Privacy Notice
Introduction
Placy Ltd operates: (i) the website placy.ai(the Website); (ii) a tool which is designed to allow users to search for properties for sale and rent via WhatsApp and Telegram (the AI Tool); and (iii) Placy Pro, an assistant for real estate professionals to manage their sales and lettings pipeline, stay on top of their contacts, leads, clients, and reduce administrative work (Placy Pro); and (iv) Placy Copilot, an assistant for real estate professionals to manage leads, schedule property viewings, and communicate with their clients, which can connect the professional's own accounts and tools such as calendar, email and messaging (Copilot). The Website, AI Tool, PlacyPro and Copilot are collectively referred to as the Services.
When you use our Services, you're trusting us with your information. We understand this is a big responsibility and we work hard to protect your information and put you in control. Please read the Privacy Notice below carefully which sets out how we process your personal data ("personal data" or "data" or "information" or "personal information").
Privacy Commitment
We at Placy Ltd (we, our or us) respect your privacy and are strongly committed to keeping your information secure. This Privacy Notice describes our practices with respect to the personal data we collect from or about you when you use our Services. This Privacy Notice also describes your options as well as your rights regarding your personal data.
Placy Ltd is the controller of the personal data obtained via our Services, meaning that we are the organisation legally responsible for deciding how and for what purposes it is used.
If you have any questions or want more details about how we use your personal data, you can contact us at Charilaou Xyloforou 13, Agios Athanasios, 4103, Limassol, Cyprus or via email at dpo@placy.ai.
By using our Services, you acknowledge that it is necessary for us to collect certain personal data about you in order to provide these Services to you.
Our Role
The role we have when processing personal data varies depending on our different Services. We have set out below when we are a processor and when we are a controller in relation to each of our Services.
- Website: we will always be a controller of personal data collected via our Website and this privacy notice will apply.
- AI Tool: we will always be a controller in respect of personal data collected and processed via the AI Tool.
- Placy Pro (estate agents): we will be a controller in respect of those real estate agents and staff that interact with Placy Pro.
- Placy Pro (customers): we will be a processor – acting on behalf of real estate agents – in respect of the personal data of customers processed by Placy Pro on behalf of real estate agents.
- Copilot (estate agents): we will be a controller in respect of those real estate agents and staff that interact with Copilot.
- Copilot (customers): we will be a processor – acting on behalf of real estate agents – in respect of the personal data of customers processed by Copilot on behalf of real estate agents.
Where we act as a controller, you should read this privacy notice to learn more about how we process your personal data and your rights.
Where we act as a processor, this privacy notice does not specifically relate to you and you should review the privacy notice of your real estate agent to understand more about how they will process your personal data, including how they use Placy Pro and Copilot.
What Personal Data We Collect and How
| Category | Personal Data Processed | How It Is Collected |
|---|---|---|
| Basic contact and identification information | Name, email address (not limited to Gmail), telephone number | Provided by you while interacting with our Services, completing our customer survey, or providing feedback via email or other forms of inquiry |
| Google Workspace integration data (Placy Copilot) | Calendar events and availability, sending email on your behalf, email address, OpenID profile information | Collected via Google OAuth when you connect your Google account to enable Placy Copilot's calendar, sending email on your behalf and identity verification |
| Search information | Content of searches input into the Services; recordings of telephone calls made to us or the Services | Collected automatically when you use the search functionality; call recordings captured during telephone interactions |
| Marketing and Communications Data | Your marketing preferences and communication preferences | Recorded based on your choices when interacting with our Services |
| Social Media information | Contact details and other personal data you choose to share | Collected when you interact with our social media pages |
| Billing address and tax ID | Company billing address; tax identification number | Billing address collected before your first purchase can be completed; tax ID entered by the paying customer via the Stripe-hosted customer portal - used to generate compliant billing documents and meet tax obligations |
| Card details | Not collected or stored by us. Card and payment instrument details | Collected and processed directly by Stripe; we do not receive, transmit, or store this data at any point |
| Payment method and transaction data | Payment method details (tokenized reference only); transaction metadata | Payment method held directly by Stripe; transaction metadata generated by Stripe and shared back to us to reconcile with your account |
| Transaction records | Receipts, invoices, failed-charge notices | Sent directly by Stripe to the customer as part of payment processing |
| Other information you provide | Residential address and other information you choose to share | Provided by you while interacting with our Services |
| Cookies and similar data collection technologies | Browser type and version, operating system, time and date of access, pages visited, referrer URL, IP address, items clicked | Collected automatically through cookies and similar tracking technologies each time you access our website |
How We Use the Personal Data and On Which Legal Bases
Under data protection law, we (and all controllers) are only permitted to process personal data for a specific purpose if we have a lawful basis for that purpose. We have set out below the purposes for which we process your personal data and the applicable lawful basis.
