Version 1.5 · Last updated: October 2026
1. Who is the data controller
The controller of the personal data collected through yolisto.app ("Yolisto" or "the Platform") is:
- Company name: CIIGMA TECHNOLOGIES S.L.
- Tax ID (NIF): B26584524
- Registration: Commercial Registry of Madrid, sheet M-876098
- Registered address: Calle Ruiz 14, 2º Izq., 28004 Madrid, Spain
- Privacy contact: legal@yolisto.app
CIIGMA TECHNOLOGIES S.L. is a company established in Spain. The processing of your personal data is therefore governed by Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and by Spanish Organic Law 3/2018 on Personal Data Protection ("LOPDGDD").
2. Who this policy protects
This policy applies to everyone whose data we process, regardless of the country from which they use the Platform. The GDPR protects your data because the controller is established in the European Union, even if you are located in Venezuela or anywhere else.
We distinguish four groups:
- Visitors: people who browse the Platform without registering or submitting forms.
- Property enquirers (leads): people who contact an agency through a Platform form to ask about a property.
- Agencies and agents with an account: real estate professionals who register to publish listings and manage enquiries.
- Agency advisors without an account: people whose agency enables a link for them to send properties from their phones.
Yolisto is a listings portal. Properties are published by the advertising agencies and agents. Yolisto is not a real estate broker, is not a party to any transaction, and does not provide legal, financial, or real estate advice.
3. What data we collect
Visitors:
- Technical browsing data (IP address, device and browser type, pages visited) and, only if you accept the campaign-measurement cookie, the campaign or website you came from, as described in sections 4 and 5 and in the Cookie Policy.
- Queries typed into the AI search or the price estimator. These queries normally contain no personal data; please do not include personal information about yourself or others in them.
Property enquirers (leads):
- Name, contact details (email and/or phone), and the message you write when enquiring about a property.
Agencies and agents with an account:
- Contact person details (name, email, phone), agency details (name, professional information), and the content they publish on the Platform (listings, photos, descriptions).
- If the agency connects its property management software: the identifier of its account in that software, the access credential it gives us (which we store encrypted) and the data of the properties in its portfolio that we import.
Agency advisors without an account:
- Name and WhatsApp number provided to us by their agency, and the drafts they send.
We do not collect special categories of data (health, beliefs, etc.) and ask you not to include them in any form or message.
4. Why we use your data and on what legal basis
| Processing | Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Agency account | Contact and agency details, published content | Sign-up, dashboard management, publishing listings, receiving leads | Art. 6(1)(b): performance of the contract (the Platform's Terms of Use) |
| User account (individual) | Email, name and the profile details you choose to provide voluntarily (buying goal, whether you live in Venezuela or abroad and in which country, indicative budget, timeframe and cities of interest) | Creating your account, saving favourites, managing your searches and personalising what you see; and, in aggregated and anonymised form, producing market statistics | Art. 6(1)(b) (performance of the contract) for the account and personalisation; art. 6(1)(f) (legitimate interest) for aggregated, anonymised statistics. All profile details are optional and you may leave them blank or change them at any time |
| Saved searches and alerts | The search criteria you save and your contact channel | Notifying you when new listings match your saved search | Art. 6(1)(b): provision of the service you activate; you can turn off any or all alerts at any time |
| Lead handling and delivery | Enquirer's name, contact details, and message | Delivering your enquiry to the advertising agency so it can respond | Art. 6(1)(b): pre-contractual steps taken at the data subject's own request |
| Assisted-purchase service request | Name, country of residence, buying timeframe, indicative budget range, preferred contact channel and its value, and the property of interest | Handling your request for the remote purchase-support service provided by Yolisto: assessing your case, contacting you through the channel you indicate and, where applicable, preparing a quote for the service | Art. 6(1)(b): pre-contractual steps taken at the data subject's own request, with a view to a possible service contract between you and Yolisto |
| Our own usage measurement | A record of the actions taken on the Platform (for example, signing up, saving a favourite or a search, sending an enquiry or publishing a listing), linked to your account if you have one, and the language | Measuring how the Platform is used and improving it. We do not use third-party analytics tools | Art. 6(1)(f): legitimate interest in measuring and improving the service |
| Campaign measurement | The campaign or website you came from, stored in the campaign-measurement cookie and linked to our own usage measurement | Learning which campaigns and outreach channels bring us users | Art. 6(1)(a): your consent, which you give or refuse in the cookie notice and can withdraw at any time from "Cookie settings" in the page footer. Without your consent we do not collect this data by any means, including when you sign up |
| Our own marketing communications | Sending you Yolisto news, if you authorize it | Consent (Art. 6(1)(a)); for agency clients, Art. 21.2 of Spanish Law 34/2002 (LSSI) for similar services | |
| AI search and price estimator | Query text; if you are logged in, linkage to your account | Providing the requested feature | Art. 6(1)(b): provision of the requested service |
