Privacy Policy

Last updated: October 5, 2026

Cubi.estate (the “Service”) is operated by Dmytro Taranenko, sole trader (Empresário em Nome Individual), registered in Portugal under taxpayer number (NIF) PT316377210, at Rua João Infante 130, 2750-384 Cascais, Portugal (“we”, “us”, or “our”). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our Service and the choices you have regarding that data. We are committed to protecting your personal data and your right to privacy. If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@cubi.estate.

This Privacy Policy applies to all personal data collected through our Service, including any related services, sales, marketing, or events. Under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Portuguese data protection law (Lei n.º 58/2019), we act as the data controller of your personal data. By using the Service, you acknowledge the processing of your personal data as described here.

Personal data we collect

We collect personal data that you voluntarily provide to us — for example when you register, search for properties, submit an inquiry, request to be connected with a real estate professional, or otherwise contact us. Depending on the context, this may include your name, email address, phone number, messaging handle (e.g. a Telegram or WhatsApp identifier where you contact us via those channels), location preferences, property search criteria, saved or compared listings, and the content of your messages and inquiries.

We also automatically collect certain technical information when you visit or use the Service, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, approximate location derived from your IP address, and log and usage data (date/time stamps, pages and listings viewed, searches performed, and other actions you take). Some of this information is collected through cookies and similar technologies — see our Cookie Policy.

Contact requests.If you ask Cubi to contact the agent for a listing: your request and any questions; the contact details you give us (name and email, plus your phone number if you ask for a callback); for a callback or video meeting, the times you propose and your time zone; the agent’s reply; and the agreed appointment.

Links to property listings in our search results — including results delivered through AI assistants (such as ChatGPT, Claude, or Perplexity) — may use first-party redirects on our own domain (e.g. cubi.estate/r/…) so that we can measure referral traffic to the advertising agency’s website, including for reporting purposes. When you follow such a link we record the listing, the timestamp, the referring service, and your browser’s user-agent string; we do not record your IP address or set any cookie in the process, and you are then taken directly to the original listing page.

How we use your data, and our legal bases

We process your personal data only where we have a lawful basis under Article 6 GDPR. Specifically:

• To provide the Service — facilitating property searches, maintaining your session, and, at your request, connecting you with licensed local real estate professionals. Legal basis: performance of a contract or taking steps at your request prior to entering into a contract (Art. 6(1)(b)).
• To operate, secure, and improve the Service — analytics, debugging, fraud and abuse prevention, and quality improvement. Legal basis: our legitimate interests in running and improving a safe and reliable service (Art. 6(1)(f)).
• To contact the agent at your request — we send your questions or request to the listing’s agent. We show your phone number to the agent only after they accept one of your proposed callback times. When the agent replies through Cubi, a member of our team reviews the reply before we pass it to you. When an agent accepts a time, we send you the agreed time and a calendar file. Legal basis: steps taken at your request (Art. 6(1)(b)).
• To search for you when you ask us to — when a search finds nothing and you use “Let Cubi look for you”, we use the email address, region and original search you give us, any budget, purpose, timeline and must-haves you add, and the identifier of your Cubi session to prepare one shortlist of property options and email it to you. We use that email address only to send that shortlist: no marketing and no follow-ups. The shortlist is prepared by our team and sent through the email and hosting providers described under “How we share your data”; our internal notification of a new request carries only its number, country, budget and due date, never your email address or notes. Legal basis: providing a service you requested (Art. 6(1)(b)).
• To learn from questions asked about a specific home — when you use “Ask Cubi about this home”, we keep a separate copy of your questions for a limited time to understand what buyers need to know about a property and to improve the answers Cubi gives. This is separate from providing the chat itself, and these copies are not used to personalise your results; using the chat’s actions, such as summarising a home or finding similar homes, works as it does elsewhere on Cubi and may inform your recommendations. Legal basis: our legitimate interest in improving the accuracy and usefulness of Cubi’s answers about individual homes (Art. 6(1)(f)). You can object to it at any time (Art. 21).
• To send marketing or promotional communications and to set non-essential cookies. Legal basis: your consent (Art. 6(1)(a)), which you may withdraw at any time.
• To comply with legal obligations — including responding to lawful requests, and tax and accounting requirements. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).

Use of artificial intelligence

The Service is an AI-assisted product. When you interact with our chat or search assistant, you are interacting with an automated artificial-intelligence system, not a human. We use AI — including large-language-model services provided by third parties, some of which are located outside the European Economic Area — to interpret your queries, search and rank listings, personalize results, and generate summaries and translations.

Property summaries, descriptions, and translations shown to you may be generated or adapted by AI and may be inaccurate, incomplete, or out of date. AI output is provided for general informational purposes only and is not professional real estate, legal, financial, tax, or investment advice; you should independently verify any information before acting on it. See our Disclaimer.

Messages Cubi sends to agents on your behalf are written with the help of AI, and say so. An agent’s reply is passed to you as the agent wrote it, labelled as the agent’s own words; Cubi does not verify it.

Where your inputs are processed by third-party AI providers, those providers act as our processors under contract. We do not permit our AI providers to use your inputs to train their models. This disclosure is provided in line with the transparency obligations of the EU AI Act (Regulation (EU) 2024/1689).

