Privacy Policy

This Privacy Policy explains what data we collect when you use this platform (the "Service"). The Service is operated by Agua Real Estate (the "Operator", "we", "us"). We are committed to handling personal data in line with the EU General Data Protection Regulation (GDPR).

1. Who is this policy for

The Service has two types of user:

• Agents — concierge / villa-rental professionals who sign up to manage their clients' check-in experience.
• Guests — clients of an Agent who access their own stay portal via a unique link (and optional PIN) provided by the Agent. Guests do not create accounts.

2. What we collect

From Agents: name, email, password (stored hashed), agency name, optional logo / brand colour, contact details (phone, WhatsApp, email).

From Guests (entered by the Agent): name, email, phone, party size, stay dates, the villa they are staying at, any concierge requests they submit and the messages within them.

Technical data: IP address, browser, basic page views — used only to operate, debug and secure the Service.

We do not process payments. We do not collect credit-card data.

3. Why we use it

• To provide the Service (showing each guest the right villa, dates, requests, etc.).
• To let Agents communicate with their guests via the platform.
• To enforce platform rules (suspending agencies that break our Terms).
• To improve the product based on aggregate usage.

4. Where it is stored

Data is stored on Supabase (Postgres) in the EU region. File uploads (PDFs, photos) are stored on Supabase Storage in the EU region. We do not transfer personal data outside the EU.

5. Who can see it

Each Agent can only see their own data and their own guests' data — agencies are isolated from each other. The Operator's super-admin team can technically access any agency's data for support, abuse investigation, or to comply with a legal request.

We do not sell or share personal data with third parties for marketing purposes.

6. How long we keep it

Agency accounts and their data are retained for as long as the account is active. If an account is deleted, all associated data (villas, bookings, requests, files) is deleted within 30 days.

7. Your rights

Under GDPR you have the right to access, correct, export and delete your personal data. Email info@aguarealestate.com and we'll respond within 30 days.

8. Cookies

We use only essential cookies: a Supabase Auth session cookie for Agents, and a per-stay PIN cookie for Guests. We do not use analytics or advertising cookies.

9. Changes

We may update this policy. The "Last updated" date at the top will change and material changes are notified to Agents via email.

Questions? Email info@aguarealestate.com.