Privacy policy

This policy explains what personal data Caseta collects when you visit our website, contact us or use the Caseta platform, why we use it, who we share it with and the rights you have under the EU General Data Protection Regulation (GDPR) and Spain's data protection law (LOPDGDD).

Who we are

Caseta ("we", "us") provides a website, portal-feed, CRM and email-marketing platform for estate agents on the Costa Blanca South and in Murcia. The data controller is Caseta (legal name, tax ID (CIF) and registered address to be confirmed). For anything about your data, write to us using the contact page.

What we collect and why

Your account

• Name and email address, to create and run your account, confirm your address and send you service emails (confirmation and password-reset links). Legal basis: performing our contract with you.
• Your password, stored only as a one-way hash. We can never see it.
• Your profile photo, if you add one, so it shows on your account. Your browser crops and shrinks it before upload; we delete it when you remove or replace it.
• Sessions: when you sign in we record the session with the IP address and browser (user agent) it came from, so you stay signed in and we can protect your account.

Security records

We keep a security log of sign-ins, failed sign-ins, sign-outs, password changes and resets, email confirmations and changes, two-factor and passkey changes, devices signed out, "Confirm it's you" attempts, account deletions and suspensions, with the time, IP address and browser. It helps us detect misuse and investigate problems. For a failed sign-in with an address that has no account, we store only a keyed, one-way code of the address, never the address itself. We never log passwords, links or reset codes. Legal basis: our legitimate interest in keeping the service and your account secure.

To stop abuse we also count recent attempts per IP address and per email address (for example sign-ins, password resets and contact-form messages). These counters are short-lived and deleted automatically after at most 15 minutes of inactivity.

The contact form

When you write to us we store your name, email address, and, if you give them, your agency and phone number, together with your message, so we can reply. You tick a box to agree to this. We don't store your IP address with the message and we don't add you to any mailing list. Legal basis: your consent, which you can withdraw at any time by asking us to delete the message.

Preferences

Your light / dark display choice is kept in a cookie on your device. See the cookie policy.

Data about your clients

When you use Caseta for your agency, you decide what information about your own clients, buyers and owners you enter (for example contacts, enquiries and viewings). For that data you are the controller and Caseta processes it on your behalf as a processor, under a data processing agreement that forms part of our terms.

Who we share it with

We don't sell personal data or use it for advertising. We use a small number of service providers (processors) to run Caseta:

• Cloudflare: hosting, database and file storage for the platform.
• Resend: delivery of the emails we send you (confirmation and password-reset links).

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision. We only disclose data to authorities where the law requires us to.

How long we keep it

• Account data: for as long as your account is open, then deleted, except what we must keep by law (for example invoices). You can delete your account yourself in Settings → Profile: your account, photo, settings, passkeys and two-factor authentication are deleted straight away, and the security log's entries no longer point to you.
• Sessions: until you sign out or they expire (7 days after your last activity).
• Security log: for a limited period (to be confirmed, typically 12 months).
• Contact messages: for as long as needed to deal with your enquiry, and no longer than 24 months unless you become a customer.
• Abuse counters: at most 15 minutes after the last attempt.

Your rights

You can ask us for access to your data, to correct or delete it, to restrict or object to how we use it, and for a copy in a portable format. Where we rely on your consent you can withdraw it at any time. Write to us through the contact page; we reply within one month. If you're not happy with our answer you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Security

Connections to Caseta are encrypted. Passwords are hashed, sessions are held in secure, HTTP-only cookies, sign-ins and password resets are rate limited, and new accounts must confirm their email address before they can sign in.

Changes

We'll update this page when the way we handle data changes, and tell account holders by email about important changes.