Bright Real Estate

Last updated: 19 October 2026

This Privacy Policy explains how Bright Real Estate collects, uses, shares, and protects personal data when you use the Bright Real Estate platform, websites, Lives (live-streamed property presentations), and related services (together, the Platform).

1. Who We Are — Data Controller

The data controller is:

Andrew James Lee, doing business as Bright Real Estate
Calle Países Bajos 6, Pol. Ind. San Pedro Alcántara
Marbella, Málaga 29670, Spain
E-mail: bright@estalara.com
Phone: +34 648 98 11 11

Andrew James Lee determines why and how the personal data described in this Policy is processed.

The Platform is offered to users in the European Union and European Economic Area. We process personal data in accordance with the General Data Protection Regulation (GDPR). The controller is established within the European Union.

2. How the Platform Works

Bright Real Estate is a real-estate platform that allows users to:

create an account and public or professional profile;
publish, browse, and manage property listings;
apply for verified agent or agency status;
communicate with other users;
host, join, and watch Lives;
connect selected advertising and streaming services;
use AI-assisted property and document features;
purchase paid Platform features; and
receive analytics-supported improvements and notifications, subject to their choices.

The processing that applies to you depends on which features you use.

3. Personal Data We Process

3.1 Account and authentication data

When you create an account, we process your:

username;
e-mail address;
chosen language;
sign-up date; and
authentication credentials.

Passwords are stored in hashed form and not as plain text.

Purpose: creating and securing your account, enabling sign-in, and sending essential service messages such as password resets and security alerts.

Legal basis: performance of a contract or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR); legitimate interests in securing the Platform (Article 6(1)(f) GDPR).

Required: yes. Without this information, an account cannot be created.

3.2 Profile data

Depending on the type of account, you may provide:

name;
profile picture;
biography;
company or agency;
country;
languages;
telephone number;
professional e-mail address;
website; and
links to professional social-media profiles.

Purpose: displaying and personalising your profile, allowing other users to identify or contact you, and providing Platform features.

Legal basis: performance of a contract (Article 6(1)(b) GDPR). Where a field is not necessary to provide the service, you choose voluntarily whether to make it available.

3.3 Agent and agency applications

If you apply for agent or agency status, we may process:

licence number, issuing country, and expiry date;
company name, registered address, and tax number;
professional contact details and website;
countries and cities in which you operate;
optional professional social-media profiles;
a copy of a professional licence; and
insurance or professional indemnity documents.

Purpose: assessing and verifying your application, preventing impersonation and fraud, communicating the result, and meeting applicable professional or legal requirements.

Legal basis: steps taken at your request and performance of a contract (Article 6(1)(b) GDPR); compliance with a legal obligation where applicable (Article 6(1)(c) GDPR); legitimate interests in verifying professionals and protecting Platform users (Article 6(1)(f) GDPR).

Required: the information marked as required in the application is necessary to obtain verified status. Social-media profiles are optional.

3.4 Property listings and uploaded materials

Agents, agencies, presenters, and property developers may upload:

property descriptions, addresses, and geographic coordinates;
photographs, videos, floor plans, and other property materials;
ownership, agency, or listing-related documents;
presenter or company details; and
other content used to create, advertise, or present a listing.

Uploaded content may contain personal data. You must have the right to provide that content to us and to make it available through the Platform.

Purpose: creating and displaying listings, running property presentations, supporting search, advertising, and AI-assisted property features.

Legal basis: performance of a contract (Article 6(1)(b) GDPR); legitimate interests in operating and improving listing features (Article 6(1)(f) GDPR).

3.5 Messages and Live chat

When you communicate through the Platform, we may process:

message or chat content;
sender and recipient identifiers;
timestamps;
delivery and read status; and
reports or moderation information.

Messages are not end-to-end encrypted. Authorised personnel may access content where reasonably necessary to investigate reported abuse, maintain the service, protect users, or comply with law.

Purpose: delivering communications, providing conversation history, moderating abuse, and maintaining security.

Legal basis: performance of a contract (Article 6(1)(b) GDPR); legitimate interests in preventing abuse and securing the Platform (Article 6(1)(f) GDPR); compliance with legal obligations where applicable (Article 6(1)(c) GDPR).

