Privacy Policy

1. Who we are

PrivateAgentLeads is operated by [Full Name], [Address], [City], Philippines (DTI/SEC: registration in process). Data Protection Officer: [email].

2. Scope

This policy covers the PrivateAgentLeads website, the agent workspace, and client presentation links created by agents. It takes effect on the date shown above.

3. Our role

For agent account data, PrivateAgentLeads decides how the data is used and acts as the personal information controller.

For client and lead data that agents enter, each agent is the personal information controller of their own clients' data and PrivateAgentLeads acts as a personal information processor on the agent's behalf. This allocation is subject to legal review.

4. What we collect

Agent account data: name, email, sign-in method, display name and approval status, and contact details agents choose to show on presentation links.

Lead and client data entered by agents: names, phone numbers, emails, nationality, budget, property preferences, viewing dates and notes, follow-up notes, and AI Assistant conversations.

Technical data: sign-in and session records kept by our authentication provider, IP address and browser information recorded when you accept the Data Agreement or send a contact message, and basic error information needed to keep the service working.

Contact form data: your name, email and message.

5. Why we use it and our lawful basis

To provide the service you signed up for (contract); to secure the service, prevent abuse and investigate incidents (legitimate interest and legal obligation); to keep proof of your Data Agreement acceptance (legitimate interest in defending legal claims); and to send product updates only if you opt in (consent).

6. Who can access data

Each agent's leads are separated by database access controls so other agents cannot see them.

The operator can technically access stored data through administration tools, privileged server processes, hosting infrastructure and backups. We access identifiable lead data only for support you request, security, maintenance and debugging, or legal compliance, using the minimum necessary. Access made through the app's admin tools is recorded in an insert-only log that you can see under Support access history. Access made directly through the hosting provider's own database console is not captured by that log; it is limited to the same purposes.

At present the only person with administrative access is the operator.

7. Service providers

Lovable Cloud (application hosting, database, authentication and file storage); Google (only if you choose to sign in with Google); and an AI provider (OpenAI, accessed through the Lovable AI gateway) for the AI Assistant and follow-up drafting. Lead details you use with the AI Assistant are sent to that provider to generate a response.

We do not sell personal data, do not use lead data for marketing, and will never use it to contact your clients.

8. International transfers

Our hosting and AI providers may store or process data outside the Philippines. We rely on providers with recognized security practices and will put appropriate safeguards in place as required by law.

9. Security

Encrypted connections (HTTPS), encryption at rest provided by our hosting provider, per-agent database access rules, private file storage with signed expiring links, revocable presentation links, role-based admin permissions, an insert-only admin access log, security headers and automatic sign-out after 30 minutes of inactivity. No system is completely secure.

10. Retention and deletion

We keep account and lead data while your account is active. When you or an administrator delete an account, the account and its leads, viewings, follow-ups, presentation links and AI history are deleted promptly. Backups are retained by our hosting provider for a limited period and then overwritten.

Minimal proof-of-consent records are kept after deletion: your Data Agreement acceptance records (version, date, IP address, browser and the text you agreed to) and admin access log entries about your account. They contain an anonymous account ID, not your name or email, and are kept only to establish, exercise or defend legal claims.

11. Your rights

Under the Data Privacy Act you have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, to claim damages, and to file a complaint.

Agents can export their data and delete their account from the Account page. For anything else, write to [email]. If you are an agent's client, please contact the agent first, since they control your data; we will help them respond.

12. Personal data breaches

If a breach is likely to cause serious harm, we will notify the National Privacy Commission and affected people within 72 hours of knowing about it, as required by law, and explain what happened and what we are doing.

13. Account suspension and closure

If an account is suspended, its data is kept but cannot be used until access is restored. If it is closed, data is handled as described in section 10.

14. Cookies

See the Cookie Policy. We use essential storage for sign-in and security, and optional analytics only with your consent.

15. Complaints

Contact our Data Protection Officer at [email]. You may also complain to the National Privacy Commission (privacy.gov.ph) at any time.

16. Changes

We will post updates here with a new version number and, for material changes, ask agents to accept again.