Privacy Policy
Last updated: 2 September 2026
Creselio is in beta
Creselio is currently in beta. This Privacy Policy describes, as accurately as we can, what information the product collects and how it is used today. It is not a statement of legal compliance with any specific data protection law, including the GDPR, and it will be revised as the product and our legal review develop.
What Creselio is
Creselio is an independent decision-support tool for people buying residential property in Spain. It helps you analyse a property's affordability and cost, prepare for and record viewings, get AI-assisted insights on what you find, compare properties, and export reports — all within your own account.
Who's responsible for this data (the controller)
Creselio is operated by Laurent Bouhnik, who is the data controller for the personal data described in this policy — the person responsible for deciding how and why it's processed. For anything privacy-related, contact hello@creselio.eu (see "Contact" below).
Account information
To use Creselio you create an account with an email address and password, or sign in with Google. Account creation and sign-in are handled by our backend provider, Supabase, which manages your authentication session.
Property, search and viewing information
When you analyse a property, Creselio stores the property and listing details you provide or import, your buyer profile and financial inputs, the generated analysis results, and any viewings you create for that property, including your checklist responses.
Notes and photos you add
If you add free-text notes or upload photos during a viewing, they are stored in your account so you can review them later. Uploaded viewing photos are kept in private storage and are only ever served back to you through short-lived, signed links — they are not publicly accessible.
AI-assisted features
Some features — such as viewing insights, listing photo intelligence and property viewing summaries — send relevant property and listing details, your free-text notes and, where applicable, your viewing photos to a third-party AI provider (Anthropic) to generate the analysis. This only happens when you explicitly request one of these AI features; it is not automatic, and results are stored in your account alongside the evidence that produced them. These AI features are decision-support only: Creselio never uses them to make an automated decision that produces legal effects concerning you or similarly significantly affects you, and every AI-generated result is meant to be reviewed and independently assessed by you, not relied on alone. We have not yet independently confirmed the exact data-retention or model-training terms that apply to our specific Anthropic account for this beta — see "International transfers" below.
Usage, quota and security telemetry
To keep Creselio reliable and to enforce fair-use limits (for example, how many analyses or AI-assisted requests an account can make), we keep limited technical records tied to your account, such as when a request was made and whether it succeeded. These records don't include the content of your notes, photos, or AI results, and are kept only as part of your account data — see "How long we keep your data" below.
Analytics and your consent
Creselio uses Google Analytics (GA4) to understand product usage, but only after you actively accept analytics in the consent prompt. If you reject or don't respond, no analytics script loads and no analytics data is sent. The events we track are a small, fixed set of product-usage events (for example, that a property was added, or a viewing was completed) and never include addresses, listing URLs, property or account identifiers, names, emails, notes, photos, financial figures, coordinates, or AI-generated content. See our Cookie Policy for what this stores in your browser.
Why we process this information, and on what legal basis
We process most of the information described above because it's necessary to provide the Creselio service you've asked for — creating and securing your account (including account-related emails such as sign-up confirmation or password reset), running the analysis and comparison features, storing your viewings and evidence so you can return to them, and generating AI-assisted insights when you request them. In each case, the legal basis is that this processing is necessary to perform the service you've asked us for (GDPR Article 6(1)(b)). We keep limited usage, quota and security telemetry, and enforce rate limits, on the basis of our legitimate interest in keeping Creselio reliable, fairly available to everyone, and protected from abuse (Article 6(1)(f)); contact us if you'd like to know more about this. Only with your freely given, specific consent do we run analytics to understand aggregate product usage (Article 6(1)(a)) — you can withdraw that consent at any time, with no effect on your ability to use Creselio and no effect on the lawfulness of analytics processing carried out before you withdrew it.
Where information is processed
Creselio relies on a small number of service providers, each used for a specific purpose: Supabase (authentication, database and private file storage), Vercel (application hosting), Anthropic (AI-assisted analysis features, only when you use them), Google (sign-in if you choose Google, and, with your consent, Google Analytics), Arsys (sends account-related emails, such as sign-up confirmation and password reset, on our behalf), RealtyAPI (looks up public listing and market data when you import a property or request comparable pricing or rental estimates — only your search inputs, such as a listing URL or a property's location, are involved), Geoapify (powers address search and location lookup when you enter a property's location), and ScrapingBee (helps us retrieve certain public listing pages when you ask us to import them). See "International transfers" below for what we have and haven't yet confirmed about how these providers handle data.
International transfers
Some of the service providers listed above may process data outside the European Economic Area (EEA) — for example, in the United States. We have not yet completed independent verification of the exact processing locations, data processing agreements, or transfer safeguards (such as the EU's Standard Contractual Clauses or an adequacy decision) currently in place for each provider. We do not claim that all processing takes place within the EEA, and we do not claim that any particular transfer mechanism applies until we've confirmed it. We'll update this section with confirmed details as that verification is completed.
How long we keep your data
We keep your account and the property, viewing, note, photo, AI-result and usage data associated with it for as long as your account stays active, or as needed for the legitimate purposes described in this policy (such as security and abuse prevention). You can permanently delete your account and all of this data at any time — see "Your rights" below — which reliably removes it, including your private viewing photos, from our active systems; deleting an individual property or viewing instead removes just that property's or viewing's own data and photos the same way. This removes the data from active use going forward; residual copies may still exist temporarily in our infrastructure providers' own backups or logs until those age out under each provider's retention schedule, and are not used by us as active account data — we haven't yet confirmed the exact duration this covers for each provider (see "Where information is processed" above). Report and viewing-summary PDFs are generated in your own browser and are never stored by Creselio. For analytics (only if you've consented), retention is governed by our Google Analytics configuration; we haven't yet confirmed the exact data-retention window set on our production GA4 property and will update this policy once we have.
What's required and what's optional
Account/authentication information is required to create and use a Creselio account — either an email address and password, or Google sign-in, depending on which method you choose; without one of these, we can't provide the service. Buyer-profile and financial information is required only for the specific features that use it, such as generating an affordability analysis; you don't need to provide it just to hold an account. Adding viewing notes, photos or custom observations is entirely optional and only happens when you choose to use those features. Accepting analytics is optional and has no effect on your ability to use Creselio either way.
Your choices in the product
You can change your analytics consent choice at any time using "Analytics settings" in the site footer. You can delete a viewing or a property from within the app, which also removes its associated photos from storage. You can also permanently delete your entire account and all of its data yourself, at any time, from your account page — see "Your rights" below for what that does and doesn't cover, and for other ways to exercise your rights.
Your rights
Subject to the conditions and exceptions set out in data protection law, you have the right to: request access to the personal data we hold about you; request correction of inaccurate or incomplete data; request erasure of your data; request restriction of how we process it; receive a copy of certain data in a portable format; and object to processing we carry out on the basis of our legitimate interests. Where we rely on your consent (analytics), you can withdraw it at any time using "Analytics settings" in the footer, without affecting the lawfulness of processing already carried out. Deleting your own account from your account page is one way to exercise your right to erasure, but not the only way, and not the way to exercise any of your other rights — for access, correction, restriction, portability, objection, or any request you'd rather make directly, email hello@creselio.eu. If you believe we haven't handled your data properly, you also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es, or with the supervisory authority in your own EU/EEA country of residence.
Contact
Data controller: Laurent Bouhnik, operating Creselio.
For privacy-related requests, contact: hello@creselio.eu
Changes to this policy
Because Creselio is in active beta, this policy may change as the product and our legal review evolve. We will update the "last updated" date above when it does.