When you host or actively participate in a Live, we process the audio, video, display name, chat contributions, and screen content that you choose to transmit. We may also process Live events such as joining, leaving, role changes, and technical quality information.

Browser or device permission allows the Platform to access your camera or microphone. Granting a technical device permission does not by itself constitute consent to every separate use of personal data.

Camera, microphone, and screen sharing can be switched off when the relevant feature permits. Passive viewers are not required to transmit camera or microphone content.

A Live may be recorded or restreamed where that feature is enabled. Where recording or public broadcasting applies, users will be informed through the relevant Live interface or notice and, where required, consent will be requested.

Purpose: providing Lives, participant interaction, screen sharing, recordings, restreaming, and technical support.

Legal basis: performance of a contract (Article 6(1)(b) GDPR); consent where required for recording, optional participation, or public disclosure (Article 6(1)(a) GDPR); legitimate interests in service security and diagnostics (Article 6(1)(f) GDPR).

3.7 Advertising and Meta integration

Agents may optionally connect a Meta account to create and manage Facebook or Instagram advertising campaigns through Bright Real Estate. Depending on the selected features, we may process:

Meta user and business identifiers;
identifiers of the advertising account and page, and the currency and time zone of the advertising account;
access tokens and the list of permissions granted to the integration;
information about the advertising account provided by Meta, such as whether the account can run ads and whether a payment method is set up;
campaign settings you enter in the Platform and the advertising texts prepared for you;
identifiers that Meta assigns to your campaigns, ad sets, ads, and images, and ad previews provided by Meta;
the delivery status of your campaigns and their performance data retrieved from Meta.

In this Policy, "data obtained from Meta" also includes information derived from that data and copies of it contained in reports, snapshots, and other records. Campaign settings and advertising texts created in the Platform are treated separately only to the extent that they do not contain, and are not derived from, data obtained from Meta.

When creating and running campaigns, we send the following to Meta: images and materials from your listings, ad content (headlines, descriptions, and calls to action), the listing URL, targeting parameters (geographic location and language), the campaign objective, budget, and schedule. From Meta we retrieve the delivery status of your campaigns (for example, whether ads were rejected or are not being delivered) and performance data, such as impressions, reach, clicks, spend and, where measured, conversions.

Access tokens are encrypted in transit and at rest and are accessible only to authorised integration processes.

Bright Real Estate does not embed or fire the Meta Pixel on its pages and does not send conversion events via the Pixel or the Conversions API.

Once this feature is enabled — and only after the required consent or another valid basis has been obtained — conversion measurement may involve firing the Meta Pixel on the device of a visitor to the campaign's destination page and sending events to Meta via the Conversions API. In that case, event data such as the following may be transmitted to Meta: the event name and time (e.g. content view, contact, lead), the page or listing URL, Meta identifiers (fbp, fbc), the IP address and browser information (user-agent), and — where applicable — a hashed e-mail address or phone number used to match the event. Before enabling this feature, we will update this Policy and, where required, request consent.

For events collected through the Meta Pixel on a visitor's device, Meta and the controller act as joint controllers within the meaning of Article 26 GDPR, on the joint-controller terms determined by Meta. Otherwise — for the data of your account and advertising account with Meta and the operation of the Meta platform — Meta acts as an independent controller under its own terms.

We use data obtained from Meta only to provide the integration to you: to create, run, stop, and report on your own campaigns, to check whether they are being delivered, to optimise them, and to settle or refund our fees for those campaigns. We do not combine this data with the data of other advertisers or with campaigns on other advertising platforms, do not use it to build or enrich profiles of people or for retargeting, do not sell it, and do not use it to train artificial intelligence models. We also do not use your campaign settings or advertising texts to train artificial intelligence models.

Within the Platform, data obtained from Meta is accessible only to the user who pays for the campaign and to members of that user's agency who are authorised to manage the advertised listing, acting on behalf of the advertiser concerned. Reasons for delivery problems that relate to the advertising account are visible only to the user who pays for the campaign. Our authorised staff and service providers acting on our instructions may access the data only to operate, secure, and support the integration.

Purpose: connecting accounts; creating, running, stopping, and reporting on campaigns; detecting campaigns that are not being delivered; settling and, where applicable, refunding our service fees; and measuring and optimising your campaigns.

