Casa Conect Global SL (“Casa Conect”, “we”, “us”) provides a secure online workspace where people involved in a property transaction or legal matter can work together. Authorized users can create and organize matters, upload, review and share documents, manage who has access and who approves what, and use AI tools to organize and work with legal and transaction information. Legal professionals can also use shared workspaces to coordinate their matters, documents and clients.
This Privacy Policy explains how we process personal data when you visit our website, contact us, create an account, or use our services.
1. Controller and contact
Casa Conect Global SL (Casa Conect) is the controller of personal data we handle to provide accounts and operate our website, billing, marketing and to maintain direct customer relationships.
We control data such as contact, account, membership, role, billing, support, usage, device, log, security-event, and marketing-preference data.
Contact details:
- Registered address: Cl. Joan De Cremona 4, EN Pta. DER, 07012 Palma, Spain
- CIF: B22876221
- Privacy contact: hello@casaconect.ai
- Security contact: security@casaconect.ai
We have not appointed a Data Protection Officer because we are not required to do so under Article 37 GDPR or Article 34 of Spanish Organic Law 3/2018 (LOPDGDD). Privacy requests are handled by the founders at hello@casaconect.ai.
2. Data we process
As controller. We process the following personal data:
- Website visitors: IP address, browser and device information, pages visited, and, where you consent, analytics cookies (see the Cookie Policy).
- Contact and demo requests: name, email address, firm, and the message you send through our website form.
- Account holders and authorised users: name, email address, organisation, role, membership, authentication and security data (including sign-in codes, MFA, and single sign-on), and settings.
- Product usage and support: in-product usage events (where you consent to analytics), error reports with Customer Content removed, and support conversations.
- Billing: billing contact, company details, tax identifiers, and payment status. Card details are handled by Stripe and are not stored by Casa Conect.
- Marketing: marketing preferences and, where applicable, records of consent.
As processor. For customer content submitted to the service, the customer normally acts as controller and Casa Conect as processor under the Data Processing Addendum (DPA). The DPA describes this processing in more detail.
We process for instance the following customer content: transaction-matter data, documents and their contents, emails and messages handled by the AI agent, participant and access data, approvals, document-review activity, and audit/activity records (Customer Content).
Customer Content may include Personal Data. Where it does, the Customer normally acts as controller and Casa Conect processes it as processor under the Data Processing Addendum (DPA).
3. Purposes and legal bases
When Casa Conect acts as controller, we process personal data for the following purposes and legal bases:
- to provide and administer accounts and the service: performance of a contract and, where relevant, steps taken at a user's request before entering into a contract;
- to answer contact and demo requests: steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries;
- to secure the service, prevent misuse, monitor errors, and maintain service reliability: our legitimate interests in operating a secure and reliable service;
- to provide customer support: performance of a contract;
- to meet tax, accounting, and other legal obligations: compliance with a legal obligation; and
- to send marketing communications, use non-essential cookies, and collect product analytics: consent. Where we send information about similar services to existing customers, we rely on Article 21.2 of Spanish Law 34/2002 (LSSI) and you may opt out at any time.
Where we rely on legitimate interests, we balance those interests against the rights and freedoms of affected individuals.
4. AI and Customer Content
We use commercial AI services to provide certain features. Customer Content — including documents, prompts, inputs, and outputs — is not used to train, fine-tune, or improve Casa Conect’s or any provider’s AI models.
We process Customer Content only to provide the requested service, maintain security, and provide support. Customer Content is made available only to authorised users and participants within the relevant company account, as configured or invited by the customer or its authorised users. Those participants may include transaction counterparties and professional advisers in case they are authorised members of the relevant workspace. Casa Conect does not make Customer Content available to unrelated customers.
Amazon Web Services (AWS) provides cloud hosting and infrastructure services. Requests for AI-assisted features are routed through OpenRouter, an AI model gateway, to AI model providers such as Amazon Bedrock, Google Vertex AI, Microsoft Azure, and Mistral AI. Every request is sent with zero data retention and no-training controls, so model providers do not store prompts or outputs and do not use them for training. Uploaded documents are read by Reducto in the EU with zero data retention and indexed for search by turbopuffer in AWS Europe (Frankfurt), eu-central-1. The complete, shared list of approved subprocessors is in Appendix A.
By default, AI processing takes place in the EU/EEA. A Customer’s administrator may choose to allow global inference, which makes additional models available that are processed outside the EEA, including in the United States; these models also run with zero data retention and no training.
