CasaConnect
CasaConnect

Privacy Policy

How we collect, use, and protect information on CasaConnect.

Privacy Policy: CasaConnect

Effective Date: January 23, 2026

Last Updated: January 23, 2026

1. Introduction & Ownership

This Privacy Policy describes how Thinkable Holdings Inc., a Delaware corporation operating under the trade name "CasaConnect"(collectively, "the Company," "we," "us," or "our"), processes personal data through our AI-powered lead qualification platform.

By accessing our Service, you acknowledge the data practices described in this policy. In compliance with the Spanish Law on Information Society Services (LSSI), Thinkable Holdings Inc. is the designated service provider for the CasaConnect platform.

2. Data Protection Roles & Representation

Under the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection (LOPDGDD):

  • Data Controller: The Real Estate Agency ("The Client") is the Controller for all "Lead Data" (prospective buyers/renters). The Agency determines the purpose and legal basis for contacting leads.
  • Data Processor: Thinkable Holdings Inc. acts as the Processor for Lead Data, handling information only according to the Agency’s instructions and our Data Processing Agreement (DPA).
  • Independent Controller: Thinkable Holdings Inc. is the Controller for "Account Data" (Agency admin details, billing, and platform usage analytics).
  • EU Representative: Pursuant to Article 27 of the GDPR, Thinkable Holdings Inc. has appointed [Insert Name of EU Rep Service, e.g., European Data Rep SL] as its representative in the European Union. You may contact them at [Insert Email/Address in Spain].

3. Information We Collect

  • Account Data: Names, business emails, and billing details of Agency staff.
  • Lead Data: Information ingested from third-party sources (e.g., Meta Lead Ads, Idealista, Fotocasa) including phone numbers and property preferences.
  • AI Interaction Data: Transcripts and metadata of automated WhatsApp interactions between our AI agents and Leads.
  • Technical Logs: IP addresses, browser types, and timestamps used for security monitoring.

4. AI Transparency & Human Oversight

In accordance with the EU AI Act (2026):

  • Interaction Notice: Our platform is designed to ensure that Leads are informed they are interacting with an AI system.
  • No Automated Legal Decisions: Our AI performs qualification only. It does not make automated decisions that produce legal effects. Final real estate brokerage decisions remain with the human agents of the Agency (Human-in-the-loop).
  • Transparency: Any text generated or manipulated by our AI for public interest matters is marked or detectable as artificially generated.

5. International Data Transfers

Thinkable Holdings Inc. is based in the United States. While primary data residency for EU clients is maintained in AWS Frankfurt (eu-central-1), data may be processed in the US.

  • EU-U.S. Data Privacy Framework (DPF): Thinkable Holdings Inc. complies with the EU-U.S. DPF as set forth by the U.S. Department of Commerce. We rely on this adequacy decision for transfers from the EEA to the US.
  • Standard Contractual Clauses (SCCs): Where the DPF is not applicable, we utilize the 2021 Standard Contractual Clauses and conduct Transfer Impact Assessments (TIAs) to ensure a level of protection equivalent to that in the EU.

6. Data Subject Rights (ARCO-POL)

In compliance with Spanish and EU law, data subjects have the following rights:

  1. Access: To know what data is being processed.
  2. Rectification: To correct inaccurate data.
  3. Cancellation (Erasure): To request the deletion of data ("Right to be Forgotten").
  4. Opposition: To object to processing based on legitimate interest.
  5. Portability: To receive data in a structured, machine-readable format.
  6. Limitation: To restrict processing under specific legal conditions.

Note to Leads: Because we are a Data Processor, if you wish to exercise these rights regarding your lead info, please contact the Real Estate Agency directly.

7. Data Retention

We retain Account Data for the duration of the subscription. Lead Data is retained based on the "Data Retention Toggle" settings configured by the Agency. Upon termination, data is deleted or anonymized within 30 days.

8. Security

We implement TLS 1.3 encryption in transit and AES-256 encryption at rest. We utilize Zero Data Retention (ZDR) protocols where possible for AI API processing to ensure Lead Data is not used to train third-party LLMs.

9. Contact

For all privacy-related inquiries or to reach our Data Protection Officer:

Thinkable Holdings Inc. (dba CasaConnect)
Email: legal@wearecasaconnect.com
Address: [Insert Delaware Office Address, e.g., 1209 Orange Street, Wilmington, DE 19801, USA]