Privacy policy

Controller

The controller for processing on this website and in the application is:

Provider

Vantero Tec SL, SL
C/. Fluvia 1
07009 Palma
Spain

Email

office@xoro.es

Who is affected

Three groups: visitors to this website, users of the application (agents and their agencies) and recipients of a dossier link (prospects). Below you find what happens for each group.

Visiting the home page

When you open the home page, your browser sends technically necessary data to the server: IP address, date and time, the requested address and the browser type. The server processes it to deliver the page and to keep the service secure. The legal basis is Art. 6(1)(f) GDPR (operation and security of the website).

These server logs are deleted after 90 days.

The home page sets no cookies and loads nothing from third-party servers. There is no analytics, no tracking and no external fonts.

Account, login and registration

For an account we store name, email address, the agency’s name and an identifier for the agency. The password is stored only as a hash. We also store the time of the last login. The basis is Art. 6(1)(b) GDPR (contract). The data stays until the account is deleted. The owner can delete the agency with all its data under Settings, Office. On request we do it for you.

Registration and login by link: for this we store your email address and a one-time key, the key only as a hash. The link is valid for 30 minutes and exactly once. We delete expired and used entries after one day at the latest.

Protection against automated attacks: for login attempts we briefly store the IP address and a hash of the email address entered, to slow down excessive attempts. The entries are deleted after 60 minutes at most. The basis is Art. 6(1)(f) GDPR (security).

Cookies: on the login and registration pages and after login, the server sets a session cookie. It is technically necessary, lasts 12 hours after login and is extended while you use the service. It is used neither for analytics nor for advertising.

Content that agents create in XORO

In XORO, agents store property data, photos, floor plans, generated dossiers and details about prospects (for example names and notes). This can include data of third parties. The respective agency is responsible for this content. XORO processes it on its behalf and on its instructions (Art. 28 GDPR). The agency concludes a data processing agreement with XORO for this.

AI features and sharing with service providers

Text generation: the text of a dossier is written by Claude from Anthropic (USA). For this, the property data, the settings for tone and prospect (including free text the agent enters for it) and reduced copies of the property photos go to Anthropic.

Reading in a brochure: when an agent uploads a brochure (PDF, photo, screenshot or Word file), the file goes to Anthropic so the details can be read out.

Redrawing a floor plan: only when the agent presses the button for it does the floor plan image go to OpenAI (USA).

Dossier links: data of recipients

If an agent sends you a link to a dossier and you open it, XORO logs for the agent:

• the time of opening, which property you view and how long the page stayed open (time spent)
• the device class (desktop, mobile, tablet) and whether another device opens the same link
• IP address and device only as a hash, from which neither can be recovered

XORO does not learn your email address, because the agent sends the link. Without a PIN the link page sets no cookies. The controller for this evaluation is the agent who sent the link (legitimate interest, Art. 6(1)(f) GDPR). XORO processes the data on the agent’s behalf. The evaluation is deleted after 90 days. You can object with the agent.

Recipients and service providers

Your data only goes to the following service providers, as far as the respective feature is used:

• Hosting: Alfahosting 06112 Halle
• Anthropic, USA: text generation and reading in brochures
• SMTP2GO: sending email (login and confirmation links, notifications to agents)
• OpenAI, USA: redrawing floor plans, only on button press

For service providers outside the EU, the safeguards under Art. 44 et seq. GDPR apply, that is an adequacy decision or standard contractual clauses, as far as the provider offers them.

Storage periods at a glance

Account and agency data: until the account is deleted. Login links: one day beyond expiry at most. Counters against attacks: 60 minutes at most. Evaluation of dossier links: see above. Server logs: see above.

Your rights

You have the following rights towards the controller:

• access to your data (Art. 15 GDPR)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing based on legitimate interests (Art. 21)

To exercise them, write to office@xoro.es. If it concerns data from a dossier link, it is best to contact the agent who sent the link first.

You can lodge a complaint with a data protection supervisory authority, in particular in the member state where you live or work.

Automated decisions

There is no automated decision-making under Art. 22 GDPR. The AI writes texts but decides nothing about people.