Privacy Policy

1. Data Controller

The Agent Trust is a platform operated under Portuguese law. The entity responsible for the processing of your personal data is:

• Entity: The Agent Trust
• Contact Email: support@theagenttrust.com
• Website: https://theagenttrust.com

2. Scope and Application

This Privacy Policy applies to all personal data collected through the The Agent Trust platform (website and associated services), including account registration, lead submissions, review submissions, professional profiles, and payment processing. By using our platform, you acknowledge the practices described in this policy.

3. Personal Data We Collect

We collect different categories of personal data depending on how you interact with our platform:

3.1 Website Visitors

When you visit our website we collect technical data needed for the site to work — session tokens and basic browser information — through strictly necessary cookies. Analytics, session-recording, and remarketing cookies are activated only after you accept the consent banner. See section 3.8 and section 7 for detail.

3.2 Registered Users (Homeowners)

When you create a free account, we collect your full name, email address, and password (stored securely hashed). You may also save favorite professionals and submit leads. This data is necessary to provide our service.

3.3 Lead Submissions (Contact Requests)

When you contact a professional through our platform, we collect: your name, phone number, email address (optional), interest type (buy/sell/valuation), and any additional details you choose to provide (timeframe, property details, notes). This data is shared with the professional you are contacting.

3.4 Review Submissions

When you submit a review, we collect: your name, email address, rating, review text, and optionally a property address for transaction verification. Your name and review text are displayed publicly. Your email is not published.

3.5 Real Estate Agents

Agents provide professional profile data including: phone number, bio, address, years of experience, service zones, languages, contract types, AMI license number and proof document, social media links, and an avatar photo. Agents may also link their Google Business profile to sync reviews. This data is displayed publicly on the agent's profile page.

3.6 Real Estate Agencies

Agencies provide business data including: business name, email, phone, address, website, logo, contract types, and social media links. Agencies may also link their Google Business profile. This data is displayed publicly on the agency's profile page.

3.7 Payment Data

Payment processing is handled entirely by Stripe, Inc. We do not store credit card numbers or full payment details. We store only your Stripe customer identifier, subscription status, and transaction history for billing and accounting purposes.

3.8 Analytics, Heatmaps and Session Recording

After your explicit consent in the cookie banner, we work with Google Analytics 4 and Microsoft Clarity to understand how you use the site, through usage metrics, heatmaps and session replay. This data is collected with first- and third-party cookies, each one listed in section 7, and helps us learn which pages work, spot errors and improve the service. Session recordings mask the content of every form field, all numbers and all e-mail addresses by default. If you are signed in, we send Google Analytics 4 your account's internal identifier — a random code containing neither your name nor your contact details — so that one person is not counted as several visitors across devices. We do not use this data for advertising or remarketing. You can withdraw consent at any time through “Manage cookies” in the footer of any page. For details on how Microsoft processes this data, see the Microsoft Privacy Statement at www.microsoft.com/privacy/privacystatement; for Google, policies.google.com/privacy.

3.9 Profiles Compiled from Public Sources

Some professional and agency profiles displayed on the Platform are compiled by The Agent Trust from publicly accessible sources — namely the IMPIC public registry of AMI licences, Google business profiles, social media, and professional websites — before the data subject claims the profile. The categories of data processed include name, professional designation, areas of operation, AMI licence number, and public reviews. The legal basis is legitimate interest (Article 6(1)(f) GDPR) in providing a real estate transparency directory, balanced against the data subject's rights, given that the data is professional in nature and already public. In accordance with Article 14 GDPR, the professional has the right to object to this processing (Article 21), to access, rectify, or request erasure of their data, and to claim or remove their profile, by contacting us through the means indicated in the Contact section of this Privacy Policy.

3.10 Server-Side Conversion Measurement

We record four events server-side, each of which depends on an action you took: submitting a lead, creating an account, completing a professional profile, and publishing a review. For each we send Google Analytics 4, via the Measurement Protocol, an event that contains NO personal data: no name, no contact details, no IP address, no advertising identifiers. We send only a pseudonymous code derived from a random internal identifier, plus one non-identifying attribute of the action itself — the request type, the account type, or the rating given. None of these events measures your browsing: they count only actions you initiated yourself. This first-party measurement lets us count what happens on the Platform and assess how the service performs. It is independent of the cookie banner and rests on legitimate interest (Article 6(1)(f) GDPR). It is distinct from the behavioural analytics described in section 3.8, which is enabled only after your consent. We do it server-side because without consent, browser measurement does not produce reliable counts — and for reviews submitted through an e-mailed link, it produces none at all. You may object to this measurement at any time (Article 21 GDPR) using the contact details given in this Policy.

4. Legal Bases for Processing

We process your personal data under the following legal bases as defined in Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): For lead submissions, review submissions, and optional data such as social media links. You can withdraw consent at any time.
• Performance of a Contract (Art. 6(1)(b)): For account creation, service delivery, profile management, and payment processing.
• Legitimate Interest (Art. 6(1)(f)): For platform security, fraud prevention, professional profile indexing from publicly available sources, Google review synchronization, and server-side lead conversion measurement without personal data (see section 3.10).
• Legal Obligation (Art. 6(1)(c)): For AMI license verification under Portuguese real estate law (Lei n.º 15/2013), tax records, and financial reporting.