Legal basis: performance of our contract with you, where you are personally a party to it (Article 6(1)(b) GDPR); otherwise, our legitimate interest in providing the integration to the organisation you represent and in administering its authorised users (Article 6(1)(f) GDPR); compliance with accounting and tax obligations imposed by Union or Member State law applicable to us (Article 6(1)(c) GDPR) and, where record-keeping is required solely by the laws of other countries, our legitimate interest in complying with those obligations, subject to necessity, proportionality, and your rights (Article 6(1)(f) GDPR); consent, once conversion measurement is enabled, for non-essential advertising identifiers or tracking on a visitor's device (Article 6(1)(a) GDPR); legitimate interests in account security, integration diagnostics, and — for data that is not data obtained from Meta — in establishing, exercising, or defending legal claims relating to our fees (Article 6(1)(f) GDPR).

You may disconnect the integration in Platform settings at any time. Disconnecting immediately deletes from our active production systems the Meta access token and connection identifiers (Meta user, business, advertising account, and page) assigned to your Bright Real Estate account and stops further access through that connection. We also ask Meta to revoke the app's permissions, except where the same Facebook user remains connected to another Bright Real Estate account; that other connection continues to work. Deletion from our production systems does not depend on Meta's response.

If the access token expires or Meta invalidates it (for example, after a password change or after you remove the app in your Facebook settings), we delete the token as soon as we learn that it is no longer valid. We keep the connection identifiers only to stop campaigns that are still running and to notify you, and delete them no later than 30 days after we learn that the token is no longer valid.

Disconnecting does not delete your campaign history in the Platform: campaign settings, advertising texts, the Meta identifiers of your campaigns, and the delivery and performance data retrieved from Meta remain available to you for as long as your account exists, unless you ask us to delete your Meta data (see our Data deletion instructions), or Meta or applicable law requires us to delete it earlier. These are maximum periods: we delete data obtained from Meta earlier when it is no longer necessary for the purposes described in this section or when we stop operating the integration, except where the law requires us to keep it. The campaigns themselves remain in your Meta advertising account. We do not control data already processed by Meta acting as a controller — that data is subject to Meta's policies.

3.8 YouTube integration and restreaming

Agents may optionally connect a Google or YouTube account. We may process:

Google OAuth tokens;
YouTube channel identifiers and basic channel information;
selected restreaming settings; and
Live status and technical information.

Purpose: connecting a YouTube channel and restreaming Lives.

Legal basis: performance of a contract (Article 6(1)(b) GDPR); consent or authorisation provided through the Google OAuth flow for access to the connected account (Article 6(1)(a) GDPR where applicable).

You may disconnect YouTube in Platform settings. Disconnecting stops future access by the Platform and removes stored access credentials, subject to security logs and legally required records.

3.9 AI assistant and document processing

When you use AI-assisted features, we may process:

questions, prompts, and conversation content;
property information and geographic coordinates;
documents that you choose to upload;
document fragments and search embeddings;
generated answers; and
diagnostic information about AI feature performance.

Relevant content may be sent to OpenAI to generate responses and to Cohere for AI processing or document reranking. When you ask about a property's surroundings, its geographic coordinates may be sent to Google Places API to identify nearby locations.

We may remove common identifiers such as e-mail addresses, telephone numbers, PESEL numbers, IBANs, and payment-card numbers before storing diagnostic query logs. Automated removal reduces risk but cannot guarantee that every identifier in free-form text or documents will be detected.

Do not upload special-category data, criminal-offence data, or documents containing unnecessary information about third parties unless the feature expressly supports that use and you have a valid legal basis.

We do not use documents submitted to the assistant to train external providers' models unless we inform you and have an appropriate legal basis. We use personal data to train or fine-tune our own models only where the data has been effectively anonymised or where separate valid consent has been obtained.

Purpose: answering questions, searching documents, providing information about properties and their surroundings, maintaining security, diagnosing faults, and evaluating feature performance.

Legal basis: performance of a contract (Article 6(1)(b) GDPR); legitimate interests in security, diagnostics, and service improvement (Article 6(1)(f) GDPR); consent where required for an optional or additional use (Article 6(1)(a) GDPR).

