Privacy Policy
How we collect, use, and protect your personal data
Last Updated: 20 April 2026
Trovara GmbH
Registered Business Address: Florastraße 75, 40217 Düsseldorf, Germany
Company Registration: HRB 112091 (Amtsgericht Düsseldorf)
VAT ID (USt-IdNr.): DE460560686
Contact:
Email: info@trovara.io
Privacy Inquiries: privacy@trovara.io
Data Protection Contact: dpo@trovara.io (Trovara GmbH has voluntarily designated a Data Protection Contact reachable at this address for all GDPR-related enquiries.)
2.1 Account Data (GDPR Art. 6(1)(b) - Contract Performance)
- Email address
- Name (first and last)
- Authentication method (bcrypt password hash, or your Google account ID if you use Sign in with Google)
- Account creation date
2.2 Profile Data (GDPR Art. 6(1)(b))
- City and country (for regional context)
- Investment preferences (property types, budget ranges)
- Property search criteria
- Phone number (optional, only if provided)
2.3 Usage Data (GDPR Art. 6(1)(f) - Legitimate Interest)
- IP address (anonymized after 7 days)
- Browser type and version
- Device information
- Pages visited and time spent
- Search queries and report generation history
- Login timestamps and session data
2.4 Payment Data (GDPR Art. 6(1)(b))
- Transaction IDs and payment status (via Stripe)
- Billing address (if provided)
- Note: We do NOT store credit card numbers - Stripe handles all card data
2.5 Communication Data (GDPR Art. 6(1)(a) - Consent)
- Email communications (if opted in)
- Newsletter preferences
- Support ticket content
2.6 Buyer Profile Data (GDPR Art. 6(1)(a) - Consent)
When generating property reports, you may optionally provide:
- Purchase purpose (primary residence, investment, holiday home)
- Buying timeline
- Nationality
- Risk tolerance
- Intended property use
- Annual income range
All buyer profile fields are optional with "Prefer not to say" options. This data is used for analytics and may be shared in anonymized, aggregated form with partner agencies (see B2B Services below).
| Purpose | Legal Basis | GDPR Article |
|---|---|---|
| Account management | Contract performance | Art. 6(1)(b) |
| Property report generation | Contract performance | Art. 6(1)(b) |
| Payment processing | Contract performance | Art. 6(1)(b) |
| Marketing communications | Consent (opt-in) | Art. 6(1)(a) |
| Security & fraud prevention | Legitimate interest | Art. 6(1)(f) |
| Legal compliance (AML, tax) | Legal obligation | Art. 6(1)(c) |
| Service improvement | Legitimate interest | Art. 6(1)(f) |
| B2B partner referrals | Consent (opt-in) | Art. 6(1)(a) |
| Anonymized market analytics | Legitimate interest | Art. 6(1)(f) |
Partner Network
We connect users with verified Italian property professionals including:
- Licensed real estate agents (agenti immobiliari)
- Property lawyers (avvocati)
- Mortgage brokers and finance partners
- Surveyors and architects (geometri, architetti)
Consent-Based Referrals
If you opt-in to partner referrals, we may share:
- Your name and contact information
- Property search preferences and budget range
- Regions of interest
- Buying timeline
You can withdraw consent at any time via your Account Settings. Partners are contractually bound to use your data solely for the referral purpose and comply with GDPR.
Anonymized Analytics
We provide partners with anonymized, aggregated market insights (e.g., search trends by region, price bracket preferences). This data cannot identify individual users.
