Privacy policy

1. Controller and contact

The controller for the HeyFinca processing activities described in this policy is Multiservihogar Soluciones S.L., Spanish tax identification number B06850978, with registered address at Calle Las Golondrinas, 11379, Los Barrios, Cádiz. For privacy enquiries and to exercise your rights: info@homira.app.

2. What this policy covers

This policy covers the HeyFinca website, its assistant, access applications and CRM use, including service report and resident invitation forms. The application form does not create a CRM account or enable repair, quotation or invoicing services.

For registration applications we collect the practice or company name, tax ID, contact person, email, telephone, service areas and, for professionals, specialities. We also retain the submission date, reference, language and acceptance of the application conditions and acknowledgement of this policy. We use these details to review and respond to the requested application and prepare access where appropriate.

The application and its PDF are stored in a Cloudflare database configured in the European Union. A copy is sent through Resend to the management inbox info@homira.app, hosted in Google Workspace. These providers process data to supply hosting and email services; international processing may be subject to their applicable contractual safeguards. Applications are not published or sent to other applicants, communities or professionals.

Applications are processed to take steps at your request before access is arranged, where applicable. Data is retained while the application is being reviewed and for any applicable legal retention periods; you may request its deletion by contacting info@homira.app, subject to applicable obligations. No marketing subscription is created. The security system temporarily stores a daily pseudonymous identifier derived from the connection IP to limit abusive submissions.

3. Data, purposes and legal bases

If you write to the contact email address, your email address, any identifying details you include and the content needed to reply will be processed. The basis will be taking steps requested before entering into a contract, where applicable, or the legitimate interest in responding to enquiries and communications. Requests to exercise rights will be processed to comply with the relevant legal obligations.

Browsing involves the exchange of technical information needed to serve the pages, such as IP address, browser data and server requests. Its purpose is to deliver and protect the website. Do not send sensitive information or third-party data that is unnecessary for your enquiry.

4. Providers and external resources

The public website homira.app is hosted by Cloudflare, which processes technical connection information to deliver and protect the service. See the Cloudflare privacy policy.

The design loads fonts from Google Fonts. When requesting them, the browser connects to Google and communicates technical information, including the IP address. You can consult the Google Fonts privacy information. This version does not include Google Analytics.

Data may be shared with providers needed to handle enquiries, host and protect the website, and with authorities where legally required. Data will not be sold or shared with third parties for their own marketing campaigns. CRM providers and the safeguards required are described in section 6.

5. Retention

Enquiries will be retained for as long as necessary to handle them and, where applicable, to comply with legal obligations or address liabilities. They will then be deleted or blocked as required. Technical hosting information also depends on the provider’s configuration and terms; further information may be requested from the controller.

6. CRM and service request privacy

The CRM supports accounts and permissions, communities, residents and presidents, repair and quotation requests, maintenance, photos and videos, optional location, documents, invoices, authorisations and activity records. Access depends on role, community, job assignment and the selected visibility. Email verification does not replace approval of a profile or community membership.

Responsibilities and legal bases

Multiservihogar Soluciones S.L., the operator of HeyFinca, is the controller for the processing it determines to manage accounts and its service relationship, review applications, protect the platform and handle rights and claims. The applicable bases are the service contract or requested pre-contractual steps where appropriate, legal obligations, and legitimate interests in preventing abuse and defending claims, subject to individuals' rights.

For community administration, the community, its property manager and HeyFinca must act according to their actual roles. Where HeyFinca processes data solely on a community's or another controller's instructions, an Article 28 GDPR processing agreement is required. This policy does not replace that agreement or automatically assign controller or processor status to every participant. The property manager must inform residents about community processing and its legal basis. A company using data to prepare or perform its own service must meet its own information and data protection obligations.

Data and access

When searching for companies, the responsible user may invite up to ten approved companies in the relevant trade after checking their declared service areas. Invited or assigned companies may view the trade, province, request type, priority, description, photographs and community name to assess the work before accepting. Requesters must avoid unnecessary personal information in descriptions and photographs. Contact details, the exact address and private documents remain restricted to the selected company after acceptance. Preview access to photographs is withdrawn when a company declines or stops participating. Coverage is estimated between postal codes, not as road distance. Companies may use the data only to assess and handle that request, not for advertising or unrelated sharing without a lawful basis. Historical access to accepted work remains subject to its permissions and applicable retention periods.