5. Data Sharing with Third Parties

We share personal data with the following trusted service providers (data processors), each bound by data processing agreements. Services marked "after consent" only receive data once you accept the cookie banner:

• Supabase Inc. — Cloud infrastructure, authentication, and database hosting (EU — Frankfurt, Germany).
• Google LLC — Google Places API and Google Maps for professional indexing and review synchronization (always active). Google Analytics 4 and Google Ads for measurement and remarketing (United States, after consent). We also send Google Analytics 4, server-side and without personal data, a conversion event for each lead submitted, under legitimate interest (see section 3.10).
• Microsoft Corporation — Microsoft Clarity — session recording and heatmaps to understand usage patterns and improve the site (United States, after consent).
• Meta Platforms Ireland Ltd. — Meta Platforms Ireland Ltd — the Platform's code provides for Meta Pixel, but it is not active in production and no data is sent to Meta. See section 7.5.
• Resend Inc. — Transactional email delivery — lead notifications and welcome emails (United States).
• Stripe Inc. — Payment processing for subscriptions and credit packs (United States, with EU processing capabilities).
• Vercel Inc. — Website hosting and delivery. As the host, it processes the technical data inherent to any web request, including the IP address. It also provides the Web Analytics and Speed Insights described in section 7.1 (United States, under EU Standard Contractual Clauses).

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), specifically in the United States. For providers certified under the EU-US Data Privacy Framework (including Google and Stripe), transfers rely on the European Commission's adequacy decision of 10 July 2023. For other providers, or as an additional safeguard, EU Standard Contractual Clauses (SCCs) as per Commission Implementing Decision (EU) 2021/914 apply, ensuring an adequate level of data protection.

7. Cookies and Tracking Technologies

This section lists every cookie and storage technology the Platform uses. The inventory was verified by measuring the live production site directly, rather than from vendor documentation, on the date shown with the table.

7.1 What runs without consent

Until you choose in the consent banner, the Platform stores not a single cookie on your device. Two measurements do run regardless, and both do so without writing anything to your equipment — which is why they do not depend on your consent under Article 5 of Portuguese Law 41/2004. First: Google Analytics loads in cookieless mode (Consent Mode v2, with every signal set to “denied” for the EEA, the United Kingdom and Switzerland) and sends anonymous page-view counts with no visitor identifier. Second: Vercel Web Analytics and Vercel Speed Insights, provided by our host, count page views and measure loading speed. They use no cookies either: a visitor is identified by a code computed from the request itself and discarded after 24 hours, which makes it impossible to link visits on different days to the same person. They collect the page address, where the visit came from, approximate location (country, region and city), operating system, browser and device type. Their scripts are served from our own domain, on paths generated at build time — which is why they have no fixed names. They rest on legitimate interest (Article 6(1)(f) GDPR). No analytics or advertising cookie is created before you consent.

7.2 Inventory

Inventory verified by measurement in production on 29 July 2026.

7.3 A note on Microsoft's cookies

Accepting analytics enables Microsoft Clarity. Beyond its own first-party cookies, Clarity causes Microsoft to set cookies on the clarity.ms and bing.com domains, among them MUID, which Microsoft's own documentation describes as being used “for advertising, site analytics, and other operational purposes”. We are telling you this because the “analytics” label does not make it obvious: accepting analytics sends Microsoft an identifier that also serves advertising purposes. If you would rather avoid that, decline the analytics category — the rest of the Platform works exactly the same.

7.4 Notification service worker

The Platform registers a service worker in your browser (the file /sw.js) whose purpose is to receive push notifications. It is code stored on your device, which is why we mention it here, even though it is not a cookie and neither collects nor transmits any data: it only waits for notification messages, which exist solely if you allow them in your browser. It stores no copies of pages and no browsing history. You can remove it in your browser settings, under site data.

7.5 Technologies present in the code but inactive

For transparency: the Platform's code provides for Meta Pixel and Google Ads, but neither is active in production — our measurement found no request and no cookie from either service, even with the marketing category accepted. That is why the table above has no advertising rows. Should either be switched on, this Policy will be updated before that happens.

7.6 Withdrawing or changing consent

You can withdraw consent at any time through “Manage cookies” in the footer of any page: the panel reopens with your current choices, and withdrawing is as easy as granting. Alternatively, clear this site's data in your browser, which also removes the saved preference. Either way, the analytics scripts stop loading. Cookies they already created remain in your browser until they expire or you delete them — to remove them at once, clear the site's data.

7.7 Legal basis

Strictly necessary cookies and the record of your own consent preference require no consent under Article 5 of Portuguese Law 41/2004 of 18 August, which transposes Directive 2002/58/EC. Analytics cookies rest on your consent (Article 6(1)(a) GDPR), which you may withdraw as easily as you gave it, as Article 7(3) GDPR requires.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Retained until you delete your account, plus a 30-day grace period.
• Lead submissions: Retained for 2 years from creation, unless deleted earlier by the agent.
• Reviews: Retained indefinitely as public content, or until you request removal.
• Payment and transaction records: Retained for 10 years as required by Portuguese tax law.

9. Your Rights

Under the GDPR and Portuguese Data Protection Law (Lei n.º 58/2019), you have the following rights regarding your personal data:

• Right of access — obtain a copy of your personal data (Art. 15)
• Right to rectification — correct inaccurate data (Art. 16)
• Right to erasure ('right to be forgotten') — request deletion of your data (Art. 17)
• Right to data portability — receive your data in a structured format (Art. 20)
• Right to restriction of processing (Art. 18)
• Right to object to processing based on legitimate interest (Art. 21)
• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal

To exercise any of these rights, contact us at support@theagenttrust.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD — Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

10. Children's Data

The Agent Trust is not directed at persons under 16 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), secure password hashing, row-level security in our database, and access controls. Despite our best efforts, no system can guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the platform. The "Last Updated" date at the top indicates when the policy was last revised.

13. Contact Us

For any questions about this Privacy Policy or the processing of your personal data, contact us at support@theagenttrust.com.