| Statistics, indexes and market studies | Aggregated and anonymised listing and usage data that cannot identify you | Producing price indexes, reports and real estate market information products | Anonymised information is not personal data (Recital 26 GDPR); the prior aggregation step relies on legitimate interest (Art. 6.1.f) |
| Handling enquiries and rights requests | Contact details and request content | Responding and keeping a record | Art. 6(1)(c): legal obligations; Art. 6(1)(f): legitimate interest in handling enquiries |
| Advisor upload link | Advisor's name and WhatsApp, provided by their agency; drafts submitted | Attributing to each advisor what they send, allowing the agency to review it and to revoke access | Art. 6(1)(f): legitimate interest of the agency and of Yolisto in operating the service contracted by the agency; you may object (section 8) |
| Prevention of reused photographs | A technical fingerprint of each photograph (a numeric summary rather than the image), listing and agency identifiers, and a similarity measure | Detecting very similar photographs published by different agencies so that a person can review possible unauthorized uses; no measure is taken automatically | Art. 6(1)(f): legitimate interest in preventing fraud and protecting agencies' content (Recital 47 GDPR) |
| Retention of the original photograph | The original file of each photograph, without a mark and without metadata | Allowing the agency to recover its photo and regenerate the public copies | Art. 6(1)(b): performance of the contract with the agency |
| Import from the agency's software | Identifier and credential of the agency's account in its software; data and images of the properties in its portfolio | Bringing into Yolisto, and keeping updated, the properties the agency chooses to import. We only read the company's own properties; data that may come with them and is not published (for example, internal comments or the exact address) is discarded on import and not stored | Art. 6(1)(b): performance of the contract with the agency |
| Protecting the catalog against unauthorized copies | Copies of pages and images from other sites where we detect content copied from Yolisto (which may include names or contact details shown on them), their web address, the date and the result of the check | Checking and documenting unauthorized use of Platform content, informing affected agencies and, where appropriate, bringing or exercising claims | Art. 6(1)(f): legitimate interest in protecting the Platform and the agencies' content and in establishing, exercising or defending legal claims |
| Security and abuse prevention | IP address (which, to limit the number of requests, we store as a keyed derived code rather than in clear), technical data about the request and the browser, signals that distinguish people from automated programs, and hosting technical logs | Protecting the Platform and its users against fraud, automated access, bulk content extraction and attacks | Art. 6(1)(f): legitimate interest in ensuring network and information security (Recital 49 GDPR) |
5. Who we share your data with
5.1 The advertising agency (the Platform's core flow)
When you submit a contact form about a property, your data (name, contact details, and message) is sent to the agency or agent that published that listing, so they can respond to your enquiry. This delivery is the very purpose of the form, and you are also informed of it in the form itself at the moment of submission.
From the moment it receives your data, the agency becomes a data controller in its own right for its own processing of that data. Our terms of service contractually require agencies to use your data solely to handle your enquiry. For any question about how the agency uses your data after delivery, you may contact the agency directly; you may also write to us at legal@yolisto.app and we will point you in the right direction.
If you request Yolisto's assisted-purchase service for a specific property, your name and contact details are also sent to the agency advertising that property as a notification of interest (so the agency can handle the sale for you), in addition to being processed by Yolisto to provide the support service. Delivery to the agency relies on the same safeguards described in section 6 for lead delivery.
5.2 Service providers (data processors)
We use providers that process data on our behalf under contracts compliant with Article 28 GDPR:
- Vercel Inc. (United States): Platform hosting, photo storage, protection against automated programs, and the gateway that sends AI search queries and the text pasted into the listing-creation assistant to the AI model.
- Neon (United States): the Platform's database.
- Anthropic, PBC (United States), through Vercel's gateway: the AI model that processes those queries and that text.
- Resend (Plus Five Five, Inc.) (United States): delivery of the Platform's emails (for example, enquiry notifications to agencies, search alerts and email verification).
We do not sell your personal data or share it with third parties for those third parties' own advertising purposes.
5.3 Authorities
We may disclose data to competent authorities where a legal obligation so requires.
5.4 What we do not do with your data
Yolisto does not sell or rent your personal data to third parties, nor does it share it so that third parties can send you advertising. Any market information products that Yolisto creates or offers to third parties are built exclusively from aggregated and anonymised data that cannot identify any individual.
5.5 Agency software and unauthorized copies
When an agency connects its management software, we receive the data of its properties from that provider at the agency's instruction; that provider works for the agency, not for Yolisto. If we detect an unauthorized copy, we may share the documentation with the affected agency, our legal advisers and, where appropriate, authorities and courts.