To monitor the quality and safety of AI-assisted features, Casa Conect records traces of AI prompts and outputs with Braintrust, in the United States, for 30 days. Access to traces is restricted to authorised Casa Conect personnel, and the transfer is protected by Standard Contractual Clauses.
AI-assisted features do not make decisions that produce legal or similarly significant effects on individuals. When the Casa Conect agent writes to people by email or messaging, its messages identify that they were prepared with AI.
5. Locations, recipients, and transfers
Customer Content is hosted in the AWS Region: Europe (Frankfurt) (eu-central-1), Germany. Our current subprocessors, their purposes, relevant data categories, processing locations, and applicable data-processing and transfer terms are listed in Appendix A and published at casaconect.ai/subprocessors.
For data we process as controller, we also use: Vercel (website hosting, EU region Frankfurt); Microsoft (Microsoft 365, for email including the hello@casaconect.ai mailbox that receives website requests); Google (Google Tag Manager and analytics on our website, only with your consent); WorkOS (authentication); Stripe (payments); Intercom (support, EU hosting); Sentry (error monitoring); and PostHog (product analytics, only with consent). We may disclose personal data to professional advisers, auditors, and authorities where required by law.
Some of these providers are located in, or may access data from, the United States. Where personal data is transferred outside the EEA, Casa Conect uses an appropriate lawful transfer mechanism, which may include an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or Standard Contractual Clauses, as applicable.
6. Security and access
Access to Customer Content is restricted to authorised personnel and approved service providers who have a legitimate operational need. We maintain technical and organisational safeguards designed to protect Customer Content, including any Personal Data it contains, against unauthorised access, loss, alteration, and disclosure. These safeguards include encryption of data in transit and at rest, with separate encryption keys for the database, files, and backups; least-privilege IAM roles; multi-factor authentication (MFA) and single sign-on (SSO) controls for administrative access; AWS audit logging and threat detection; encrypted backups and Amazon Aurora point-in-time recovery; and automated dependency scanning through GitHub Dependabot.
We maintain documented incident-response procedures for identifying, assessing, containing, investigating, and remediating security incidents, as well as administrative access controls, including single sign-on (SSO) where appropriate. Where a confirmed security incident involves Customer Personal Data, we will notify the Customer without undue delay after becoming aware of it and provide available information reasonably needed by the Customer, as required by applicable law.
We regularly review these controls as our systems and security practices evolve.
7. Retention
We retain personal data that we process as controller only as long as needed for the stated purposes or as required by law:
| Data | Retention |
|---|---|
| Account and membership data | For the life of the account, then deleted when the workspace is closed |
| Contact and demo requests | 24 months after the last contact, unless a customer relationship starts |
| Billing and invoicing records | 6 years, as required by the Spanish Commercial Code (Article 30) and tax law |
| Support conversations | 24 months after the conversation closes |
| Security and application logs | 90 days |
| Product analytics | 12 months |
| Cookie-consent records | For the duration of the consent and up to 24 months |
| Marketing preferences | Until you withdraw consent or opt out |
When a Customer closes its workspace, Customer Content is deleted from active systems straight away. Before closing a workspace, the Customer may request an export of Customer Content under the Terms and DPA. Where a subscription ends without the workspace being closed, Customer Content is kept for 90 days so that it can be exported and is then deleted from active systems unless retention is required by applicable law or agreed otherwise in writing.
Backup copies are deleted or overwritten within 12 months and are not restored except where necessary for disaster recovery or business continuity. Security and troubleshooting logs are retained only for the applicable documented retention period and then deleted or anonymised. Details are set out in the DPA.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to Casa Conect’s processing of personal data as controller. You may withdraw consent at any time where consent is the legal basis, including through the cookie settings on our website and in the service. Contact hello@casaconect.ai. We will respond within one month. You may also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or your local data-protection authority.
For requests concerning Personal Data in Customer Content, contact the relevant Customer as controller. Casa Conect will provide reasonable assistance to Customers with such requests as described in the DPA.
9. Changes
We may update this policy and will publish the revised version with a new effective date. Where a change is material, we will notify account holders in advance by email or in the service.
Appendix A — Approved subprocessors
The following approved subprocessors support the service. OpenRouter, the AI model providers reached through it, Reducto, and turbopuffer are AI providers. This appendix will be updated as providers or their processing arrangements change. The current list is published at casaconect.ai/subprocessors.