Data include submitted identity and contact details, roles and trades, community and property details, the request description, required trade, address and postcode, precise location if supplied, attachments, communications, decisions and acceptance records. They are used to review requests, assign and follow jobs, arrange visits and retain documentation. Mandatory fields are needed to process the relevant form; optional precise location and attachments may be omitted.

The repair contact name and telephone are accessible to the requester, authorised management and the assigned company. They are not published in the directory or shown to other residents. Descriptions and attachments may be accessible to active residents when community visibility is selected. Do not include private contact details in those fields or documents if they should not be shared. Identity and tax details in quotes and invoices are available to authorised case participants.

Reports submitted using a public link are reviewed by the property manager before assignment. Contact details collected in that form remain restricted to management; the description and files may be shared with the assigned company. Resident invitations link an application to a community but require manager approval. The precise job location is hidden from the professional until acceptance. Professional contact details remain private unless the professional replies and authorises sharing within the case; documents they upload may contain their details.

Other people's details and photographs

Anyone providing another person's data must have a lawful basis to share them and give that person this information. The source is the user, manager or requester who provided them; categories include identity, contact and report information. The controller must comply with Article 14 GDPR within its applicable time limits and circumstances. A box checked by someone else does not replace this duty or constitute that person's consent. Supply only necessary information and avoid images of people, private documents or sensitive data unrelated to the work.

Providers and transfers

The CRM uses Cloudflare for hosting, databases and private file storage; Supabase for email authentication; and Resend for access codes and service messages. Website applications are also sent to the management inbox in Google Workspace. Providers access data to deliver their services. European storage settings do not alone rule out international transfers, including support or subprocessors. Transfers require an applicable adequacy decision or valid safeguards such as standard contractual clauses and necessary supplementary measures. Contact info@homira.app for information on applicable safeguards; this policy does not itself establish that provider agreements have been signed.

Retention, security and decisions

Data are retained as necessary to review applications, deliver the service and manage jobs, and subsequently for applicable legal periods or claims, with restricted access. Moving a case to My trash hides it from the personal view: it does not delete other participants' history or constitute a data erasure request. Removing a community from management does not automatically destroy its documents. You may request erasure, subject to applicable legal limits and restrictions.

Terms acceptance records retain authenticated identity, time, version and the accepted document; previous versions are not retrospectively replaced. Access uses email codes and a technical session; Remember me can keep it active for up to seven days unless you sign out or access is withdrawn. Do not share accounts. Suggested trades use words in the report and may be corrected. Automatic assignments follow management's configured authorisation and do not guarantee availability, quote acceptance or performance. Submitting a report is not consent to marketing.

7. Your rights

You may request access, rectification, erasure, objection, restriction and portability, where applicable, by writing to info@homira.app. State your request and the information needed to identify it. Where processing is based on your consent, you may withdraw it without affecting the lawfulness of prior processing.

You may lodge a complaint with the Spanish Data Protection Agency. The current website does not carry out profiling or automated decisions on registration requests.

8. Cookies, external channels and updates

HeyFinca has not added advertising or audience measurement cookies to this version. Hosting or authentication services may use their own technical mechanisms. Pop-up notices do not require cookies to appear.

If forms, analytics, messaging or new features are added, this information will be updated before processing begins and consent will be requested where appropriate.

Reference framework: General Data Protection Regulation and Organic Law 3/2018.

9. AI assistant

The optional assistant answers general questions about HeyFinca. When you send a question, its text is processed by Cloudflare and sent to OpenAI to generate an answer. Do not include personal data, passwords, bank details or private CRM information. The assistant has no access to CRM records and cannot register users, approve work or make payments. It may make mistakes.

We process questions to respond to your request and technical usage information under our legitimate interest in protecting the service and controlling abuse. Our application does not save chat histories. Each question is sent independently, with response storage disabled. OpenAI may retain content in abuse-monitoring logs, normally for up to 30 days, with exceptions described in its API data controls. International processing may occur under the providers’ applicable contractual safeguards.

To limit usage, we store timestamps and a daily pseudonymous identifier derived from the connection IP in a Cloudflare database configured in the EU; this table contains no questions or answers. Previous-month entries are removed when a new request is processed in the following month. Cloudflare may also retain technical invocation logs. You can use email instead of the assistant and exercise your rights using the contact details above.