We share data only with trusted processors who are bound by Data Processing Agreements (DPAs) or equivalent contractual safeguards, and comply with GDPR. The table below names every third party that receives personal data from us — including those that receive only your IP address because their content loads in your browser:
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Google Cloud Platform | Application hosting (Compute Engine) and production database (Cloud SQL) | Netherlands (EU) | EU region, SCCs, DPA |
| Stripe | Payment processing and fraud detection | USA/EU | PCI-DSS Level 1, SCCs, DPA |
| Google (Sign-In) | Optional “Sign in with Google” authentication | USA/EU | SCCs, DPA |
| IONOS / United Domains | Transactional email delivery (SMTP) | Germany (EU) | GDPR-compliant, DPA |
| Brevo (Sendinblue) | Newsletter and marketing email delivery — stores your email address and name | France (EU) | EU processing, DPA |
| OpenAI | AI property analysis and report narrative (GPT-4o); optional contract analysis — GDPR Art. 28 DPA signed | USA | SCCs, DPA |
| Anthropic | Dream Discovery assistant, chat replies and chart explanations (Claude) | USA | SCCs, DPA |
| Perplexity AI | Regional market intelligence — GDPR Art. 28 DPA signed | USA | SCCs, DPA |
| Google (Gemini API) | Fallback AI analysis of property photographs | USA | SCCs, DPA |
| Google Maps Platform | Maps, Places, Street View, Distance Matrix, Solar, Air Quality, Address Validation, Geocoding APIs | USA/EU | SCCs, DPA |
| Google Analytics 4 / Google Ads | Website analytics and advertising measurement — only with your consent | USA/EU | SCCs, DPA, Consent Mode |
| Meta Platforms | Advertising measurement via Meta Pixel and the server-side Conversions API — only with your consent | Ireland (EU) / USA | SCCs, DPA |
| Microsoft Clarity | Session analytics and heatmaps — only with your consent | USA | SCCs, DPA |
| CASAFARI | Licensed property data and market analytics | Portugal (EU) | EU processing, GDPR-compliant |
| OpenAPI Real Estate | Property transaction, cadastral and valuation data | Italy (EU) | EU processing, DPA, Licensed API |
| Sanity | Magazine content management and image delivery (CDN receives your IP address) | EU/USA | SCCs, DPA |
| ScraperAPI | Server-side retrieval of the listing page you submit for analysis | USA | SCCs, DPA |
| Cloudflare | CDN delivery of map interface graphics (receives your IP address) | USA/EU | SCCs, DPA |
| OpenStreetMap Foundation | Map tile delivery (receives your IP address) | United Kingdom | UK adequacy decision |
What AI is Used For
We use AI systems (OpenAI GPT-4o, Anthropic Claude, Google Gemini and Perplexity AI) to perform automated analysis of property and market data. This includes generating investment scores, rental yield projections, and neighbourhood analysis. This AI processing concerns the property being analysed and market conditions — not individual user profiles or personal characteristics.
No Fully-Automated Legally-Binding Decisions About You
Trovara does not subject users to fully-automated decisions that produce legal or similarly significant effects about them as individuals within the meaning of GDPR Article 22(1). Our AI outputs are:
- Informational property analysis — not decisions about your eligibility for services
- Presented as estimates to assist your human decision-making
- Not used to approve or deny access to financial services, employment, or essential services
Your Right to Request Human Review
If you believe an AI-generated analysis or score in a Trovara report is significantly inaccurate or has caused you harm, you may contact our Data Protection Officer at dpo@trovara.io to request human review of the output. We will respond within 30 days. For more information, see our AI Transparency Statement.
The EU Data Act (Regulation (EU) 2023/2854) entered into force on 11 January 2024 and applies from 12 September 2025. It establishes rules on the fair access to and use of data generated by connected products and related services.
Trovara's current services do not involve IoT-connected products or the primary data access obligations under the Data Act. However, where applicable to our data-sharing practices with business partners, we are committed to compliance with the Data Act's requirements on data portability, data access fairness, and switching facilitation.
We will update this section as regulatory guidance on the Data Act develops and as its obligations become directly relevant to our business operations.
