Privacy Policy
Last updated: February 2026
1. Data Controller
The Agent Trust is a platform operated under Portuguese law. The entity responsible for the processing of your personal data is:
- Entity: The Agent Trust
- Contact Email: support@theagenttrust.com
- Website: https://theagenttrust.com
2. Scope and Application
This Privacy Policy applies to all personal data collected through the The Agent Trust platform (website and associated services), including account registration, lead submissions, review submissions, professional profiles, and payment processing. By using our platform, you acknowledge the practices described in this policy.
3. Personal Data We Collect
We collect different categories of personal data depending on how you interact with our platform:
3.1 Website Visitors
When you visit our website we collect technical data needed for the site to work — session tokens and basic browser information — through strictly necessary cookies. Analytics, session-recording, and remarketing cookies are activated only after you accept the consent banner. See section 3.8 and section 7 for detail.
3.2 Registered Users (Homeowners)
When you create a free account, we collect your full name, email address, and password (stored securely hashed). You may also save favorite professionals and submit leads. This data is necessary to provide our service.
3.3 Lead Submissions (Contact Requests)
When you contact a professional through our platform, we collect: your name, phone number, email address (optional), interest type (buy/sell/valuation), and any additional details you choose to provide (timeframe, property details, notes). This data is shared with the professional you are contacting.
3.4 Review Submissions
When you submit a review, we collect: your name, email address, rating, review text, and optionally a property address for transaction verification. Your name and review text are displayed publicly. Your email is not published.
3.5 Real Estate Agents
Agents provide professional profile data including: phone number, bio, address, years of experience, service zones, languages, contract types, AMI license number and proof document, social media links, and an avatar photo. Agents may also link their Google Business profile to sync reviews. This data is displayed publicly on the agent's profile page.
3.6 Real Estate Agencies
Agencies provide business data including: business name, email, phone, address, website, logo, contract types, and social media links. Agencies may also link their Google Business profile. This data is displayed publicly on the agency's profile page.
3.7 Payment Data
Payment processing is handled entirely by Stripe, Inc. We do not store credit card numbers or full payment details. We store only your Stripe customer identifier, subscription status, and transaction history for billing and accounting purposes.
3.8 Analytics, Heatmaps and Session Recording
After your explicit consent (cookie banner), we partner with Microsoft Clarity, Google Analytics 4, and Meta Pixel to capture how you use and interact with the site through behavioral metrics, heatmaps, and session replay. Website usage data is captured using first and third-party cookies and helps us understand which pages work, identify errors, and improve the service. Session recordings exclude sensitive fields (passwords, payment data) by default. We also use this information for site optimization, security, and advertising. You can withdraw consent at any time by clearing the `cookie-consent` cookie in your browser. For details on how Microsoft processes this data, see the Microsoft Privacy Statement at www.microsoft.com/privacy/privacystatement; for Google, policies.google.com/privacy; for Meta, www.facebook.com/privacy/policy.
3.9 Profiles Compiled from Public Sources
Some professional and agency profiles displayed on the Platform are compiled by The Agent Trust from publicly accessible sources — namely the IMPIC public registry of AMI licences, Google business profiles, social media, and professional websites — before the data subject claims the profile. The categories of data processed include name, professional designation, areas of operation, AMI licence number, and public reviews. The legal basis is legitimate interest (Article 6(1)(f) GDPR) in providing a real estate transparency directory, balanced against the data subject's rights, given that the data is professional in nature and already public. In accordance with Article 14 GDPR, the professional has the right to object to this processing (Article 21), to access, rectify, or request erasure of their data, and to claim or remove their profile, by contacting us through the means indicated in the Contact section of this Privacy Policy.
4. Legal Bases for Processing
We process your personal data under the following legal bases as defined in Article 6 of the GDPR:
- Consent (Art. 6(1)(a)): For lead submissions, review submissions, and optional data such as social media links. You can withdraw consent at any time.
- Performance of a Contract (Art. 6(1)(b)): For account creation, service delivery, profile management, and payment processing.
- Legitimate Interest (Art. 6(1)(f)): For platform security, fraud prevention, professional profile indexing from publicly available sources, and Google review synchronization.
- Legal Obligation (Art. 6(1)(c)): For AMI license verification under Portuguese real estate law (Lei n.º 15/2013), tax records, and financial reporting.
5. Data Sharing with Third Parties
We share personal data with the following trusted service providers (data processors), each bound by data processing agreements. Services marked "after consent" only receive data once you accept the cookie banner:
- Supabase Inc. — Cloud infrastructure, authentication, and database hosting (EU — Frankfurt, Germany).
- Google LLC — Google Places API and Google Maps for professional indexing and review synchronization (always active). Google Analytics 4 and Google Ads for measurement and remarketing (United States, after consent).
- Microsoft Corporation — Microsoft Clarity — session recording and heatmaps to understand usage patterns and improve the site (United States, after consent).
- Meta Platforms Ireland Ltd. — Meta Platforms Ireland Ltd — Meta Pixel for conversion measurement and remarketing on Facebook/Instagram (Ireland / United States, after consent).
- Resend Inc. — Transactional email delivery — lead notifications and welcome emails (United States).
- Stripe Inc. — Payment processing for subscriptions and credit packs (United States, with EU processing capabilities).
6. International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA), specifically in the United States. These transfers are protected by EU Standard Contractual Clauses (SCCs) as per Commission Implementing Decision (EU) 2021/914, ensuring an adequate level of data protection.
8. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Account data: Retained until you delete your account, plus a 30-day grace period.
- Lead submissions: Retained for 2 years from creation, unless deleted earlier by the agent.
- Reviews: Retained indefinitely as public content, or until you request removal.
- Payment and transaction records: Retained for 10 years as required by Portuguese tax law.
9. Your Rights
Under the GDPR and Portuguese Data Protection Law (Lei n.º 58/2019), you have the following rights regarding your personal data:
- Right of access — obtain a copy of your personal data (Art. 15)
- Right to rectification — correct inaccurate data (Art. 16)
- Right to erasure ('right to be forgotten') — request deletion of your data (Art. 17)
- Right to data portability — receive your data in a structured format (Art. 20)
- Right to restriction of processing (Art. 18)
- Right to object to processing based on legitimate interest (Art. 21)
- Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal
To exercise any of these rights, contact us at support@theagenttrust.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD — Comissão Nacional de Proteção de Dados) at www.cnpd.pt.
10. Children's Data
The Agent Trust is not directed at persons under 16 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately.
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), secure password hashing, row-level security in our database, and access controls. Despite our best efforts, no system can guarantee absolute security.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the platform. The "Last Updated" date at the top indicates when the policy was last revised.
13. Contact Us
For any questions about this Privacy Policy or the processing of your personal data, contact us at support@theagenttrust.com.