Applies to:https://clavy.io, its public property, town and neighbourhood pages, the account area and the property reports (together, “Clavy” or the “Service”).
This policy explains who we are, what personal data we process, why and on what legal basis, who receives it, where it goes, how long we keep it and how you can exercise your rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Latvian Personal Data Processing Law (Fizisko personu datu apstrādes likums).
Where something is still being confirmed, this policy says so instead of promising it. If anything is unclear, write to privacy@clavy.io.
1. Who we are
Epic House SIA, registration number 40203716958, VAT number LV40203716958, with registered office at Duntes iela 6, Riga, LV-1013, Latvia, entered in the Register of Enterprises of the Republic of Latvia (the “Company”, “we”, “us”), operates Clavy and is the controller of the personal data described in this policy.
The Company is established in Latvia (EU). The Latvian supervisory authority is the Datu valsts inspekcija (DVI), Elijas iela 17, Riga, LV-1050 (www.dvi.gov.lv). You can also complain to the supervisory authority of the EU or EEA country where you live, for example the Agencia Española de Protección de Datos (www.aepd.es) in Spain.
Data protection officer: none appointed. Whether one is required is being confirmed; in the meantime, write to privacy@clavy.io.
Our role. We are the controller of all the personal data described in this policy. We do not process personal data on behalf of customers: nothing you give Clavy is processed on your instructions, so no data processing agreement (DPA) applies and none is needed to use Clavy. The property and market information is public data that Clavy transforms; it is not personal data you give us.
2. What personal data we process
2.1 Your account
Account: e-mail address, name, interface language, role and the workspaces you are a member of.
Sign-in: your password only as a salted hash, never in clear; single-use links for verifying your e-mail address and resetting your password; and session records, which include your IP address and your browser's user agent.
2.2 Location, only if you allow it
Clavy never shows your browser's location prompt on its own. You share your location from the account page with the Share my location button, which explains what it is for (showing you properties around you), or you set a point by hand on the map. When you sign in, Clavy refreshes the stored position silently only if your browser has already granted Clavy access to your location and you have not removed your location in Clavy.
Stored: the coordinates with their accuracy, the time of the reading, your time zone, the state of your browser's location permission and whether you set the point by hand. Altitude, heading and speed are not stored.
If your browser reports that location is blocked, we record that so that we do not ask.
The approximate address of the stored point is looked up once by Clavy's server from OpenStreetMap's Nominatim service. The server sends the coordinates rounded to about 100 metres (three decimals) and no name, e-mail or IP address, and keeps the answer with the location. The search box on the account page's map sends the text you typed to Nominatim in the same way.
Remove on the account page deletes the stored position and records that you withdrew, so no later sign-in captures it again until you share it again. Your browser's own permission is separate: you change it in the browser's settings.
2.3 Subscriptions, payments and reports
Subscriptions and payments: the plan, status and periods of your subscription, your Stripe customer and subscription identifiers, the reports granted and used, and for each purchase the amount, the status, Stripe's reference and the acceptance you gave before paying: the version and the exact published revision of the terms, the statements you accepted, the language and the time. Card details are held by Stripe; we never see them.
Reports: the property of each report and the reports and PDFs produced.
Saved searches and report template drafts, if you use them.
2.4 Records we keep to run the Service
Audit log: actions taken with your account, with your account identifier.
Technical errors, only when error tracking is enabled: technical details of the error and of the page and browser involved, without your name or e-mail address.
Support: the content of any e-mail you send us.
2.5 Information about properties
Clavy does not request, store or show owners' names, identity numbers, owners' addresses or cadastral values. It holds the Catastro's parcels, buildings and addresses, descriptive facts about each unit (floor, door, use and participation share), and the sale listings delivered by Scout, a service of the same company, Epic House SIA, kept as received together with their history.
