Privacy Policy

Last updated: October 2026

1. Who We Are

NeraTek provides AI-powered real estate technology services to real estate agencies in Portugal. When you interact with a chatbot powered by NeraTek, the real estate agency you contacted is the data controller and NeraTek acts as a data processor on its behalf.

2. What Data We Collect

When you contact a real estate agency via WhatsApp or landing page chat, we may collect:

Contact information: Phone number (from WhatsApp), email address (if provided)
Property preferences: Area, budget range, property type, number of bedrooms, must-have features
Buyer profile: Language, financing plan, purchase timeline, decision structure
Conversation messages: Your messages exchanged with the chatbot and agents
Engagement data: Response patterns, message timestamps, viewing attendance

3. Why We Process Your Data

Purpose	Legal Basis (GDPR)
Lead management and communication (matching you with properties, responding to inquiries)	Art. 6(1)(b) — Contract performance / pre-contractual steps
Follow-up communications (property updates, viewing reminders)	Art. 6(1)(f) — Legitimate interest (balancing test: minimal data used, easy opt-out, direct benefit to lead)
Market demand analysis (aggregate area/budget/property type trends)	Art. 6(1)(f) — Legitimate interest (aggregated statistics only, k-anonymity ≥ 5)
Automated lead scoring (prioritizing agent follow-ups)	Art. 6(1)(f) — Legitimate interest (agent assistance only, no automated decisions with legal effect)
Agent account management	Art. 6(1)(b) — Contract performance
Booking and viewing management	Art. 6(1)(b) — Contract performance

Market analysis reports contain only aggregate counts (e.g., "23 buyers searching in Coimbra") and never identify individual buyers. We apply a minimum group size of 5 (k-anonymity) to prevent re-identification.

4. AI Chatbot Disclosure

The chat assistant you interact with is an AI system, not a human agent. It is designed to help you find suitable properties by asking about your preferences. A human agent may take over the conversation at any point. In accordance with the EU AI Act (Art. 50), we disclose this at the start of every conversation.

5. Automated Profiling

We use automated profiling to generate a lead score for each contact. This scoring system evaluates:

Response patterns: How quickly and consistently you respond to messages
Property interest: Number of properties viewed, prospect pages opened
Engagement level: Viewing attendance, follow-up interactions
Language signals: Expressions of urgency, readiness to purchase, financing status

Lead scores (hot, warm, cold) are used solely to help agents prioritize their follow-ups and provide timely service. No decisions producing legal effects or similarly significant effects are made solely by automated means. Agents always review scores in context before taking action.

You have the right to object to automated profiling at any time by contacting the agency directly or sending a message in the WhatsApp conversation. Upon objection, your lead score will be removed and the agent will manage your inquiry without automated prioritization.

6. Data Retention

Lead personal data: Anonymized after 24 months with no message in either direction and no update to your record (the period starts again whenever there is a new message or an update), unless a viewing is upcoming or a deal is in progress. Anonymized within 30 days of an erasure request.
If you opt out: We keep only your phone number and dates, so that you are never contacted again. Everything else is anonymized 30 days after your last message or the last update to your record, whichever is later, but not while a viewing is upcoming or a deal is in progress.
Conversation messages: Message content is anonymized 12 months after the last message in the conversation, so the agent keeps the context while your enquiry is active. Metadata (timestamps, direction) is retained.
The assistant's short-term memory (times offered while booking a viewing): Deleted 30 days after the conversation goes quiet. Your answer when the assistant offers property alerts is kept as a record of your consent (or refusal).
Property preferences: Search profiles are anonymized, and preferences and topics the assistant noted are deleted, after 6 months without an update.
Viewing approval requests: Deleted after 24 months.
Website chats that did not lead to contact: Identifiers removed after 12 months.
Analytics events: Phone numbers removed after 12 months. Aggregate statistics retained indefinitely.
Aggregated demand reports: Retained indefinitely (contain no personal data).
Technical error logs: Deleted after 90 days.
Backups: Daily backups are kept for 35 days on our server in the EU (Frankfurt) and as encrypted copies in EU object storage (Frankfurt). Older backups are deleted automatically.
Agent data: Retained for the duration of the account. Deleted within 30 days after account closure or on request (NeraTek carries this out manually).
Invoices and billing records: Kept for 10 years, as Portuguese tax law requires.