3.10 Payments and transaction records

When you use paid features, we may process:

wallet balance;
amounts and currency;
transaction type and history;
subscription or purchased-feature information;
billing or tax information; and
Stripe transaction or reference identifiers.

Payment-card details are processed by Stripe and are not intended to reach our servers.

Purpose: processing payments, maintaining balances and billing history, preventing fraud, and meeting accounting and tax requirements.

Legal basis: performance of a contract (Article 6(1)(b) GDPR); compliance with legal obligations (Article 6(1)(c) GDPR); legitimate interests in preventing payment fraud (Article 6(1)(f) GDPR).

3.11 Push notifications

If you enable browser notifications, we process a Firebase Cloud Messaging (FCM) device token. The token is a pseudonymous identifier used to route notifications to a browser or device.

Purpose: sending alerts about messages, account activity, and relevant Platform events.

Legal basis: consent (Article 6(1)(a) GDPR).

Notifications are optional. You can withdraw permission in browser settings. You may also remove a registered token through the available Platform settings or by contacting us.

3.12 Maps and location services

The Platform uses Leaflet and map tiles provided by OpenStreetMap. Geographic searches may use the Overpass API. When map content is requested, the relevant provider may receive an IP address and standard HTTP request information.

Purpose: displaying property locations and supporting geographic search.

Legal basis: performance of a contract (Article 6(1)(b) GDPR); legitimate interests in providing useful location features (Article 6(1)(f) GDPR).

3.13 Analytics and session replay

If you accept optional analytics, we use PostHog to understand how the Platform is used and where technical or usability problems occur.

Depending on configuration, PostHog may process:

a pseudonymous account or session identifier;
pages and features used;
clicks and navigation events;
browser and device information;
error and performance information; and
session-replay data showing interactions with the Platform.

Session replay is intended to help reproduce usability and technical problems. Sensitive input fields should be excluded or masked through technical configuration. You should nevertheless avoid entering unnecessary sensitive data into free-form fields.

PostHog is configured to use EU infrastructure. Before analytics consent, it uses memory-only, cookieless operation and is not linked to your account by us. After consent, analytics may use local storage and cookies and may be associated with your account identifier.

Purpose: analytics, diagnosing errors, improving usability, and understanding feature performance.

Legal basis: consent (Article 6(1)(a) GDPR).

You may decline analytics or withdraw consent at any time through cookie settings. Withdrawal stops future analytics collection and session replay on that device.

3.14 Server logs and security data

Our systems and service providers may automatically process:

IP address;
request URL and timestamp;
browser and device information;
authentication and security events;
error information; and
identifiers needed to investigate incidents or prevent abuse.

Sensitive request values should be removed or masked before being written to application logs where technically possible.

Purpose: securing the Platform, preventing abuse and fraud, diagnosing failures, and investigating incidents.

Legal basis: legitimate interests in security and reliable service operation (Article 6(1)(f) GDPR); compliance with legal obligations where applicable (Article 6(1)(c) GDPR).

4. Artificial Intelligence and Profiling

4.1 Interaction with AI

When you use the AI assistant, you are interacting with an automated system and not a human. AI-generated answers may be incomplete or inaccurate and should not be treated as legal, financial, investment, or other professional advice.

The EU AI Act transparency requirements generally apply from 2 August 2026. We aim to provide clear information about AI interaction and generated content in the relevant interfaces.

4.2 AI-supported advertising and recommendations

AI may assist with creating advertising text, property descriptions, translations, summaries, or other content. Human users remain responsible for reviewing content before publication where the Platform provides a review step.

Where content is artificially generated or materially manipulated, it will be labelled or technically marked where required by applicable law and taking into account the respective obligations of the AI provider and the user deploying the content.

4.3 Profiling and automated decisions

The Platform may use limited automated processing to personalise features, support search, recommend content, assess campaign performance, or assist agents in organising enquiries.

Unless we provide a separate notice for a specific feature, we do not use solely automated processing to make decisions that produce legal effects or similarly significant effects concerning you. In particular, the Platform does not automatically decide whether you may buy, rent, view, or enquire about a property, determine your eligibility for housing or credit, or change a property's legal terms based on profiling.

