Privacy Policy

How we collect, use, and protect your personal data

Last Updated: 20 April 2026

1. Data Controller

Trovara GmbH

Registered Business Address: Florastraße 75, 40217 Düsseldorf, Germany
Company Registration: HRB 112091 (Amtsgericht Düsseldorf)
VAT ID (USt-IdNr.): DE460560686

Contact:

Email: info@trovara.io

Privacy Inquiries: privacy@trovara.io

Data Protection Contact: dpo@trovara.io (Trovara GmbH has voluntarily designated a Data Protection Contact reachable at this address for all GDPR-related enquiries.)

2. Personal Data We Collect

2.1 Account Data (GDPR Art. 6(1)(b) - Contract Performance)

  • Email address
  • Name (first and last)
  • Authentication method (bcrypt password hash, or your Google account ID if you use Sign in with Google)
  • Account creation date

2.2 Profile Data (GDPR Art. 6(1)(b))

  • City and country (for regional context)
  • Investment preferences (property types, budget ranges)
  • Property search criteria
  • Phone number (optional, only if provided)

2.3 Usage Data (GDPR Art. 6(1)(f) - Legitimate Interest)

  • IP address (anonymized after 7 days)
  • Browser type and version
  • Device information
  • Pages visited and time spent
  • Search queries and report generation history
  • Login timestamps and session data

2.4 Payment Data (GDPR Art. 6(1)(b))

  • Transaction IDs and payment status (via Stripe)
  • Billing address (if provided)
  • Note: We do NOT store credit card numbers - Stripe handles all card data

2.5 Communication Data (GDPR Art. 6(1)(a) - Consent)

  • Email communications (if opted in)
  • Newsletter preferences
  • Support ticket content

2.6 Buyer Profile Data (GDPR Art. 6(1)(a) - Consent)

When generating property reports, you may optionally provide:

  • Purchase purpose (primary residence, investment, holiday home)
  • Buying timeline
  • Nationality
  • Risk tolerance
  • Intended property use
  • Annual income range

All buyer profile fields are optional with "Prefer not to say" options. This data is used for analytics and may be shared in anonymized, aggregated form with partner agencies (see B2B Services below).

3. How We Use Your Data
PurposeLegal BasisGDPR Article
Account managementContract performanceArt. 6(1)(b)
Property report generationContract performanceArt. 6(1)(b)
Payment processingContract performanceArt. 6(1)(b)
Marketing communicationsConsent (opt-in)Art. 6(1)(a)
Security & fraud preventionLegitimate interestArt. 6(1)(f)
Legal compliance (AML, tax)Legal obligationArt. 6(1)(c)
Service improvementLegitimate interestArt. 6(1)(f)
B2B partner referralsConsent (opt-in)Art. 6(1)(a)
Anonymized market analyticsLegitimate interestArt. 6(1)(f)
3B. B2B Services & Lead Generation

Partner Network

We connect users with verified Italian property professionals including:

  • Licensed real estate agents (agenti immobiliari)
  • Property lawyers (avvocati)
  • Mortgage brokers and finance partners
  • Surveyors and architects (geometri, architetti)

Consent-Based Referrals

If you opt-in to partner referrals, we may share:

  • Your name and contact information
  • Property search preferences and budget range
  • Regions of interest
  • Buying timeline

You can withdraw consent at any time via your Account Settings. Partners are contractually bound to use your data solely for the referral purpose and comply with GDPR.

Anonymized Analytics

We provide partners with anonymized, aggregated market insights (e.g., search trends by region, price bracket preferences). This data cannot identify individual users.