| Purpose | Lawful |
|---|---|
| To provide you with our Services, including administering and maintaining our Services and providing you with responses to your searches through our Services. | Necessary for the performance of the contract we have with you. |
| To respond to communications and queries you have raised with us whether via phone, email or otherwise. | Our legitimate interests so that we can answer your queries |
| To record telephone conversations for training and improvement purposes whether made to us directly or calls with our Services | Our legitimate interests so that we can improve our Services |
| To analyse how you (and others) interact with our Services so that we can improve them, for instance, by monitoring and recording how and when systems are accessed and how data is uploaded in order to analyse performance. This also allows our Services to continually ‘learn and improve’. | Our legitimate interests so that we can ensure that our Services are operating as effectively as possible |
| To analyse and understand your preferences so that we can offer you customised content and other personalisation to make the Services more relevant to your interests. | Our legitimate interests to make the content that you receive more relevant to you and your needs |
| To send you news/updates for our products and Services. | Consent |
| To send you direct marketing, including promotions and invitations on new or existing products and services including bonus guides. | Consent |
| To develop new programs, products and services. | Our legitimate interests so that we can create new offerings |
| To identify any misuse of our Services and protect the IT systems, architecture and networks. | Necessary for the performance of the contact we have with you |
| To identify and prevent fraud or other criminal activity. | Necessary to comply with our legal obligations |
| To report any fraud or other criminal activity to law enforcement and/or respond to queries from law enforcement. | Necessary to comply with our legal obligations; or in our legitimate interests to ensure our Services are safe where notification is not required but proportionate |
| In accordance with legal obligations imposed upon us. | Necessary to comply with our legal obligations |
| To defend ourselves legally. | Necessary for the performance of the contract we have with you / necessary to comply with our legal obligations |
We may also process your personal data for purposes which compatible with those listed above. Where we intend to introduce any new processing purpose we will update the table above.
Automated Decision-Making
Our Services are automated, but we do not deploy automated decision-making, including profiling, via our Services which could produce legal or similarly significant effects for you. The Services is intended to help provide you with useful information about properties in your area to aid your property search.
Disclosure of Personal Data
In certain circumstances, we may disclose your personal data to:
- Processors (such as vendors and service providers): We use processors to assist us in meeting business operations needs and to perform certain services and functions. We may disclose personal data to processors, including providers of hosting services, customer service vendors, cloud services, content delivery services, data warehouse services, support and safety monitoring services, email communication software, web analytics services, payment and transaction providers, Stripe, Inc. (payment processor) and other information technology services providers. These organisations are contractually obligated only to process your personal data in accordance with our instructions. Any processing by our processors will be consistent with this Privacy Notice.
- Business Transfers: We may disclose your personal data as part of a corporate transaction, including a purchase of all or part of our business, investment, reorganization, bankruptcy, receivership, or transition of service to another provider. Your personal data and other information may be disclosed in the diligence process with counterparties and others involved in such corporate transaction and may be transferred to a successor or affiliate as part of any completed transaction along with other assets.
