PRIVACY POLICY

Last updated: 25 October 2026

1. INTRODUCTION

At FORGELAB DIGITAL PRODUCTS, S.L. (referred to below as “Askpancho”, “we” or “the Platform”) we are committed to protecting the privacy and personal data of our users. This Privacy Policy describes how we collect, use, share and protect personal information when you use our artificial intelligence services that support people buying a home.

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (Spain’s Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, LOPDGDD).

2. DATA CONTROLLER

Identity: FORGELAB DIGITAL PRODUCTS, S.L.

NIF (Spanish tax identification number): B75796524

Address: Calle Larga Nº19, 44622 Arens de Lledó, Spain

Email: pancho@askpancho.ai

3. DATA PROTECTION OFFICER (DPO)

Given the volume and nature of the data processed, FORGELAB DIGITAL PRODUCTS, S.L. is not required to appoint a Data Protection Officer under Article 37 of the GDPR. However, for any question about the protection of personal data, you can contact:

Privacy contact: pancho@askpancho.ai

We will deal with your request within one month of receiving it at the latest. In particularly complex cases, or because of the number of requests, this period may be extended by two further months, and we will tell you about the extension within the first month.

4. DATA WE COLLECT

4.1. Identification and Contact Data

Name
Email address
IP address
Device and browser information

Users sign in with their name and email address, without needing a password.

4.2. Data on the Property Being Evaluated

To provide the service, we may collect:

Type of property, location or area, floor area, age, price and the features stated.
Information from the property listing provided by the user.
Photographs of the property and, where applicable, documents the user decides to provide (for example, a nota simple (Land Registry extract) or an energy performance certificate).
Answers to the guided inspection questionnaire and what you write in the chat.
Any other data needed to generate the evaluation or the report.

4.3. Browsing Data

Cookies and similar technologies (see Cookie Policy)
Pages visited and browsing time
Interactions with the platform

4.4. Evaluation Data

History of properties and reports requested
Results of the evaluations
Communications relating to the service

4.5. Payment Data

Payment details (card number, expiry date, CVC) are processed directly by our payment provider Stripe and are never stored on our servers. Stripe may collect additional data such as the IP address, browser information and the card’s country in order to process the payment and prevent fraud.

For each order we keep the service purchased, the amount, the currency, the coupon or the code of the partner who recommended us to you, if any, and the IP address and browser from which the order was placed.

4.6. Browser Notifications

If you tap “Notify me”, we keep your browser’s notification subscription (a technical address of your browser’s notification service, its encryption keys, the language and the type of browser) so we can let you know when a report is ready. You can turn notifications off in your browser settings.

5. PURPOSES OF PROCESSING

5.1. Main Purposes

We use your data to:

Provide the service:

Generate evaluations and reports on properties using AI
Process and analyse the images, documents and data provided
Research and summarise information about the area where the property is located
Show you the results of evaluations and reports in the chat and let you know when they are ready
Manage payments, receipts and invoices

Improve the service (with consent):

Train and optimise our artificial intelligence models
Develop new features
Statistical and performance analysis

Communication:

Respond to questions and requests
Send information about the status of the service
Important notices about changes
Marketing communications and surveys (only with express consent)

Legal compliance:

Comply with legal and tax obligations
Respond to court orders and requests from the courts

5.2. Processing by Third-Party AI

To carry out the evaluations, we share data (mainly images, documents, descriptions of properties and what you write in the chat) with our AI service provider:

Anthropic (Claude)

To research the area, the AI model consults public sources on the internet, and we use the OpenStreetMap mapping service (Nominatim) to locate the address or area of the property, without sending it your personal data.

These providers process the data under their own privacy policies. If we add new AI providers, this policy will be updated to reflect that change.

6. RESPONSIBILITY FOR UPLOADED IMAGES AND DOCUMENTS

The user is solely responsible for the content of the images and documents they upload to the platform. Photographs of properties and the documents provided may contain personal data of third parties, such as people’s faces, number plates of parked vehicles, names on letterboxes or doorbells, data contained in documents (for example, notas simples (Land Registry extracts) or title deeds), addresses or other visible identifying information.

By using our services, the user declares and guarantees that:

They have the right or the necessary authorisation to upload the images and documents provided.
They have taken reasonable steps to avoid including personal data of third parties without their consent.
They accept full responsibility arising from the content of the images and documents uploaded, including any third-party claim for infringement of their privacy or data protection rights.

Askpancho does not manually review uploaded images or documents to detect personal data of third parties, although it may introduce technical measures for automatic anonymisation when it sees fit.

7. LEGAL BASIS FOR PROCESSING

The processing of your data is based on:

Performance of a contract: For providing the service you request, free or paid (analysing the listings, images, documents and property data you give us, and generating the evaluations and reports), and for managing payments.
Consent: For training AI models with your photos and conversations, for analytics and advertising cookies (and detecting your country to show you the currency), for browser notifications and for sending marketing communications and surveys.
Legitimate interest: For aggregated statistical analysis, the general improvement of the platform and its security, including preventing abuse (for example, the daily usage limits) and technical error logs.
Legal obligation: For compliance with tax and legal obligations.