Whether the facts about an identifiable dwelling, or the listing records, are personal data of an owner, an occupant or an agent is under review. Until that is decided, anyone, with or without a Clavy account, can ask for a correction or object to the processing through privacy@clavy.io, and we limit what we hold to the public record and to the listing as it was published.
2.6 What we do not collect
We do not intentionally collect special categories of personal data (such as health, beliefs or ethnic origin). Clavy is intended for adults; we do not knowingly process the personal data of anyone under 18. If you believe a minor has created an account, write to privacy@clavy.io and we will delete it.
3. Why we process your data and on what legal basis
Purpose
Data
Legal basis (GDPR art. 6)
Running your account and sign-in
Account, sign-in
(b) Performance of the contract
Running your subscription, preparing and delivering reports and keeping count of the reports included
Subscriptions, reports
(b) Performance of the contract
Taking payment and keeping accounting records
Payments, orders
(b) Performance of the contract; (c) legal obligations under accounting and tax law
Sending transactional e-mail such as e-mail verification, password resets and report-ready notices
E-mail address, name
(b) Performance of the contract
Keeping your location to show you properties around you
Location
(a) Your consent, which you give by sharing your location on the account page or by setting a point on the map, and withdraw at any time by removing the location there
Finding and fixing errors in the Service
Technical errors
(f) Legitimate interest in a working service
Protecting the Service with rate limits, session records and the audit log
Sign-in, audit log
(f) Legitimate interest in security
Answering your questions and requests
Support
(b) Performance of the contract, or (f) legitimate interest in answering enquiries
Complying with legal requests and defending legal claims
Any
(c) Legal obligation; (f) legitimate interest
Before relying on legitimate interest we weigh it against your interests and rights; you can ask for that assessment at privacy@clavy.io. We send no marketing e-mail.
4. Estimates and automated processing
Clavy computes automated market-value estimates of properties from public records and observed listings, and expresses them as ranges. They describe properties, not people: they do not evaluate you and produce no legal or similarly significant effect on you, so no decision within the meaning of GDPR art. 22 is taken.
We do not send your personal data to AI models and do not use it to train any model.
5. Who receives your data
Your data is not sold, rented or shared for advertising. We share it only with these categories of recipients:
Cloud hosting and file storage provider (EU, Frankfurt, for functions and files)
Database provider (region being confirmed; our runbook places it in Frankfurt)
E-mail delivery provider (EU, Ireland, as configured)
Payment provider: Stripe, whose checkout and billing pages you use directly; card details never reach Clavy. For the payment itself Stripe also acts as an independent controller for its own obligations, such as fraud prevention and financial regulation; which role applies to each activity is being confirmed
Error-monitoring provider, only when enabled, and never your name, e-mail address or IP address
Network protection of our geographic data server, which receives technical request data only; the server itself holds property records and no account data
Professional advisers (lawyers, auditors) bound by confidentiality
Public authorities, only when the law requires it
The Sub-processors page describes each category, where it runs and what is still being verified, and says how to request the itemised list that names each provider with its purpose, location, agreement and transfer safeguard. When you exercise your right of access, we name the recipients of your data.
Some services receive data when you use a feature:
Google: the interactive Google Maps view and Google's 3D view load only when you click to open them; from then on Google receives your browser's IP address and the location being viewed.
OpenStreetMap Foundation (Nominatim): when the address of your saved location is looked up, or when you search for a place on the account page's map, Clavy's server sends Nominatim the coordinates rounded to about 100 metres or the text you typed, with no name, e-mail or IP address; your browser never contacts Nominatim. Clavy makes at most one request per second to Nominatim across the whole application.
Instituto Geográfico Nacional: your browser requests aerial imagery directly from www.ign.es and tms-pnoa-ma.idee.es, which receive your IP address.
Within Clavy, members of a shared workspace see the reports ordered in it. Our staff can access an account's data to give support; that access is limited to named, verified staff accounts, and what they change is recorded in a log.