Automated decision-making and profiling

To make the Service more useful, we use profiling — we analyze your searches, saved and compared listings, and interaction signals to rank and personalize the property results we show you. This processing helps order and filter listings; it does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. You can object to profiling carried out on the basis of our legitimate interests (Art. 21 GDPR) by contacting us, and you can limit personalization by using the Service without saving or signalling preferences.

How we share your data

We share personal data only with your consent, to comply with law, to provide the Service, to protect our or others’ rights, or to fulfil business obligations. We may share data with categories of recipients including: hosting and infrastructure providers; AI and machine-learning service providers; email and messaging delivery providers; analytics providers; and, where you ask to be connected, licensed local real estate professionals. These recipients act as our processors and are bound by contract, except for the real estate professionals, who act as independent controllers once you are connected to them at your explicit request. We do not sell your personal data.

The agent or agency for the listing you asked about receives your questions or request. They receive your phone number only after accepting a callback time you proposed. We do not give them your email address unless you ask us to connect you.

International data transfers

Some of our processors (for example certain AI and hosting providers) are located outside the European Economic Area, including in the United States. Where personal data is transferred to a third country, we rely on an appropriate safeguard under Chapter V GDPR — an adequacy decision of the European Commission, or Standard Contractual Clauses approved by the European Commission, together with supplementary measures where required. You may request more information about these safeguards by contacting us.

Data retention

We keep your personal data only for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (for example for tax or accounting purposes). When we no longer have a legitimate need to process your personal data, we will delete or anonymize it, or, where that is not possible, securely store and isolate it from further processing until deletion is possible.

Where we can state a specific period, these are the ones we apply, and we have enforced them with an automated job, rather than on request, since 22 September 2026:

• Your account — for as long as the account exists. Delete it and the account data goes with it.
• Request and security logs — 30 days for web request records and 14 days for connector request records (the IP address and any free-text search are removed after 7 days; these connector periods apply since 4 October 2026). These records are kept to diagnose faults and prevent abuse. Encrypted database backups may keep copies for up to about two weeks longer; they are used only to recover from failures.
• Searches you run — 180 days, after which the record is anonymized: we keep the search text and what it returned so we can measure and improve results, and we erase the identifier that links it to you.
• How you use the Service — 365 days for the record of properties you saved, opened or compared, which we use to personalize what you see.
• Feedback you send us — 2 years.
• Contact requests — 24 months. Agents’ replies passed to you: 90 days in our relay records (they also stay in your chat history until you delete the chat). Proposed and agreed appointment times: 90 days after the appointment.
• Requests for Cubi to search for you — deleted 12 months after you send them. You can withdraw a request at any time by emailing privacy@cubi.estate; we then erase your email address and anything you wrote straight away. A record that we offered you this service, holding only identifiers and the country (no email address or text), is deleted after 90 days. These periods apply from the day the feature launches.
• Questions about a specific home — when you use “Ask Cubi about this home”, the questions you ask are also kept for 30 days to help us improve Cubi, then deleted. Your chat itself stays in your chat history until you delete it. The record of steps you take there, such as opening the contact form, is deleted after 90 days. Both periods have been enforced by the same automated job since 26 September 2026, when this feature launched.

Some records are deliberately kept for longer because deleting them would remove a protection you have. If you ask us to stop contacting you, or to hide a professional’s contact details, that instruction is kept indefinitely: erasing it would undo it. Where we connect you with a real estate professional at your request, we keep the record of that request for 24 months, as evidence of what was shared and on what basis.

Security

We implement appropriate technical and organizational measures designed to protect the personal data we process. However, no electronic transmission or storage technology is completely secure, so while we strive to protect your personal data we cannot guarantee its absolute security.

Your rights

If you are in the European Economic Area, you have the following rights under the GDPR: the right to access your personal data and obtain a copy; the right to rectification of inaccurate data; the right to erasure (“right to be forgotten”); the right to restrict processing; the right to data portability; the right to object to processing based on our legitimate interests, including profiling; and, where processing is based on consent, the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, contact us at privacy@cubi.estate. We will respond in accordance with applicable data protection law.

If you believe we are unlawfully processing your personal data, you also have the right to lodge a complaint with your local supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD). Contact details for other EEA authorities are available at edpb.europa.eu.

Personal data of third parties (real estate professionals)

The Service indexes property listings from third-party sources, which may contain the contact details of real estate agents or agencies. Where we process such data, we act as a controller. On our own website and chat product we display the agent’s name, their agency, and a link to their public professional profile on the source portal; these are shown without separate consent, because they were published alongside the listing for the purpose of being contacted about it. We do not show an agent’s email address, and a WhatsApp link — which incorporates their business telephone number — is offered only where the professional has given us consent. Our public AI connector (mcp.cubi.estate) returns no agent or agency identity at all: neither name, agency, registration number nor profile link. A dedicated notice for professionals, provided under Article 14 GDPR, is available at cubi.estate/privacy-for-agents. If you are a real estate professional and wish to access, correct, or have your personal data removed, please contact us at privacy@cubi.estate.

Children

The Service is not directed to children under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last updated” date and becomes effective as soon as it is accessible. If we make material changes, we may notify you by posting a prominent notice or by direct notification. We encourage you to review this Privacy Policy periodically.