7. Your Rights

Under GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict processing (your data is stored but not actively processed while a dispute is resolved)
Data portability
Object to processing based on legitimate interest
Object to automated profiling (see Section 5 above)

To exercise any of these rights, send "DELETE" in the WhatsApp conversation, or contact the agency directly. Your data will be fully erased within 30 days.

When your data is erased, we keep only your phone number as a do-not-contact (suppression) record. Its only purpose is to make sure that the real estate agency you contacted does not contact you again through NeraTek.

When you request restriction of processing, your data will be stored but not used for messaging, scoring, or analytics until the restriction is lifted.

8. Data Sharing and Sub-processors

Your data is shared with:

The real estate agency you contacted (data controller)
NeraTek (data processor — provides the technology platform)

We do not sell your personal data to third parties.

NeraTek engages the following sub-processors to deliver the service. Each sub-processor is bound by a Data Processing Agreement (DPA) and processes only the minimum data necessary.

Sub-processor	Purpose	Location	Transfer Mechanism
DigitalOcean	Infrastructure hosting and backup storage	EU (Frankfurt, Germany)	N/A (EU)
Twilio	WhatsApp and SMS messaging	US	DPF + Twilio BCRs (SCCs as fallback)
Google (Calendar)	Scheduling viewings in agents' calendars	US	DPF + SCCs
Google (Workspace / Gmail)	Sending notification and follow-up emails, including emails to you	US / global	DPF + SCCs
Meta / WhatsApp	Message delivery	US / EU	DPF
OpenAI Ireland Ltd	AI model inference (not used for model training)	Ireland; processing may take place in the US	SCCs
Anthropic (Claude API)	AI model inference for the next version of the assistant (not used for model training)	US	SCCs
Resend	Transactional email delivery	US	SCCs
Sentry	Error monitoring and diagnostics	US	SCCs

Map geocoding (no data about you): to show an agency's property listings on a map, the listing addresses may be sent to Google's Geocoding API (US, DPF) when enabled, or otherwise to the OpenStreetMap Foundation's Nominatim service (United Kingdom and EU; UK adequacy decision). Only property addresses are sent, never lead data.

Billing of NeraTek's customers (separate from your data): Stripe (US, DPF + SCCs) processes subscription payments of the agencies and agents who use NeraTek. NeraTek is the controller for this billing data. Stripe is not a sub-processor of your data and receives no lead data.

The list of sub-processors may change. Agencies are notified at least 30 days before a sub-processor is added or replaced.

9. International Transfers

Your data may be processed outside the European Economic Area (EEA) by the US-based sub-processors listed above: Twilio, Google, Meta/WhatsApp, OpenAI, Resend, and Sentry. OpenAI's contracting entity for the EEA is OpenAI Ireland Ltd, but processing may take place in the US.

The primary transfer mechanism is the EU-US Data Privacy Framework (DPF), under which certified US companies commit to adequate data protection standards recognized by the European Commission. Standard Contractual Clauses (SCCs) as approved by the European Commission (Implementing Decision (EU) 2021/914) apply where a sub-processor is not DPF-certified, and alongside the DPF where listed above. Twilio also relies on its Binding Corporate Rules. Data is encrypted in transit (TLS).

DigitalOcean hosts all primary infrastructure in the EU (Frankfurt region), and backup copies are stored in DigitalOcean's Frankfurt region (EU), so your data at rest remains within the EEA.

10. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and application-level encryption at rest for sensitive tokens (AES-256-GCM), role-based access controls, separation between agencies (every query is filtered by agency, with database row-level security as an additional safeguard), rate limiting, an audit log of data changes, exports of personal data and GDPR erasures, and security reviews.

11. Google User Data & Limited Use

When an agent connects their Google Calendar, with their explicit consent, NeraTek accesses it solely to provide appointment scheduling — checking availability (free/busy) and creating, updating, or cancelling property-viewing events at the agent's request. We do not read other calendar content for any other purpose, and we never sell Google user data.

Google Calendar data is used only to deliver this scheduling feature. It is never transferred to our AI provider (OpenAI) or any other third party to develop, train, or improve generalized artificial-intelligence or machine-learning models. Data processed by our AI provider is sent via the OpenAI API, which does not use it to train OpenAI's models.

NeraTek's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Contact

For data protection inquiries:
NeraTek — privacy@neratek.net

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) at www.cnpd.pt.