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Account data (active users) | Duration of account + 2 years | Contract, legal obligations |
| Inactive accounts | Deleted after 3 years of inactivity | Storage limitation principle |
| Payment records | 10 years | German tax law (AO §147) |
| Audit logs (security) | 7 years | Legal compliance, security |
| Marketing consent records | Until consent withdrawn + 3 years | GDPR accountability |
Under GDPR, you have the following rights:
Right to Access (Art. 15)
Request a copy of all personal data we hold about you.
➜ User Dashboard privacy@trovara.io
Right to Rectification (Art. 16)
Correct inaccurate or incomplete data.
➜ Account Settings
Right to Erasure / "Right to be Forgotten" (Art. 17)
Request deletion of your data (subject to legal retention obligations).
➜ Delete Account in User Dashboard
Right to Data Portability (Art. 20)
Receive your data in machine-readable format (JSON).
➜ Export feature in User Dashboard
Right to Object (Art. 21)
Object to processing based on legitimate interest (e.g., marketing).
➜ Unsubscribe links in emails or Preferences
Right to Restriction (Art. 18)
Restrict processing while we verify data accuracy or lawfulness.
➜ privacy@trovara.io
Right to Withdraw Consent (Art. 7(3))
Withdraw consent for marketing or optional processing at any time.
➜ Communication Preferences
Right to Lodge a Complaint (Art. 77)
File a complaint with your local data protection authority:
➜ NRW (lead authority for Trovara GmbH): LDI NRW — Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf
➜ Germany (federal): BfDI (Federal Commissioner)
➜ EU-wide list: EDPB Member Authorities
7.1 Google Services Integrated
Trovara integrates the following Google Maps Platform services to provide location intelligence in our property reports:
- Google Maps JavaScript API (interactive property maps)
- Google Places API (nearby amenities, points of interest)
- Google Street View Static API (street-level neighborhood imagery)
- Google Distance Matrix API (travel time and distance calculations)
- Google Solar API (building solar potential analysis)
- Google Air Quality API (local air quality data)
- Google Address Validation API (property address verification)
- Google Geocoding API (address-to-coordinate resolution)
7.2 Data Google May Collect
When you interact with Google Maps features in Trovara, Google may collect certain information including your IP address, device information, and usage data. This data collection is governed by the Google Privacy Policy.
7.3 Your Rights Regarding Google Data
For information about how Google processes your data and your rights with respect to that data, please refer to the Google Privacy Policy and Google Maps/Google Earth Additional Terms of Service.
We implement industry-standard security measures:
- Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
- Authentication: e-mail and password with bcrypt hashing, or optional Google Sign-In (OAuth 2.0). Sessions are held in an httpOnly, secure cookie.
- Access Controls: Role-based access, least privilege principle
- Monitoring: 24/7 security logging and anomaly detection
- Regular Audits: Annual penetration testing and security reviews
- Incident Response: 72-hour breach notification process (GDPR Art. 33)
We use cookies for essential functionality and, with your consent, analytics. See our detailed Cookie Policy.
- Authentication session (httpOnly, secure)
- CSRF protection tokens
- Load balancing
- Google Analytics 4 & Microsoft Clarity — usage statistics and UX diagnostics (only with your consent)
- Google Ads — conversion tracking & remarketing
- Google Signals — cross-device insights for signed-in Google users (with your consent; not anonymous)
- Meta Pixel — ad measurement & remarketing
These run only with your Marketing consent, which you can withdraw at any time via the cookie settings. You can control Google data via 'My Activity' and Google Ads Settings, and Meta data in your Meta account.
Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, contact us immediately at privacy@trovara.io for deletion.
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be notified via email (for registered users) and prominently posted on our website at least 30 days before taking effect.
Version History: Available upon request at privacy@trovara.io
Trovara GmbH
Privacy Inquiries: privacy@trovara.io
Data Protection Contact: dpo@trovara.io
General Inquiries: info@trovara.io
For GDPR requests, please include "GDPR Request" in the subject line and specify the right you wish to exercise.