Privacy Policy

1. Data controller

Controller

[OPERATOR NAME], a sole trader (autónomo) trading as Yald

NIF (Spanish tax ID)

[NIF]

Address for notifications

[NOTIFICATION ADDRESS]

Website

https://yald.es

Privacy email

privacy@yald.es

Data Protection Officer (DPO)

Not appointed. None of the conditions in Article 37 GDPR or Article 34 LOPDGDD apply.

2. Scope and applicable law

We process your data in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 of 5 December on the protection of personal data and the guarantee of digital rights (LOPDGDD) and the LSSI-CE as regards electronic communications. This policy explains what data we process, for what purpose and on what legal basis, for how long, with whom we share it, and what rights you have.

3. Scope of the service

To provide the service we create user accounts, store the analyses you choose to keep, and process payments for the subscription and one-off features through a payment provider. We do not access bank information through aggregation (open banking). We apply the minimisation principle: we collect the least necessary to provide the service.

4. Categories of data we process

Category

Data

Source

Retention

Waiting list

Your email address and, optionally, the language and country you indicate.

You

Until you unsubscribe, or up to 24 months from the last contact.

Data entered into the estimation tool

Property details (price, area, autonomous community, calculation assumptions) and the rent and expense figures you enter.

You

Not retained. Processed transiently to generate the estimate and discarded at the end of the session. Not linked to you or to your email address.

Usage data

Aggregated Site usage metrics (pages viewed, language, approximate country) collected through cookieless analytics with no persistent identifiers.

Automatic

Aggregated statistics, containing no identifying data.

Communications

The content of enquiries you send us and your email address.

You

Up to 24 months from resolution of the enquiry.

We do not process special categories of data (Article 9 GDPR) and we do not carry out profiling.

Account

Your email, authentication identifier, language and the tax-profile preferences (status, country) you provide.

You

While the account is active; deleted when you delete the account.

Subscription and payment

Your plan, status and Stripe customer identifier. Full card details are handled by Stripe; we do not store them.

You / Stripe

For the relationship and the legally required tax and accounting periods.

Saved analyses

The property details and assumptions of the analyses you choose to save to your account.

You

Until you delete them or delete your account.

AI copilot questions

The text of your question and the related analysis, sent to our AI provider to generate the answer.

You

Not retained for training; processed transiently to answer.

5. Purposes and legal bases

Purpose

Legal basis (Art. 6 GDPR)

Sending you information about the launch and product news, if you joined the waiting list.

Consent (Art. 6(1)(a))

Generating the estimates you request in the tool.

Steps taken at your request prior to entering into a contract (Art. 6(1)(b)) - processing is transient and not retained.

Handling your enquiries and the exercise of your rights.

Legitimate interest and, where applicable, legal obligation (Art. 6(1)(f) and (c))

Measuring Site usage in aggregate to maintain and improve it. This includes daily counts of product milestones (sign-up, first saved analysis, upgrade) recorded without a user identifier: we know how many people reached each step, never who.

Legitimate interest (Art. 6(1)(f)), after balancing

Site security and abuse prevention.

Legitimate interest (Art. 6(1)(f))

Computing local price and rent averages from the figures in the analyses you save, where you have expressly opted in.

Consent (Art. 6(1)(a)), withdrawable at any time

Where the basis is legitimate interest, we have assessed that it does not override your rights and freedoms; you may ask us for information about that balancing test. Where the basis is consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

Providing the account, subscription and payment features you sign up for.

Performance of a contract (Art. 6(1)(b)) and legal tax and accounting obligations (Art. 6(1)(c)).

6. Local market averages (optional)

Yald estimates prices and rents from a researched reference table. If you opt in, the figures in the analyses you save may additionally feed area averages that improve that estimate for every user.

What is used: the price, the size, the municipality or district and, where present, the rent and expenses. What is never used: your name, your email address, or the property's postal address.

How it is protected: figures are grouped by area and by size band, never by property. A cell is only published once at least 5 distinct properties feed it; below that threshold it is suppressed and never comes into existence. The output is public averages; your data is not.

Legal basis: your consent (Art. 6(1)(a) GDPR). It is entirely optional: refusing limits no feature of the service, changes no price and affects your account in no way.

How to withdraw: untick the option in your account, or write to privacy@yald.es. Your figures leave the calculation at the next rebuild. Withdrawal does not affect the lawfulness of processing carried out while the consent was in force.

This feature is covered by an internal data protection impact assessment (DPIA). If the purpose changes materially, you will be asked afresh rather than having an existing consent stretched to cover it.

7. Recipients: processors and third parties

We do not sell your data or share it for commercial purposes. To provide the service we use providers acting as processors on our behalf and under a contract compliant with Art. 28 GDPR. The list is set out in Annex A. We may also disclose data to public authorities where there is a legal obligation to do so.

8. International transfers

The main infrastructure is hosted in the European Union. Where a provider processes data outside the European Economic Area, we require appropriate safeguards under Chapter V GDPR, in particular the Standard Contractual Clauses approved by the European Commission or an adequacy decision. You may request information about those safeguards.

9. Automated decisions

The Site's calculations are automated using the data and assumptions you provide, but they produce informational estimates and not a decision producing legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR. You retain control over the decisions you make.

10. Your rights

You may exercise the following rights: access, rectification, erasure («right to be forgotten»), objection, restriction of processing and portability, as well as the right not to be subject to automated individual decision-making. You may also withdraw your consent at any time.

You have the right to lodge a complaint with the competent supervisory authority. The reference authority is the Spanish Data Protection Agency (AEPD) - C/ Jorge Juan, 6, 28001 Madrid - www.aepd.es; you may also contact the authority in your country of residence.

11. How to exercise your rights

You may exercise your rights by writing to privacy@yald.es, providing proof of identity. Every waiting-list email also carries a one-click unsubscribe link. We will handle your request within the legal time limits (generally one month, extendable in cases of particular complexity).

12. Information security

We apply appropriate technical and organisational measures, including encryption in transit (HTTPS), EU hosting, access control and minimisation of the data collected. Because the data you enter into the tool is not retained, the risk associated with processing it is low by design. No system is infallible, but we work continuously to protect your information.

13. Minors

The Site is intended for adults. We do not knowingly collect data from minors; if you become aware that a minor has provided us with data, please contact us for its deletion.

14. Changes to this policy

We may update this Privacy Policy, and we will need to expand it when user accounts, payments, document storage or bank connectivity are enabled. The version in force is the one published on the Site; if the changes are substantial, we will notify you by appropriate means.

Version 0.9 - last updated: 2026-07-18.

Annex A - Processors

Provider

Function

Location / safeguards

Vercel

Hosting and delivery of the web application.

EU (European region) / SCCs where applicable

Supabase

Authentication, database and storage for accounts and saved analyses.

EU / SCCs where applicable

Self-managed server operated by the Operator

Running the calculation engine.

EU

Stripe

Payment and subscription processing. Handles card data; we do not store it.

EU / US under SCCs

Anthropic

AI copilot engine (only if you use that feature).

US under SCCs

Resend

Sending transactional and waiting-list emails.

EU / SCCs where applicable

Vercel Web Analytics

Aggregated usage analytics, cookieless and without persistent identifiers.

EU (European region) / SCCs where applicable - cookieless

OpenStreetMap

Area location-map tiles (loaded only when a report is viewed; no cookies).

EU/EEA + global CDN