5.6 Map provider
When you view a map on the Platform, your browser downloads the map images directly from the map provider's servers, which receive your IP address, technical data about your browser, the site the request comes from and the map area being displayed. The provider serving the map at any given time is identified in the attribution shown on the map itself, and is one of these:
- OpenStreetMap Foundation (United Kingdom), which processes that data as a controller under its own privacy policy;
- Stadia Maps, Inc. (United States), which processes it on our behalf as a processor.
If we start using another map provider, we will add it to this list before using it.
5.7 Sign-in with Google
If you choose "Continue with Google", Google identifies you and gives us your name, your email address, an identifier for your Google account and whether that email is verified, so that we can create or open your Yolisto account. Google processes your data as a controller under its own privacy policy.
6. International transfers
- Providers in the United States (those in section 5.2 and, when it is the one serving the map, Stadia Maps): the transfer is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework for providers certified under it and, in all other cases or as a fallback, by the standard contractual clauses included in their data processing agreement.
- Map provider in the United Kingdom (OpenStreetMap Foundation): the United Kingdom has an adequacy decision from the European Commission.
- Delivery of leads to agencies established outside the European Economic Area (in particular, in Venezuela, which does not have an adequacy decision from the European Commission): the delivery of your data to the advertising agency is based on the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, in their controller-to-controller module, which Ciigma and the agency enter into through the International Data Transfer Annex. The agency accepts it when registering or when accepting the current version of the Terms of Use. Until an agency that registered before that version has accepted it, the delivery relies on Article 49(1)(b) GDPR, as necessary for the pre-contractual measures you yourself request when you ask that agency to contact you.
You may obtain a copy of the standard contractual clauses and more information about these safeguards by writing to legal@yolisto.app.
7. How long we keep your data
- Agency accounts: while the account is active. After closure, data is kept blocked for the limitation periods of potential legal liabilities (Art. 32 LOPDGDD).
- Leads: for the time needed to deliver the enquiry to the agency and thereafter for a maximum of 12 months, unless a subsequent relationship or a legal retention obligation exists.
- Our own usage measurement: kept as a history of Platform use; when an account is deleted, its records can no longer be linked to the account holder's name or email.
- Campaign measurement: the cookie stays in your browser for 90 days, or until you withdraw consent; the origin already linked to our own usage measurement is kept with it, on the terms of the previous item.
- Security and abuse prevention: the counters that limit the number of requests are deleted automatically when their window expires, and hosting technical logs are kept for a maximum of 30 days.
- User account, favourites and saved searches: while your account is active or until you delete them; alerts stop as soon as you turn them off.
- Assisted-purchase requests: while your request is being handled and, if you do not go on to contract the service, for a maximum of 12 months from the last contact; if you contract the service, for the duration of the relationship and the subsequent limitation periods.
- Marketing communications: until you withdraw consent or object.
- Enquiries and rights requests: for the applicable liability limitation periods.
- Advisors without an account: while the link is active and for up to 12 months after its revocation or the advisor's removal.
- Records of similar photographs: 12 months from their review.
- Original photographs and public copies: while the listing is published and for up to 90 days after its removal or the closure of the account; the technical fingerprints may be kept afterwards because they do not identify the image or any person.
- Agency software credential: until the agency disconnects it or its account is deleted.
- Documentation of unauthorized copies: up to 5 years from the last check or, if a claim is under way, until it is finally resolved.
8. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability, and withdraw your consent without affecting the lawfulness of prior processing.
To exercise them, write to legal@yolisto.app, stating the right you wish to exercise and information that allows us to identify you. We will respond within the timeframes set by the GDPR (as a general rule, one month from receipt of the request, under Art. 12.3 GDPR).
If you believe we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority given the controller's establishment in Spain: www.aepd.es.
Users in Venezuela: the rights above apply to you in full regardless of your country of residence. This policy is also compatible with the right of access, updating, rectification, and destruction of data recognized in Article 28 of the Constitution of the Bolivarian Republic of Venezuela (habeas data), which you retain under your national legal system.
9. Minors
The Platform is not directed at persons under 18. We do not knowingly collect data from minors. If we become aware that a minor has provided us with personal data, we will delete it.
10. Security
We apply technical and organizational measures appropriate to the risk of the processing (Art. 32 GDPR), including encrypted communications (HTTPS), access controls, and minimization of the data collected. The credentials agencies give us to connect their software are stored encrypted and are not displayed again. Before publishing a photograph, we remove the file's metadata, including the geolocation recorded by phones, and we show the location of properties in an approximate way. No system is completely infallible; if a security breach occurs that poses a high risk to your rights, we will notify you in accordance with applicable law.
11. Cookies
The use of cookies and similar technologies, including the campaign-measurement cookie that is only set with your consent, is described in the Cookie Policy.
12. Changes to this policy
We may update this policy to reflect changes in the Platform or in the law. The current version will always be published on this page, showing the date of the last update. If a change is substantial, we will flag it visibly on the Platform.
For any questions about this policy, write to legal@yolisto.app.