4. Data Sharing & Third-Party Processors

We share data only with trusted processors who are bound by Data Processing Agreements (DPAs) or equivalent contractual safeguards, and comply with GDPR. The table below names every third party that receives personal data from us — including those that receive only your IP address because their content loads in your browser:

ProcessorPurposeLocationSafeguards
Google Cloud PlatformApplication hosting (Compute Engine) and production database (Cloud SQL)Netherlands (EU)EU region, SCCs, DPA
StripePayment processing and fraud detectionUSA/EUPCI-DSS Level 1, SCCs, DPA
Google (Sign-In)Optional “Sign in with Google” authenticationUSA/EUSCCs, DPA
IONOS / United DomainsTransactional email delivery (SMTP)Germany (EU)GDPR-compliant, DPA
Brevo (Sendinblue)Newsletter and marketing email delivery — stores your email address and nameFrance (EU)EU processing, DPA
OpenAIAI property analysis and report narrative (GPT-4o); optional contract analysis — GDPR Art. 28 DPA signedUSASCCs, DPA
AnthropicDream Discovery assistant, chat replies and chart explanations (Claude)USASCCs, DPA
Perplexity AIRegional market intelligence — GDPR Art. 28 DPA signedUSASCCs, DPA
Google (Gemini API)Fallback AI analysis of property photographsUSASCCs, DPA
Google Maps PlatformMaps, Places, Street View, Distance Matrix, Solar, Air Quality, Address Validation, Geocoding APIsUSA/EUSCCs, DPA
Google Analytics 4 / Google AdsWebsite analytics and advertising measurement — only with your consentUSA/EUSCCs, DPA, Consent Mode
Meta PlatformsAdvertising measurement via Meta Pixel and the server-side Conversions API — only with your consentIreland (EU) / USASCCs, DPA
Microsoft ClaritySession analytics and heatmaps — only with your consentUSASCCs, DPA
CASAFARILicensed property data and market analyticsPortugal (EU)EU processing, GDPR-compliant
OpenAPI Real EstateProperty transaction, cadastral and valuation dataItaly (EU)EU processing, DPA, Licensed API
SanityMagazine content management and image delivery (CDN receives your IP address)EU/USASCCs, DPA
ScraperAPIServer-side retrieval of the listing page you submit for analysisUSASCCs, DPA
CloudflareCDN delivery of map interface graphics (receives your IP address)USA/EUSCCs, DPA
OpenStreetMap FoundationMap tile delivery (receives your IP address)United KingdomUK adequacy decision
4B. Automated Decision-Making and AI Processing (GDPR Article 22)

What AI is Used For

We use AI systems (OpenAI GPT-4o, Anthropic Claude, Google Gemini and Perplexity AI) to perform automated analysis of property and market data. This includes generating investment scores, rental yield projections, and neighbourhood analysis. This AI processing concerns the property being analysed and market conditions — not individual user profiles or personal characteristics.

No Fully-Automated Legally-Binding Decisions About You

Trovara does not subject users to fully-automated decisions that produce legal or similarly significant effects about them as individuals within the meaning of GDPR Article 22(1). Our AI outputs are:

  • Informational property analysis — not decisions about your eligibility for services
  • Presented as estimates to assist your human decision-making
  • Not used to approve or deny access to financial services, employment, or essential services

Your Right to Request Human Review

If you believe an AI-generated analysis or score in a Trovara report is significantly inaccurate or has caused you harm, you may contact our Data Protection Officer at dpo@trovara.io to request human review of the output. We will respond within 30 days. For more information, see our AI Transparency Statement.

4C. EU Data Act Notice (Regulation 2023/2854)

The EU Data Act (Regulation (EU) 2023/2854) entered into force on 11 January 2024 and applies from 12 September 2025. It establishes rules on the fair access to and use of data generated by connected products and related services.

Trovara's current services do not involve IoT-connected products or the primary data access obligations under the Data Act. However, where applicable to our data-sharing practices with business partners, we are committed to compliance with the Data Act's requirements on data portability, data access fairness, and switching facilitation.

We will update this section as regulatory guidance on the Data Act develops and as its obligations become directly relevant to our business operations.

