Privacy Policy
Version: 2026-09-11
*Translation for convenience. The Spanish original prevails in case of discrepancy.*
This policy explains how Mansaria processes the data of the people who use the platform: owners and employees of agencies.
Data about the agency’s clients (buyers, sellers, tenants) is processed by the agency itself as controller; Mansaria acts as processor under the DPA.
Controller
Myroslav Podryhulia, tax ID Y9837838Q (NIE), calle La Laja, 7, 38678 Adeje, Santa Cruz de Tenerife, Spain. Contact: info@profilab.org.
What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (hashed), two-step factors | Account access | Performance of contract (art. 6.1.b) |
| Name, phone, job title | Identification within the team | Performance of contract |
| Agency name, tax ID, address | Invoicing and documents | Legal obligation (art. 6.1.c) |
| Access and change logs | Security and proof of compliance | Legitimate interest (art. 6.1.f) |
| Connected mailbox: address and permissions granted; for each letter sent from a record, recipient, subject and date | Writing to the client from their record | Performance of the contract |
| Support requests: the topic you pick, your description and the attached technical context | Handling and reproducing the incident | Legitimate interest |
The technical context is attached only if you tick the box when sending the request and covers the section you write from, your browser and window size, the interface language, your role, the agency plan and metadata of the latest actions in the system — what changed and when. It never includes the content of your clients, deals or documents: that data is yours and we only process it on your instructions, as set out in the DPA.
Your correspondence is not stored. If you connect your mailbox, we do not copy its contents — neither into the database nor into the backups: when a client record is opened we ask your provider for the letters exchanged with that address and show them on screen. You can disconnect the mailbox at any time, and we immediately lose access.
We do not use the data for advertising and we do not sell it. There is no behavioural analytics and no profiling.
Cookies
The service uses a technical session cookie, necessary to keep you signed in, and — if you answer the notice — a cookie that stores that answer. Under the Spanish supervisory authority’s guidance, strictly necessary cookies do not require consent.
On the public pages (home, sign-up and legal documents) advertising cookies from Google and Meta may be used, for the sole purpose of knowing which ad brought a sign-up. They are not set without your consent: until you give it, nothing is loaded from those providers. Consent is asked in a notice where accepting and refusing cost the same, and it can be withdrawn at any time from “Cookie settings” at the foot of the page.
Inside the application, once signed in, there are no third-party or measurement cookies.
Knowing which campaign a sign-up came from does not depend on these cookies: campaign tags travel in the web address and are not stored on your device, so that measurement works the same if you refuse.
Retention
Account data is kept while the contract is in force and for the limitation periods applicable to tax and contractual obligations.
Support requests, together with their technical context, are kept for as long as they are needed to handle them and as proof of compliance.
Data the agency enters about its clients is governed by the agency’s instructions and by the DPA.
Recipients
The providers listed in SUBENCARGADOS.md. No one else, except where legally required.
International transfers
Where a provider is outside the EEA, the transfer relies on the European Commission’s Standard Contractual Clauses. Details are in the subprocessor list.
Your rights
Access, rectification, erasure, objection, restriction and portability, by writing to info@profilab.org. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
If your relationship is with a real estate agency that uses Mansaria, contact them first: they decide what data about you is processed.
Security
Technical measures are described in Annex I of the DPA. Should a breach occur that poses a high risk to your rights, we will inform you without undue delay.
Changes
Changes are published with a new version and date. If they affect essential terms, acceptance will be requested on sign-in.