8. DATA RETENTION

Personal data will be kept for the following periods:

Account, properties, conversations, photos and reports: For as long as you keep your account. You can delete it at any time from the chat menu (“Delete my account”): at that moment your account, your properties, your conversations, your inspections, your photos, your reports, your unpaid orders, your browser notifications and the technical logs linked to your email are deleted.
Paid orders: When you delete your account they are kept without any data that identifies you (no name, email, IP address or browser), with the amount, the date and the payment reference, for the periods required by tax and commercial law.
Receipts and invoices: Issued and kept by Stripe, with the payment details, under its own legal obligations.
Email verification codes: Deleted automatically after 7 days.
Signed-in session: The session cookie expires after 30 days.
Consent to AI training: We keep whether you gave it, when and with which wording for as long as you keep your account.
Backups: Deleted data may remain for a time in technical backups, which are only used to restore the service after a failure.
Anonymised data: Indefinitely, to improve the AI algorithms, as they are not personal data.

9. RECIPIENTS OF THE DATA

9.1. Sharing of Data

We may share your data with:

Essential service providers:

Hosting of the application and the database: Railway (servers in the European Union, the Netherlands)
Storage of photographs: Amazon Web Services S3 (European Union, Sweden)
AI provider: Anthropic (Claude)
Maps: OpenStreetMap Nominatim (only the address or area of the property)
Sending emails (verification codes): Resend
Payment services: Stripe (payment collection, receipts and invoices, fraud prevention)
Analytics and advertising, only with your consent: Google (Google Analytics and Google Ads) and ipapi.co (country from the IP address, to show you the currency)
Browser notifications, if you turn them on: your browser’s notification service (for example, Google’s, Apple’s or Mozilla’s), which delivers the notification

Authorities and public bodies:

When required by law
In response to legal proceedings

9.2. International Transfers

Several of our providers (among them Anthropic, Stripe, Google, Resend, ipapi.co and the company that runs Railway) are based in the United States or may process data outside the European Economic Area (EEA). In these cases, we ensure that there are appropriate safeguards to protect your data, such as:

Standard contractual clauses approved by the European Commission.
Adequacy decisions of the European Commission, including the EU–US Data Privacy Framework (DPF) for transfers to certified organisations in the United States.
Other transfer mechanisms approved under Chapter V of the GDPR.

10. USERS’ RIGHTS

10.1. Your Rights

As a user, you have the right to:

Access: Obtain confirmation of, and a copy of, your personal data.
Rectification: Correct inaccurate or incomplete data.
Erasure: Ask for your data to be deleted (the “right to be forgotten”).
Restriction: Restrict processing in certain circumstances.
Portability: Receive your data in a structured, commonly used format.
Objection: Object to certain processing, including processing based on legitimate interest.
Withdrawal of consent: You can withdraw the consent you have given for AI training (from the chat menu, “Pancho learns from my photos and chats”), for cookies (“Cookie settings”, at the bottom of the website) or for marketing communications at any time, without affecting the lawfulness of processing carried out before.
Not to be subject to automated decisions: Including profiling that has legal or similarly significant effects.

10.2. Exercising Your Rights

You can delete your account and your data yourself, at any time, from the chat menu (“Delete my account”). To exercise your other rights, contact us at:

Email: pancho@askpancho.ai

Postal address: Calle Larga Nº19, 44622 Arens de Lledó, Spain

If you can, write to us from the email address you use with Askpancho and state clearly which right you wish to exercise. If we cannot check that the request is yours, we will ask you for the minimum needed to confirm it. We will reply within one month of receiving the request at the latest. In particularly complex cases, or because of the number of requests, this period may be extended by two further months, and we will tell you about the extension within the first month.

10.3. Complaints

If you believe your rights have been infringed, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish data protection authority) or with the data protection authority of your country of residence in the EU.

11. DATA SECURITY

We apply appropriate technical and organisational measures to protect your data, including:

Encryption of communications (HTTPS/TLS).
Photographs stored encrypted on Amazon Web Services S3.
Role-based restricted access.
Regular reviews of the platform’s security.

12. MINORS

Our services are not intended for people under 18. We do not knowingly collect data from minors. If we find that we have received data from a minor, we will delete it immediately.

13. CHANGES TO THE POLICY

We reserve the right to update this policy. Significant changes will be notified by:

A prominent notice on the platform.
Email to registered users.
A request for fresh consent where necessary.

14. USE OF EVALUATIONS AND REPORTS

14.1. Public Sharing

The user may decide to share evaluations and reports publicly. In doing so, the user takes responsibility for disclosing any information they contain.

14.2. Use by Askpancho

We reserve the right to use evaluations and reports anonymously and in aggregate for:

Statistics and market analysis.
Improving our algorithms (subject to the user’s consent).
Promotional purposes (always anonymised).

15. COOKIES

The use of cookies is governed by our separate Cookie Policy, which is available on the platform.

16. CONTACT

For any question about this policy or about the processing of your data:

Email: pancho@askpancho.ai

Address: Calle Larga Nº19, 44622 Arens de Lledó, Spain

17. VERSION AND LANGUAGES

This policy is available in Spanish and in English. If there is any discrepancy between the two versions, the Spanish version prevails.