6. International transfers
The application's functions and its report file storage run in Frankfurt, Germany, the region our hosting provider is set to. Several of our providers belong to groups established in the United States, and support or sub-processor access to personal data may occur from outside the European Economic Area. For each such transfer we rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the provider is certified, or on the Commission's Standard Contractual Clauses (Decision 2021/914). The itemised list of providers records the safeguard for each one; the Sub-processors page says what is still being verified and how to request the list.
You can ask for the details of the safeguard for a specific transfer at privacy@clavy.io.
7. How long we keep your data
This table states what is enforced today and which periods are still being set with counsel. No period is invented.
Data
Retention
Account
While you keep it; erased when your account is deleted (section 8 says what is kept)
Sessions
Expire after 30 days without use; the period after which expired session records are purged is being set
E-mail verification and password-reset links
Single-use; a verification link expires after 24 hours and a reset link after one hour
Saved location
Until you remove it on the account page or your account is deleted
Reports, saved searches and drafts
While your account exists
Orders, subscriptions and report-credit records
Kept as accounting records, without your account identifier once your account is deleted, for the period the law requires; the period is being confirmed. Stripe keeps its own payment records under its terms
Audit log
Kept for accountability, without your identifiers once your account is deleted; the period is being set
Backups
Data remains in a backup until that backup expires; the backup schedule is being settled
8. Your rights
Under the GDPR you have the right to:
Access the personal data we hold about you (art. 15)
Rectify inaccurate data (art. 16)
Erase your data (art. 17)
Restrict processing (art. 18)
Portability: receive your data in a structured, machine-readable format (art. 20)
Object to processing based on legitimate interest (art. 21)
Withdraw consent at any time where processing is based on consent, without affecting the processing before you withdrew it (art. 7(3))
Lodge a complaint with the Latvian supervisory authority, the Datu valsts inspekcija (DVI), Elijas iela 17, Riga, LV-1050, Latvia (www.dvi.gov.lv), or with the authority of the country where you live, for example the Agencia Española de Protección de Datos (www.aepd.es) in Spain
On the account page. From the account page you can download a copy of your data and remove your saved location, which also withdraws your consent to location.
Deleting your account. Self-service deletion is not available yet. Write to privacy@clavy.io from the address linked to your account and our staff will delete it. Deletion erases your profile, your saved location, the reports and PDFs in your personal workspace, and your saved searches and drafts. It keeps: reports you ordered in a shared workspace, which stay with that workspace without your name; orders, subscriptions and report-credit records, kept as accounting records without your account identifier; audit entries, kept without your identifiers; Stripe's own records, which Stripe keeps under its terms; and data in a backup, which remains until the backup expires.
Any other request. Write to privacy@clavy.io from the address linked to your account. We answer within one month; for complex requests we may extend that by two further months and will tell you why. Exercising your rights is free unless a request is manifestly unfounded or excessive.
If you have no account. Owners, occupants and agents may exercise their rights about the property information described in section 2.5 by writing to privacy@clavy.io.
9. Security
We protect your data with:
TLS encryption for every connection to Clavy, enforced with HSTS.
Passwords kept only as salted hashes, and single-use links that expire.
Report files in private storage, served only to the people allowed to see them.
Staff access limited to named, verified accounts, with the changes they make recorded in a log.
Rate limits on sign-in and other sensitive requests.
Encryption at rest, which our database and storage providers state they apply to the data they hold for us.
If a personal-data breach is likely to put your rights and freedoms at risk, we will notify the DVI within 72 hours of becoming aware of it and, where the risk is high, tell the people affected without undue delay.
10. Cookies
We use only the cookies and browser storage needed to run the Service and to remember your choices, and no analytics or advertising cookies. The Cookie policy lists each one.
11. Changes to this policy
Every version of this policy carries its version number and effective date, and the earlier versions stay readable on this page. We may publish a new version before its effective date: it is announced on this page while the current version stays in force until that date. Before a material change takes effect, we tell account holders by e-mail.