Legal

Privacy policy and data processing

Last updated: 3 June 2026

This policy explains how Hernan Bustos Real Estate Experts processes personal data on the public website, private application, AI assistant, access forms, contacts, referrals, and real-estate communications.

Controller

Controller: Hernan Bustos Real Estate Experts. Website: hernanbustos.com. Application: leadtrack360.com. Privacy and rights contact: info@hernanbustos.com.

Data we process

  • Account data: first name, last name, email, phone, country, role, access status, creation date, and update date.
  • Authentication data: sessions, IP address, user agent, connected sign-in providers, and authorized permissions.
  • Organization data: memberships, invitations, enabled modules, administrative activity, and permissions.
  • Chat and lead data: conversations, messages, data provided in chat, lead status, send events, and language preferences.
  • Contacts and referrals: contact data provided by users or synchronized from Google Contacts when the user links an account.
  • Formal property visits: client name, identity-document type and number, explicit consent evidence, visit date, demographic ranges, six property ratings, short feedback, amount the client would pay, touchscreen signature, report recipients, delivery status, and optional owner-satisfaction response.
  • Communications: transactional emails, invitations, access requests, and referrals.
  • Security data: technical events needed for abuse prevention, authentication, and platform protection.

Purposes and legal bases

  • Providing the application and managing accounts: contract performance or pre-contractual steps.
  • Managing leads, referrals, and real-estate requests: requested service performance and non-intrusive legitimate commercial interest.
  • Recording a formal property visit, evidencing attendance, collecting unedited client feedback, and reporting it to the property owner and buyer's agent: explicit consent, requested service performance, legitimate interest, and legal obligations where applicable.
  • Sending access, invitation, and notification emails: service performance and legitimate interest.
  • Synchronizing Google contacts: user consent when the user links an account and grants permissions.
  • Configuring AI assistant responses: service performance and, where applicable, consent for data voluntarily provided.
  • Security, audit, and abuse prevention: legitimate interest and legal compliance.
  • Handling GDPR requests: legal obligation.

Processors and providers

The platform uses technical providers that may process data as processors: VPS and database infrastructure providers for hosting and storage; Cloudflare Turnstile for abuse prevention; an OpenAI-compatible AI provider for chat inference; Resend for transactional email; Google for sign-in and contact synchronization when the user links an account; Gravatar to show a profile image through an email hash. Advisors or providers strictly needed for support, legal compliance, or security may also be involved.

International transfers

Some providers may process data outside the European Economic Area. In those cases, appropriate safeguards are used, such as adequacy decisions, standard contractual clauses, data processing agreements, and suitable technical and organizational measures.

Retention periods

  • Account and organization data: while the account exists or while needed to provide the service.
  • Sessions and security data: for the time needed for authentication, abuse prevention, and audit.
  • Leads, referrals, and commercial communications: during the commercial relationship and applicable legal periods.
  • Synchronized contacts: until deleted, the source is disconnected, or a valid request is fulfilled.
  • Formal visit evidence: the agency-configured period, seven years by default, unless a shorter valid period applies or a legal hold requires retention. On expiry, identity links, report-recipient data, and signatures are removed while non-identifying aggregate feedback may be retained.
  • GDPR requests: a minimal proof of request handling is kept, preferably with an email hash after erasure.

Your rights

You may request access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where applicable. Authenticated users can download data and request erasure from Profile. You can also write to info@hernanbustos.com.

Complaints

If you believe processing does not comply with the law, you may complain to the competent supervisory authority. In Spain, this is the Spanish Data Protection Agency: aepd.es.