Draft for legal review
Privacy
Last updated: 2026-10-22
1. Controller
The data controller is the operator of Propiedad Paraguay (contact details and tax id to be completed before launch). Write to propiedadparaguay5@gmail.com with any question about your data or to exercise your rights. This policy follows Law 7593/2025 on Personal Data Protection and Law 4868/2013 on Electronic Commerce.
2. What data we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, password (only its Argon2id hash), optional username, name; WhatsApp number if you verify it; if you sign in with Google, your Google account's identifier and email | Create your account and sign in | Performance of the contract | While the account exists |
| Favorites, saved searches, follows | Show what you saved and send alerts | Contract; consent for WhatsApp alerts | While the account exists or until you delete them |
| Listings, photos, texts, property location | Publish and show listings; translate them | Contract | Listing history: asking prices, changes, and how and at what price each offer ended if you tell us, shown to registered users without the agent’s name and kept as market data; the unit number is shown on the page; photos are deleted when the listing is removed |
| Exclusivity contracts (document, owner's name and national id) | Verify the exclusivity the agent declares | Legitimate interest (fraud prevention) and truthfulness duty | Document deleted upon decision; verification record kept. The national id is stored encrypted and never shown |
| Contacts (leads): listing, channel, time, user when signed in, and the message if you wrote one | Deliver the message you write to an owner by email; agent response statistics and abuse prevention | Contract (delivering your message) and legitimate interest | 24 months |
| Listing reports | Moderation | Legitimate interest | 24 months |
| Connection logs (IP, timestamp, user agent) and the log of private-document views and admin actions | Security, abuse prevention and legal compliance | Legal obligation (Law 4868: at least 6 months) and legitimate interest | 6 to 12 months. In the log of views and actions, the IP and user agent are erased after 12 months and only what was done and when remains |
| Agency tax id (RUC) | Verified-agency badge | Contract | While the agency exists |
3. Cookies and analytics
We use a single cookie (__Host-pp_session), strictly necessary to keep you signed in; it is HttpOnly, Secure and SameSite.
We use no advertising or tracking cookies. Audience analytics are cookie-free (Cloudflare Web Analytics) and do not identify
people. The installable app stores pages and photos you already viewed on your device to work offline; you can clear them from your browser.
4. WhatsApp and email
Codes to verify your number are sent over WhatsApp at your request. WhatsApp alerts (new listings, price drops, "still available?") are messages we initiate and require your explicit consent, which you can give and withdraw in My account. We use templates approved by Meta; reply "STOP" to any message to opt out. Agents receive contact messages directly on their WhatsApp: the Site records only that a contact happened, not the conversation.
5. Who we share data with
- Infrastructure providers (Cloudflare: hosting, database, file storage, maps) under data processing agreements. Data may be hosted outside Paraguay; Law 7593 applies regardless.
- Meta (WhatsApp Business Platform) and the transactional email provider, only to deliver messages.
- Google, only if you choose to sign in with Google: Google knows you used its account to sign in here. We do not receive your contacts or your mail.
- OpenStreetMap (Nominatim): when you search for an address we do not hold while publishing, our server sends only the text you typed to its search, without your account or your IP address.
- Have I Been Pwned: when you choose a password we check whether it appears in known breaches by sending only the first 5 characters of its SHA-1 hash, never the password.
- Advertisers: when you contact an agent, they receive your message over the channel you chose. When you write to an owner by email from a listing, we send them your message with your name and your account's email so they can answer you; their address is not shown to you.
- Authorities, when a lawful order requires it.
We do not sell personal data or use it for third-party advertising.
6. Your rights (Law 7593)
You have the right, free of charge, to:
- Access your data and get a copy instantly, without asking us: the "Download my data" button in My account gives you a file with everything we hold about you (profile, open sessions, favorites, consents, saved searches and the alerts you received, the listings you published with their price history, the inquiries you sent, reports, exclusivity contracts, and the log of your activity over the last 12 months). It never includes other people's data or national id numbers (stored encrypted and never returned). You can download it up to 3 times a day.
- Rectify inaccurate data (name and language from My account; anything else by writing to support).
- Delete your data: the "Delete my account" button in My account ends your sessions and deletes or anonymizes your personal data across every module of the Site; only records required by law (connection logs, verifications) are kept for the stated period.
- Object to processing based on legitimate interest and withdraw consents (alerts).
- Port your data: that same download is a JSON file, a structured, commonly used format you can take to another service.
- Lodge a complaint with Paraguay's data protection authority.
Downloading and deleting your data need no email to us. For the other rights, write to support: we answer within the legal deadlines and may ask you to verify your identity through the same channel you sign in with.
7. Security
Passwords are stored only as Argon2id hashes and ones known from breaches are refused; you can turn on a second step (authenticator app or passkey) with recovery codes; sessions live in secure, expiring cookies; moderation staff use passkeys or an authenticator app. Private documents (exclusivity contracts) live in a private store, open only through short-lived signed links, and every access is logged. National ids are encrypted in the database. Photos are re-encoded on the server, which strips metadata and GPS location. If an incident affects your data, we will notify you and the authority as the law requires.
8. Minors
The Site is intended for people aged 18 or over. We do not knowingly create accounts for minors.
9. Public data sources and credits
The basemap uses data from © OpenStreetMap contributors (ODbL). Parcel data comes from the Servicio Nacional de Catastro; we show only listing locations and, where authorized, lot outlines, never owner data.
10. Changes
If we change this policy we will publish the new version with its date and, for material changes, notify you through your account channel.