Privacy policy

1. Who we are and our role

Llavaura is operated by SVC InternetServices LLC, 400 Rella Drive 123-298, Montebello, NY 10901, United States. Contact: support@llavaura.com.

We are the controller for data about visitors of llavaura.com, demo and partner requests, and the users of agency accounts.

For the data that real estate agencies manage in Llavaura about their own clients (leads, contacts, messages, viewings, documents) and about visitors of their agency websites, the agency is the controller and we act as processor on its instructions, under a data processing agreement. If your question concerns such data, please contact the agency; we will also forward requests we receive.

2. Data we process

• Account data: name, e-mail address, phone number, role and agency of platform users.
• Content entered by agencies: listings, contacts, leads, notes, appointments, tasks and documents.
• Communications: messages exchanged through WhatsApp, e-mail, website forms and, when connected, Instagram and Facebook; transcripts of chats with the website assistant (we do not store audio).
• Technical data: logs, device and browser information; IP addresses are stored only as a one-way hash for rate limiting and abuse prevention.
• Requests sent through our forms (demo, partner programme).

3. Data from Meta Platforms (WhatsApp, Instagram, Facebook)

When an agency connects its WhatsApp Business account (and, where available, its Instagram account or Facebook Page), we receive: account and phone number identifiers, the business display name, access tokens, and the messages exchanged between the agency and its clients, including the sender's phone number or profile name, attached media and delivery statuses.

We use this data only to: show conversations in the agency's CRM, create and update leads, send the replies the agency writes or approves (or automatic replies the agency has switched on), prepare drafts and summaries with AI for the agency, and publish content the agency chooses to publish.

We do not sell Platform Data, do not use it for advertising or to build profiles for third parties, do not use it to train AI models, and only share it with the subprocessors needed to provide the service. Access tokens are stored encrypted on our servers and are never exposed to browsers.

When an agency disconnects a channel, we stop collecting data from it and delete its access tokens. See our data deletion page for how to have data removed.

4. Purposes and legal bases

• Providing the platform and agency websites under our contract with the agency (GDPR art. 6(1)(b)), and processing on the agency's instructions (art. 28).
• Security, fraud and abuse prevention, and improving the service (legitimate interests, art. 6(1)(f)).
• Answering demo, partner and support requests (pre-contractual steps and legitimate interests).
• Complying with legal obligations, such as accounting and tax (art. 6(1)(c)).
• Consent where required, for example for marketing messages (art. 6(1)(a)); you can withdraw consent at any time.

5. Artificial intelligence

Llavaura uses AI providers to write and translate texts, draft replies, summarise conversations, analyse listing photos and generate images and videos at the agency's request. These providers process data under agreements that limit their use of it to providing their service to us.

Visitors who use the website assistant are told that they are talking to an AI assistant. AI output is reviewed or controlled by the agency; AI imagery is never used to misrepresent a real property.

6. Subprocessors

We use the following service providers to run Llavaura:

• Supabase: database, file storage and authentication (EU, Ireland)
• Vercel: hosting of the platform and agency websites
• Anthropic: AI text processing (Claude) for replies, summaries, translations and the assistant
• Google: AI images (Gemini), maps, geocoding and nearby places
• ElevenLabs: speech recognition and voice for the website assistant (no audio recordings are stored by us)
• fal.ai: AI video generation
• Mailgun: sending and receiving e-mail (EU region)
• Meta Platforms: WhatsApp Business Platform, and Instagram and Facebook messaging and publishing when connected
• Cloudflare: bot protection on forms (Turnstile)

7. International transfers

Llavaura is operated by a company established in the United States, and some providers process data outside the European Economic Area. For such transfers we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.

8. Retention

• Account data: for the duration of the contract and up to 90 days afterwards, so the agency can export its data.
• Agency data: deleted on the agency's instructions, and at the latest 90 days after the end of the contract; backups are overwritten in their regular cycle.
• Website assistant transcripts: 30 days, or 12 months when the conversation led to an enquiry.
• Screened e-mails that were not enquiries: 30 days.
• Invoices and accounting records: as long as the law requires.

9. Security

Each agency's data is isolated at database level (row-level security), data is encrypted in transit and at rest, secrets are kept server-side only, and access within our team follows the principle of least privilege.

10. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability and to withdraw consent. Write to support@llavaura.com. For data managed by an agency, contact the agency directly or write to us and we will forward your request.

You can also lodge a complaint with a supervisory authority, such as the Spanish Agencia Española de Protección de Datos (aepd.es) or the authority of the country where you live.

11. Cookies

llavaura.com and agency websites use only strictly necessary cookies (login session, language, security and the assistant session). We do not use advertising or analytics cookies. If that changes, we will update this policy and ask for consent where required.

12. Children

Llavaura is a business service and is not directed at people under 18.

13. Changes

We may update this policy. The date at the top shows the latest version; significant changes are announced to agency account holders.

14. Contact

SVC InternetServices LLC, 400 Rella Drive 123-298, Montebello, NY 10901, United States. E-mail: support@llavaura.com. Phone: +1 (845) 746-3132.