- Amazon Web Services EMEA SARL
- Purpose
- Cloud hosting, database, file storage, backups, logging, email, and infrastructure
- AI provider
- No
- Processing location
- Germany — AWS Europe (Frankfurt), eu-central-1
- Data-processing terms
- AWS Data Processing Addendum
- OpenRouter, Inc.
- Purpose
- AI model gateway that routes requests for AI-assisted features to AI model providers under zero data retention and no-training controls
- AI provider
- Yes
- Processing location
- EU/EEA for organisations using EU inference (the default); United States and other regions only where the Customer enables global inference
- Data-processing terms
- OpenRouter Data Processing Agreement; Standard Contractual Clauses
- AI model providers reached through OpenRouter, including Amazon Bedrock, Google Vertex AI, Microsoft Azure, Mistral AI, Anthropic, and OpenAI
- Purpose
- Generation of requested AI-assisted outputs, dictation, and embeddings, with zero data retention and no training
- AI provider
- Yes
- Processing location
- EU/EEA endpoints under EU inference; endpoints outside the EEA only where the Customer enables global inference
- Data-processing terms
- Provider terms through OpenRouter, with zero data retention
- Reducto
- Purpose
- Document reading (extraction of text, tables, and layout from uploaded files)
- AI provider
- Yes
- Processing location
- EU — Reducto EU data residency, with zero data retention
- Data-processing terms
- Reducto Data Processing Addendum
- turbopuffer
- Purpose
- Document search index; embeddings are generated with Cohere Embed v4 inside turbopuffer’s EU deployment
- AI provider
- Yes
- Processing location
- Germany — AWS Europe (Frankfurt), eu-central-1, over a private network connection
- Data-processing terms
- turbopuffer Data Processing Addendum
- Temporal Technologies
- Purpose
- Scheduling of background jobs and AI agent runs; receives only encrypted payloads and opaque identifiers
- AI provider
- No
- Processing location
- Germany — AWS Europe (Frankfurt), eu-central-1, over a private network connection
- Data-processing terms
- Temporal Data Processing Addendum
- Braintrust
- Purpose
- Tracing of AI prompts and outputs for quality, safety, and troubleshooting; traces are retained for 30 days
- AI provider
- No
- Processing location
- United States
- Data-processing terms
- Braintrust Data Processing Addendum; Standard Contractual Clauses
- WorkOS, Inc.
- Purpose
- Authentication, single sign-on, multi-factor authentication, organisation management, and authorisation of connected accounts
- AI provider
- No
- Processing location
- United States
- Data-processing terms
- WorkOS Data Processing Addendum; Standard Contractual Clauses
- Stripe Payments Europe, Ltd.
- Purpose
- Payments and billing
- AI provider
- No
- Processing location
- Ireland (EEA); Stripe group processing outside the EEA under Stripe’s transfer mechanisms
- Data-processing terms
- Stripe Data Processing Agreement
- Intercom
- Purpose
- Customer support messaging
- AI provider
- No
- Processing location
- EU — Intercom EU data hosting
- Data-processing terms
- Intercom Data Processing Agreement
- Functional Software, Inc. (Sentry)
- Purpose
- Error monitoring, configured to exclude Customer Content
- AI provider
- No
- Processing location
- Germany — Sentry EU region
- Data-processing terms
- Sentry Data Processing Addendum; Standard Contractual Clauses
- PostHog
- Purpose
- Product analytics, used only with consent and configured to exclude Customer Content
- AI provider
- No
- Processing location
- EU — PostHog EU Cloud
- Data-processing terms
- PostHog Data Processing Agreement
- DocuSign
- Purpose
- Electronic signature of documents that an authorised user approves for signing
- AI provider
- No
- Processing location
- EU — DocuSign EU data centre
- Data-processing terms
- DocuSign Data Processing Addendum
- Meta Platforms Ireland Ltd (WhatsApp Business)
- Purpose
- Delivery of messages between authorised users and the Casa Conect agent on WhatsApp, where the Customer enables it
- AI provider
- No
- Processing location
- Ireland (EEA); Meta group processing outside the EEA under Meta’s transfer mechanisms
- Data-processing terms
- WhatsApp Business data processing terms
Customer Content is not used to train or fine-tune AI models. The applicable data-processing terms and transfer mechanisms for each subprocessor are available on request and, where relevant, through our Data Processing Addendum.