- Government Authorities or other third parties: We may share your personal data, including information about your interaction with our Services, with government authorities, industry peers, or other third parties in compliance with the law (i) if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, (ii) to protect and defend our rights or property, (iii) if we determine, in our sole discretion, that there is a violation of our terms, policies, or the law; (iv) to detect or prevent fraud or other illegal activity; (v) to protect the safety, security, and integrity of our products, employees, or users, or the public; or (vi) to protect against legal liability.
- Affiliates: We may disclose personal data to our affiliates, meaning an entity that controls, is controlled by, or is under common control with Placy Ltd. Our affiliates may use the personal data we share in a manner consistent with this Privacy Notice.
- Third parties: We may ask for your consent to share your information with third parties. In any such case, we will make it clear why we want to share the information, such as to receive marketing from such third party.
- AI Third Party Providers: To provide you with the Services or part of the Services, specific data is processed by third-party AI service providers namely Microsoft Azure.
Connected Accounts & Third-Party Integrations
Placy lets you connect third-party accounts and services to enable specific features. When you connect a service, you explicitly authorize the access through that provider's own consent screen. We access only the data needed to provide the feature you enabled, and you can disconnect or revoke access at any time.
Google Account (Calendar and Email)
When you connect your Google account, Placy requests access to the following data to provide scheduling and communication features:
- Google Calendar events (calendar.events) — to create, read, update, and cancel calendar events for property viewings and client meetings that you schedule through Placy.
- Google Calendar availability (calendar.events.freebusy) — to read your busy/free intervals (not event details) so Placy can suggest meeting times when you are available and avoid double-booking.
- Sending email (gmail.send) — to send emails on your behalf when you choose to contact a lead or client through Placy.
We use this data solely to provide the features described above. We do not sell Google user data, use it for advertising, or transfer it to third parties except as needed to provide the feature you enabled or as required by law.
Placy's use of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Notwithstanding any other provision of this Privacy Notice, information obtained from Google APIs (Google Calendar and Gmail) is used only to provide the features described in this section, in line with the Google API Services User Data Policy including the Limited Use requirements. We do not use it to train generalized AI/ML models, transfer it as part of a business transfer, or share it with affiliates, except as necessary to provide the feature you enabled, to comply with applicable law, or for security operations.
You can revoke Placy's access to your Google data at any time in your Google Account permissions (https://myaccount.google.com/permissions) or by disconnecting the integration inside Placy.
WhatsApp / Meta
When you connect WhatsApp (via Meta), Placy sends and receives messages on your behalf to communicate with your leads and clients, including one-time verification codes and message templates you approve. Our use of the WhatsApp Business Platform follows Meta's Platform Terms and Developer Policies.
Other services you connect
When you connect other third-party services (such as your CRM or other tools), Placy accesses only the data needed to provide the feature you enabled, and processes it according to this Privacy Notice and your agreement with us.
We do not control, and we are not responsible for, the data practices of Third-Party Services. Before enabling an integration, you should ensure you have the authority to grant such access and that doing so complies with any applicable terms, policies, or confidentiality obligations. Before enabling an integration, you should review the third party's privacy policy.
How Long Do We Keep Your Data
If you connect your Google Calendar or Gmail account, we access and use that data solely to provide the features you've authorized. We delete this data immediately when you disconnect the integration or close your account.
Our third-party service providers process this data only for as long as necessary to provide the Services to us. At the end of our agreement with a provider, that provider will delete or return the data to us, in accordance with our data processing agreement, except where retention is required by law.
Other data not derived from your Google integration is retained for as long as we continue providing you the relevant service, and is deleted in 7 days once that service relationship ends.
All deletion timelines above are subject to any shorter or longer retention period required by applicable law or for safety and security purposes.
Your Rights
You have the following statutory rights in relation to your personal data:
- Right to access: You have the right to request access to the personal data we hold about you.
- Right to erasure (also known as the right to be forgotten): You have the right to request that we delete your personal data in certain situations.
- Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
- Right to restrict processing: You have the right to request us to restrict the processing of your personal data in certain circumstances.
- Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to a third party.
- Right not to be subject to automated decision-making: You have the right to object to decisions based solely on automated processing, including profiling, that significantly affect you.
- Right of objection: You have the right to object to any processing that is undertaken in respect of our legitimate interests.
- Right to withdraw consent: You have the right to withdraw your consent at any time if we rely on consent as the legal basis for processing your personal data.
- Right to object to direct marketing: You have the right to object to our processing of your personal data for direct marketing purposes. You can exercise this right by contacting us at dpo@placy.ai or using the "unsubscribe" link in emails.
We thought it would be useful to provide some examples about how your rights in respect of data protection work as we appreciate many are not familiar with data subject rights. For example, if you would prefer that our Services do not 'learn' from your interactions, which is something that we do on the basis of our legitimate interests, you can 'object' to this via the email below and we will cease this type of processing. Or, if you would like us to delete information held about you for the purposes of personalising and customising response to you, you can do this by requesting erasure of this data, again by writing to the email below.
To exercise any of your rights, please contact us at dpo@placy.ai. When contacting us, please provide enough information to identify yourself and let us know which right(s) you want to exercise and the information to which your request relates.
Withdrawing consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn.
Please note that these rights are not absolute (save for objecting to direct marketing) and may be limited in certain circumstances, such as when fulfilling your request would reveal personal data about another person or if we are required by law or have compelling legitimate interests to continue processing your information.
Please note that exercising some of these rights may impact our ability to provide our Services to you. We will inform you of any such impact when you make a request to exercise your rights.
You also have the right to complain to your local supervisory authority, although we ask that you raise any concerns with us in the first instance. Further information is provided below.
International Transfers
Your personal data may be processed outside of the European Economic Area (EEA) where our affiliates, partners, merchants, or service providers may be located.
When we transfer your personal data, we will do so pursuant to applicable data protection laws. To transfer your personal data to other jurisdictions, we rely on the European Commission's adequacy decisions on certain countries and, for other jurisdictions, we rely on the Standard Contractual Clauses as approved by the European Commission.
Security of Your Personal Data
We have appropriate security measures to prevent personal data from being accidentally lost, used, or accessed unlawfully. Data is encrypted in transit (TLS) and at rest; the access tokens that connect your Google account are encrypted and are never stored in plaintext. Access is limited to your own authenticated account. Your data is stored within the EU (Microsoft Azure, North Europe region).
We also minimise what we store. For connected Google services we do not store the content of your calendar events or emails. We keep only the encrypted connection tokens and the identifier of an event our assistant created on your behalf.
We will notify you and any applicable regulator of any data breach that is likely to cause risk to you.
Children
Our Services are not directed to, or intended for, children under 13. We do not knowingly collect personal data from children under 13. If you are aware that a child's personal data has been shared with our website, please let us know so we can investigate and delete that data where applicable.
Cookies
We use cookies to run our website. A "cookie" is a small file containing a string of characters that is sent to your web browser and uniquely identifies your browser. Cookies help us collect information so we can better understand how you access and navigate our website. This information helps us develop and improve the design, layout, content, and function of our website. It also allows us to prevent fraud and improve our security.
We may also use cookies to track activity and click-through behaviour to better understand your preferences and browsing habits and to provide a more personalized experience while visiting our website and for more personalized alerts. We use different types of cookies to run the website. You can view and manage cookies in your browser.
You can be directed to our Cookies Policy for more information.
How to Contact Us
If you have any questions about our Privacy Notice, the data we hold about you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us at dpo@placy.ai.
You may also find it helpful to refer to the guidance from the Data Protection Commissioner: https://www.dataprotection.gov.cy.
How You Can Complain to the Appropriate Authority
Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you can complain to your local supervisory authority. For those based in Cyprus, please contact the Office of the Commissioner for Personal Data Protection at https://www.dataprotection.gov.cy.
Changes to This Privacy Notice
We may update this Privacy Notice from time to time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law.
Last updated: 20 October 2026