If we introduce behavioural scoring, sentiment analysis, adaptive listing presentation, or another material profiling feature, we will provide information about the data used, purpose, logic, consequences, legal basis, retention, and available controls before the processing begins.

5. Cookies and Similar Technologies

The Platform uses cookies, local storage, and similar technologies for authentication, language settings, consent preferences, analytics, advertising integrations, and push notifications.

Non-essential analytics or advertising technologies are used only after the required consent has been obtained. Further information is available in our Cookie Policy.

We do not sell personal data.

We may share personal data with:

AWS / Amazon Web Services — hosting, file storage, Live video, and related infrastructure;
Stripe — payment processing and fraud prevention;
Firebase / Google — push notifications;
PostHog — analytics and session replay (with consent);
Meta Platforms — account connection and advertising;
Google / YouTube — account connection and Live restreaming;
OpenAI — AI response generation;
Cohere — AI processing and document reranking;
Google Places API — property-surroundings and nearby-location search;
OpenStreetMap and Overpass providers — maps and geographic search.

We may also share data with:

agents, agencies, presenters, or other users where this is necessary to provide a feature you request;
professional advisers acting under confidentiality;
authorities, courts, or law-enforcement bodies where disclosure is legally required or necessary to protect rights and safety; and
a buyer, investor, or successor in connection with a merger, acquisition, restructuring, or transfer of the business, subject to appropriate safeguards.

Service providers that process personal data on our behalf are required to act under appropriate contractual and confidentiality obligations.

Where an agent or agency receives a lead or other personal data for its own follow-up and determines its own purposes and means of processing, it may act as a separate controller and must provide its own privacy information.

7. International Data Transfers

The controller is established in the European Union. Where possible, we use provider infrastructure located in the European Economic Area. Some providers may nevertheless process data outside the EEA.

Where the GDPR requires transfer safeguards, we use an applicable lawful transfer mechanism, such as:

an adequacy decision, including the EU-US Data Privacy Framework for a certified recipient;
the European Commission's Standard Contractual Clauses; or
another mechanism permitted by Chapter V GDPR.

Where appropriate, we assess supplementary technical, contractual, and organisational measures. You may contact us for information about the safeguards applicable to a particular transfer.

8. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the relevant purpose, including legal, accounting, security, and dispute-resolution requirements.

Our current general retention periods are:

Account and authentication data — until account deletion, followed by backup deletion cycles of up to 1 year;
Profile data — until removed by the user or the account is closed;
Agent or agency application and verification documents — while verified status is active and generally up to 5 years afterwards where needed for claims, compliance, or verification records;
Property content and uploaded documents — until deleted, the relevant listing or account is closed, or retention is otherwise required;
Direct messages — until the relevant account or conversation is deleted, subject to abuse reports and legal requirements;
Live recordings — for the period communicated for the relevant recording or until it is deleted, subject to legal requirements and copies published on third-party platforms;
Payment, billing, and transaction records, including those relating to advertising (our fees and refunds and the information needed to document them) — for the statutory retention period applicable to each record under the accounting and tax laws that apply to us, calculated from the starting date those laws prescribe (under Polish law, generally 5 years from the end of the financial year to which the records relate). Records relating to advertising contain data obtained from Meta only to the extent the law requires it;
Meta access tokens and connection identifiers (Meta user, business, advertising account, page) — while the integration is connected; deleted immediately on disconnection or account closure. A token that has expired or that Meta has invalidated is deleted as soon as we learn that it is no longer valid; the connection identifiers are then kept for no longer than 30 days and only to stop running campaigns and to notify you;
Campaign settings and advertising texts created in the Platform — for the life of your account; after the account is closed, only the elements that form part of billing records (such as the campaign name, budget, and dates linked to our fees), for the period applicable to those records;
Data obtained from Meta about your campaigns (Meta identifiers of campaigns, ad sets, ads, and images, ad previews, delivery status, performance data, and information derived from them) — at most for the life of your account; deleted earlier if you request deletion of your Meta data, when it is no longer necessary for the purposes described in Section 3.7, when we stop operating the integration, or when Meta or applicable law requires it; deleted when the account is closed. We may keep only aggregated statistics that cannot be associated with you, your agency, your advertising account, or any other person, browser, or device. They remain subject to Meta's restrictions, we use them only to assess the performance and effectiveness of advertisers' campaigns, and we delete them as soon as they are no longer needed for that purpose, when we stop operating the integration, or if Meta asks us to;
YouTube access credentials — until the integration is disconnected, the credential expires, or the account is closed;
AI diagnostic query logs — generally up to 90 days;
AI documents and embeddings — until deleted by the user or the relevant account is closed;
Push-notification tokens — until removed, invalidated, permission is withdrawn, or the account is closed;
Application and security logs — generally up to 90 days, unless needed for an active incident, claim, or legal obligation;
Analytics and session-replay data — according to our configured PostHog retention period and consent settings;
Consent records — for as long as needed to demonstrate consent and address related legal claims.

