Your data, handled with care.

Policies and documents

• Privacy policyHow Clavy collects, uses, shares and protects personal data, and how you can exercise your rights under the GDPR.Version 1.1 · 23 Oct 2026
• Terms of serviceThe agreement for using Clavy, its subscriptions and its reports, including what an estimate is and how to withdraw from a purchase.Version 1.1 · 21 Oct 2026
• Cookie policyThe cookies and browser storage Clavy uses: only what keeps you signed in and remembers your choices. No advertising, and product analytics without cookies.Version 1.1 · 23 Oct 2026
• Sub-processorsClavy is the controller of the personal data it holds and processes nothing on anyone's behalf, so there is no data processing agreement to sign. This page describes the categories of providers that run Clavy, where they run, and how to request the itemised list.Version 1.0 · 15 Oct 2026
• Legal noticeWho provides this website: Epic House SIA's identification, registration and contact details, and the conditions for using its information.Version 1.0 · 15 Oct 2026
• Legal informationWhat a Clavy estimate is and is not, what Clavy does not warrant, the sources and licences behind its information, what it holds about people and how to ask for a correction.Version 1.1 · 17 Oct 2026
• SupportHow to reach us, what to include when you write, and where to manage your account, billing and data.Version 1.0 · 15 Oct 2026

At a glance

Hosting

Application functions and report files run in Frankfurt; the categories of providers and where they run are on the sub-processors page

Payments

Card details stay with Stripe; Clavy never sees them

Property owners

Clavy does not request, store or show owners' names, identity numbers, owners' addresses or cadastral values

Tracking

No advertising or cross-site trackers; product analytics hosted in the EU, without cookies, that you can switch off

Estimates

Always a range, for information purposes, never a regulated appraisal

Documents

Versioned and dated, with earlier versions kept readable

What is in place

Each item is a fact about the running service, not a certification.

• TLS for every connection, with HSTS✓In place
• Passwords stored only as salted hashes✓In place
• Report files in private storage, served only to the people allowed to see them✓In place
• Download of your data from the account page✓In place
• Identification of the provider in the legal notice✓In place
• Versioned documents, with earlier versions kept in an archive✓In place
• The exact version of the terms you accept recorded with each purchase✓In place
• Online withdrawal from a purchase on the billing page✓In place
• No advertising or cross-site trackers; product analytics without cookies, switchable off on the account page✓In place
• Google Maps loads only when you click✓In place

What we are still completing

These items are open; we do not claim them.

• Review of these documents by counselOpen
• The agreement, region and transfer safeguard verified for each provider in the itemised list described on the sub-processors pageOpen
• Retention periods for orders, audit records and backupsOpen
• Self-service account deletion (until then, deletion requests go to privacy@clavy.io)Open
• The assessment of whether facts about an identifiable dwelling, or listing records, are personal dataOpen

How your data is handled

Account and order data is kept in our application database, and report files in private storage that only the people allowed to see them can open. Application functions and report file storage run in Frankfurt. Clavy is the controller of this data and processes nothing on anyone's behalf, so there is no data processing agreement to sign; the sub-processors page describes the categories of providers that run Clavy, where they run, what is still being verified and how to request the itemised list.

We do not sell personal data, use it for advertising or send it to AI models. We set only the cookies and browser storage the service needs: no advertising or cross-site trackers. Our product analytics, hosted in the EU, use no cookies and never receive your name, e-mail address or IP address, and you can switch them off on your account page. Google Maps loads only when you click, and aerial imagery is requested by your browser from the Instituto Geográfico Nacional. Clavy never shows the browser's location prompt by itself: you share your location from the account page or set a point on the map, and "Remove" withdraws it until you share it again.

From the account page you can download a copy of your data and remove your saved location. To delete your account, write to privacy@clavy.io from the address on your account; Clavy's staff delete it and answer within one month. Deletion erases your profile, your saved location, the reports and PDFs in your personal workspace, and your saved searches and drafts. Reports ordered in a shared workspace stay with that workspace, without your name. Orders, subscriptions and report-credit records are kept as accounting records without your account identifier, audit entries are kept without identifiers, Stripe keeps its own payment records, and data in a backup remains until the backup expires. Retention and your rights are set out in the privacy policy.

Property information

Clavy's property facts come from public records, chiefly the Dirección General del Catastro, and its market information from sale listings delivered by Scout, a service operated by the same company, Epic House SIA. Clavy does not request, store or show owners' names, identity numbers, owners' addresses or cadastral values. It holds Catastro parcels, buildings and addresses, descriptive facts about units (floor, door, use, surface, participation share) and the listing records as received, with their history. Whether facts about an identifiable dwelling, or the listing records, are personal data of an owner, occupant or agent is under assessment; anyone, with or without an account, can ask for a correction or object through privacy@clavy.io.

Every estimate is a range for information purposes, never a regulated appraisal, and property facts carry no certificative value. The legal information page explains why, lists each source with its licence and says how to report a wrong fact.

Security

• TLS for every connection, with HSTS.
• Passwords stored only as salted hashes; verification and password-reset links are single-use and expire.
• Report files in private storage, served only to the people allowed to see them.
• Access by Clavy's staff to account data is limited to named, verified accounts, and the changes they make are recorded in a log.
• Rate limits on sign-in and other sensitive requests.
• Our database and storage providers encrypt data at rest.

If a personal-data breach is likely to put your rights and freedoms at risk, we will notify the Latvian supervisory authority (Datu valsts inspekcija) within 72 hours and, where the risk is high, tell you without undue delay. To report a security problem, write to hello@clavy.io.

How these documents change

Every document carries a version number and an effective date, and earlier versions stay readable below it. A correction that does not change the meaning keeps the version and the date. A new version can be published before its effective date; the page then announces the upcoming version, and the current one stays in force until that date. Account holders are told by e-mail before a material change to the terms or the privacy policy takes effect.

Questions and requests