial-intelligence or machine-learning models

Habiata has completed CASA Tier 2 assessment for its use of Google OAuth and restricted Google API scopes. See our Security page for details.

5.2 Google scopes we request

5.3 Use of Microsoft user data

Equivalent disclosures apply if you connect a Microsoft (Outlook) account. We use Microsoft user data only to provide the features described below, do not sell or transfer it for advertising, do not use it to train AI models, and do not allow humans to read it except as set out in section 5.1. We request the following Microsoft Graph scopes:

• User.Read: to identify the connected Microsoft account
• Mail.ReadWrite: to sync email into the Platform's Messages view
• Mail.Send: to send replies and outbound messages
• offline_access: to keep the connection working without asking you to log in again

5.4 Apple iCloud Calendar

Apple iCloud Calendar is connected via CalDAV using an app-specific password that you generate at appleid.apple.com. The password is stored encrypted with AES-256-GCM and is used only to read and write calendar events to the calendar you select. We do not access any other iCloud data.

5.5 Storage and security of integration credentials

• Refresh tokens (Google, Microsoft) are stored encrypted with AES-256-GCM in our database. The encryption key resides in our backend secret store and is never sent to or accessible by your browser
• Access tokens are never persisted. They are minted on-demand from the encrypted refresh token each time the Platform needs to call Google or Microsoft APIs, used once, and immediately discarded
• Email message content that has been synced into the Platform is stored in your Customer account, encrypted at rest, and access-controlled by the Platform's row-level security policies
• Calendar events created by the Platform in your calendar contain only the visit metadata you have entered (property reference, time, attendees), never free-text Customer Data or AI-generated content
• No human at Habiata reads your email or calendar data, except as set out in section 5.1 above

5.6 Disconnecting and revoking access

You can disconnect any integration at any time from Settings → Email accounts or Settings → Calendar. When you do:

1. Habiata immediately calls Google's (or Microsoft's) token-revocation endpoint, withdrawing our app's access at the provider
2. The encrypted refresh token is deleted from our database
3. Synced messages and connection metadata are removed

You may additionally revoke Habiata's access directly at the provider, at any time:

• Google: myaccount.google.com/permissions
• Microsoft: account.live.com/consent/Manage
• Apple: revoke the app-specific password at appleid.apple.com

6. AI and automated processing

The Platform includes AI-powered features such as:

• Property descriptions and valuations: generated from property details you provide
• Document analysis and recommendations: processing documents you upload
• AI Studio: image generation and editing for marketing materials
• Smart search: finding comparable properties on public portals

We do not use your data to train general-purpose AI models. AI processing is limited to delivering the services described in your subscription. We may use anonymised, aggregated data (from which no individual or company can be identified) to improve the Platform and develop new features.

AI-generated content is provided as a suggestion only. You are responsible for reviewing and approving any output before it is published or shared.

Connecting AI assistants (ChatGPT, Claude and others)

If your company enables external AI access in Company settings, users can connect an AI assistant such as ChatGPT or Claude to their Habiata account. At the user's request, the assistant can search and read the data that user can already see in Habiata, such as contacts and leads (including names, email addresses, phone numbers and enquiry details), properties, deals, visits, projects and files (including their contents). If write actions are enabled, it can also create and update records.

• Data is only sent in response to the user's own requests, using their sign-in and the permissions they already have in Habiata.
• The assistant's provider (for example OpenAI or Anthropic) processes this data under its own terms and privacy policy.
• For security and audit purposes, we log which tools are called, by which user and AI assistant, and whether the call succeeded. We do not log the data returned.
• Owners and admins can switch external AI access off at any time, and users can disconnect the assistant in its settings.

7. International data transfers

Your data is primarily hosted within the European Economic Area (EEA). Where data is transferred outside the EEA (for example, to AWS regions in the US or to Stripe), we rely on:

• The European Commission's adequacy decisions, where available
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary technical measures (encryption in transit and at rest)

8. Data retention

We will notify you by email at least 48 hours before permanent deletion. During the retention period you may export your data through the Platform's export functionality. Once deleted, data cannot be recovered.

9. Data security

We classify the data we process by sensitivity and apply technical and organisational measures appropriate to each level. For Customer Data we process on your organisation's behalf, the protection levels and mapped controls are set out in Annex I of our Data Processing Agreement.

We implement technical and organisational measures appropriate to the risk, including:

• Encryption of all data in transit (TLS 1.2+) and at rest
• Secure authentication via AWS Cognito with support for multi-factor authentication
• Role-based access controls; personnel access on a need-to-know basis
• Two-factor authentication for production systems
• Automated CI/CD pipelines with code review; production isolated from all other environments
• Continuous monitoring, telemetry, and incident-response procedures
• Encrypted backups with key management systems

Full details of our security measures are set out in Annex I of our DPA.

10. Your rights under the GDPR

You have the right to:

• Access: obtain a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): request deletion of your data
• Restriction: limit how we process your data in certain circumstances
• Data portability: receive your data in a structured, machine-readable format
• Object: object to processing based on legitimate interest
• Withdraw consent: where processing is based on consent (e.g. analytics cookies), withdraw at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email legal@habiata.lu. We will respond within 30 days.

You also have the right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD), the Luxembourg supervisory authority, or the supervisory authority of your habitual residence.

11. Cookies

Strictly necessary

These cookies are essential for the Platform to function (authentication session, language preference, cookie-consent choice). They cannot be disabled.

Analytics

With your consent, we use analytics tools to understand how users interact with the Platform (e.g. anonymised heatmaps, session recordings). No personal identifiers are collected through these tools.

Error monitoring

We use error-monitoring services to detect and resolve technical issues quickly. This data is processed under our legitimate interest in maintaining a reliable service.

You can change your cookie preferences at any time using the button below.

12. Children

The Platform is not intended for and should not be used by persons under the age of eighteen (18). We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the Platform at least 30 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy. The latest version is always available at habiata.lu/privacy.

14. Contact