Privacy Policy

1. Data controller

Owner: Marta Jiménez Álvarez · Spanish tax ID 20264654K · Calle Teide, 14, 45930 Méntrida, Toledo, Spain · info@gatavia.com

Privacy enquiries: info@gatavia.com.

2. Data we may process

• Identity and contact data
• Account, authentication and preference data
• Property, booking, income, expense and professional activity data where linked to an individual
• Documents, contracts, invoices and files voluntarily uploaded
• Support requests and communications
• Technical and security logs such as access records, IP, device and security events
• Plan, purchase and payment-status information; full card details are handled by the payment provider

3. Purposes

• Create and manage accounts and sessions
• Provide Gatavia Check, Gatavia App, Library, guides, memberships and contracted services
• Process documents and generate requested analyses
• Manage purchases, subscriptions, billing and support
• Prevent fraud and unauthorised access
• Comply with legal obligations
• Improve security, performance and service operation
• Send marketing communications where consent or another valid legal basis exists

4. Legal bases

Depending on the processing, we rely on contract performance or pre-contractual steps, compliance with legal obligations, legitimate interests in security and service improvement, or consent where required. Consent can be withdrawn at any time for processing that depends on it.

5. Providers and recipients

Gatavia uses technology providers including Supabase for database/authentication, Stripe for payments, email and infrastructure providers, and AI providers when a specific feature requires them. Only data necessary for the relevant service is shared under applicable safeguards. Authorities may receive data where legally required.

6. AI and uploaded documents

When a user requests document analysis or extraction, relevant files or excerpts may be processed by automated systems or configured AI providers. Do not upload sensitive information that is not necessary. Users uploading third-party data must have a valid legal basis.

7. International transfers

Providers may process data from countries different from the user’s location. Where required, recognised safeguards such as adequacy decisions, standard contractual clauses or equivalent lawful mechanisms will be used.

8. Retention

Data is kept for as long as necessary to provide the service and manage the contractual relationship, then where required for legal claims and statutory obligations. Exact periods vary by data type, product and applicable legal duties.

9. Rights

Where applicable, you may request access, rectification, erasure, objection, restriction, portability and withdrawal of consent by contacting info@gatavia.com. We may reasonably verify identity. You may also complain to your competent data protection authority.

10. Managers processing third-party data

Where a property manager processes personal data through Gatavia on behalf of owners or clients, the parties must identify their controller/processor roles. Additional data-processing terms may be required.

11. Security

We apply reasonable technical and organisational safeguards. No system is completely secure. Users must protect credentials and report suspected unauthorised access.

12. Updates

This policy may change to reflect legal, technical, functional or provider changes. The version published here is the current version.