Deletion from active systems may not immediately remove data from encrypted backups. Backup copies are isolated from ordinary use and deleted or overwritten according to backup cycles.

9. Your Rights

Where the GDPR applies, you may have the right to:

access your personal data;
correct inaccurate or incomplete data;
request deletion;
restrict processing;
receive data you provided in a structured, commonly used, machine-readable format;
object to processing based on legitimate interests, including the use of AI-assistant data to improve models;
withdraw consent at any time, without affecting processing carried out before withdrawal;
obtain information about relevant automated decision-making and profiling; and
lodge a complaint with a data-protection supervisory authority.

You may complain to the authority in the country where you live, work, or believe an infringement occurred. The supervisory authority for the controller is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan 6, 28001 Madrid, Spain
https://www.aepd.es

Users in Poland may also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.

Rights are subject to the exceptions provided by applicable law; for example, we may retain information required for tax records, fraud prevention, legal claims, or compliance with law. For data obtained from Meta, the general provisions on fraud prevention, security logs, and legal claims do not extend the retention permitted under Sections 3.7 and 8.

To exercise a right, contact bright@estalara.com. We may need to verify your identity. We normally respond within 30 days, subject to extensions permitted by law for complex or numerous requests.

If data has been shared with an agent acting as a separate controller, you may also need to contact that agent regarding its subsequent processing.

9.1 Account deletion

To delete your account, send a request to bright@estalara.com from the e-mail address associated with the account. We may take reasonable steps to verify your identity. We delete your account, profile, and related content without undue delay and inform you of the action taken no later than one calendar month after receiving the request (see Section 5 of our Data deletion instructions for extensions). If we need additional information to complete the request, we will tell you.

Closing your account also deletes all data obtained from Meta through the advertising integration (see Sections 3.7 and 8), except records we are required by law to keep — in particular accounting and tax records relating to our advertising fees — and aggregated statistics that cannot be associated with you, your agency, your advertising account, or any other person, browser, or device. The general provisions on security logs and legal claims do not extend the retention of data obtained from Meta.

We retain certain data for the period required by law or justified by a valid legal basis, in particular accounting and tax records and a limited set of security logs (see Section 8). Data removed from production systems may temporarily remain in encrypted backups, which are deleted or overwritten in line with our backup cycle. These backups are isolated from ordinary operations, are not accessible in the normal functioning of the Platform, and are not restored to an active account.

10. Security

We use technical and organisational measures appropriate to the nature and risk of the processing. These may include encryption in transit and at rest, access controls, token protection, logging, backups, and monitoring.

No online service can guarantee absolute security. You are responsible for protecting your password, devices, connected third-party accounts, and any content you choose to share publicly.

11. Children

The Platform is intended for adults and is not directed to children under 18. We do not knowingly create accounts for or collect personal data directly from children. If you believe a child has provided personal data, contact us so that we can investigate and take appropriate action.

12. Changes to This Policy

We may update this Policy when the Platform, providers, or legal requirements change. The revision date at the top identifies the current version.

If a change materially affects how we process personal data, we will provide an appropriate notice through the Platform, by e-mail, or by another suitable method before the change takes effect where required.

13. Contact

Andrew James Lee (Bright Real Estate)
Calle Países Bajos 6, Pol. Ind. San Pedro Alcántara
Marbella, Málaga 29670, Spain
E-mail: bright@estalara.com
Phone: +34 648 98 11 11

Privacy Policy