5. Data Retention Periods
Data TypeRetention PeriodLegal Basis
Account data (active users)Duration of account + 2 yearsContract, legal obligations
Inactive accountsDeleted after 3 years of inactivityStorage limitation principle
Payment records10 yearsGerman tax law (AO §147)
Audit logs (security)7 yearsLegal compliance, security
Marketing consent recordsUntil consent withdrawn + 3 yearsGDPR accountability
6. Your GDPR Rights

Under GDPR, you have the following rights:

Right to Access (Art. 15)

Request a copy of all personal data we hold about you.
User Dashboard privacy@trovara.io

Right to Rectification (Art. 16)

Correct inaccurate or incomplete data.
Account Settings

Right to Erasure / "Right to be Forgotten" (Art. 17)

Request deletion of your data (subject to legal retention obligations).
Delete Account in User Dashboard

Right to Data Portability (Art. 20)

Receive your data in machine-readable format (JSON).
Export feature in User Dashboard

Right to Object (Art. 21)

Object to processing based on legitimate interest (e.g., marketing).
➜ Unsubscribe links in emails or Preferences

Right to Restriction (Art. 18)

Restrict processing while we verify data accuracy or lawfulness.
privacy@trovara.io

Right to Withdraw Consent (Art. 7(3))

Withdraw consent for marketing or optional processing at any time.
Communication Preferences

Right to Lodge a Complaint (Art. 77)

File a complaint with your local data protection authority:
NRW (lead authority for Trovara GmbH): LDI NRW — Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf
Germany (federal): BfDI (Federal Commissioner)
EU-wide list: EDPB Member Authorities

7. Google Maps Platform Data Collection

7.1 Google Services Integrated

Trovara integrates the following Google Maps Platform services to provide location intelligence in our property reports:

  • Google Maps JavaScript API (interactive property maps)
  • Google Places API (nearby amenities, points of interest)
  • Google Street View Static API (street-level neighborhood imagery)
  • Google Distance Matrix API (travel time and distance calculations)
  • Google Solar API (building solar potential analysis)
  • Google Air Quality API (local air quality data)
  • Google Address Validation API (property address verification)
  • Google Geocoding API (address-to-coordinate resolution)

7.2 Data Google May Collect

When you interact with Google Maps features in Trovara, Google may collect certain information including your IP address, device information, and usage data. This data collection is governed by the Google Privacy Policy.

7.3 Your Rights Regarding Google Data

For information about how Google processes your data and your rights with respect to that data, please refer to the Google Privacy Policy and Google Maps/Google Earth Additional Terms of Service.

8. Data Security

We implement industry-standard security measures:

  • Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
  • Authentication: e-mail and password with bcrypt hashing, or optional Google Sign-In (OAuth 2.0). Sessions are held in an httpOnly, secure cookie.
  • Access Controls: Role-based access, least privilege principle
  • Monitoring: 24/7 security logging and anomaly detection
  • Regular Audits: Annual penetration testing and security reviews
  • Incident Response: 72-hour breach notification process (GDPR Art. 33)
9. Cookies & Tracking

We use cookies for essential functionality and, with your consent, analytics. See our detailed Cookie Policy.

Essential Cookies (No Consent Required):
  • Authentication session (httpOnly, secure)
  • CSRF protection tokens
  • Load balancing
Analytics Cookies (Opt-In Required):
  • Google Analytics 4 & Microsoft Clarity — usage statistics and UX diagnostics (only with your consent)
Advertising & Remarketing Cookies (Opt-In Required):
  • Google Ads — conversion tracking & remarketing
  • Google Signals — cross-device insights for signed-in Google users (with your consent; not anonymous)
  • Meta Pixel — ad measurement & remarketing

These run only with your Marketing consent, which you can withdraw at any time via the cookie settings. You can control Google data via 'My Activity' and Google Ads Settings, and Meta data in your Meta account.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, contact us immediately at privacy@trovara.io for deletion.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be notified via email (for registered users) and prominently posted on our website at least 30 days before taking effect.

Version History: Available upon request at privacy@trovara.io

12. Contact Us

Trovara GmbH

Privacy Inquiries: privacy@trovara.io

Data Protection Contact: dpo@trovara.io

General Inquiries: info@trovara.io

For GDPR requests, please include "GDPR Request" in the subject line and specify the right you wish to exercise.