Privacy Policy

1. Who we are

Olloport is a 3D property-scanning service operated by Ilias Khayat, pending incorporation as a Spanish sociedad limitada (S.L.). We operate olloport.com and its related services: the client dashboard (app.olloport.com), the 3D viewer (view.olloport.com), and our capture and hosting services for 3D property scans.

• Privacy contact: privacy@olloport.com
• Our full corporate registration details (registered name, tax ID, and commercial registry entry) will be published here once incorporation completes.

We are the "data controller" for the processing described in this policy, except where Section 6 says otherwise (scans we host on behalf of our clients).

2. What this policy covers

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights. It covers five situations, and you may be in more than one:

1. You visit our website.
2. You contact us (contact form or email).
3. You have an account on our dashboard.
4. You are a business contact or lead in our records.
5. You appear in, or own a property shown in, a 3D scan we host.

3. What we collect and why

3.1 Website visitors

• Language preference: we read your browser's language header (Accept-Language) to show the site in English, Spanish, or Catalan, and store your choice in a lang cookie if you pick a language manually. Legal basis: our legitimate interest in showing you the site in your language.
• Security and operations logs: our hosting provider (Cloudflare) processes your IP address and request metadata to serve the site and protect it from abuse. Legal basis: legitimate interest in operating and securing the service.
• We do not use advertising or tracking cookies, and we do not sell data.

3.2 When you contact us

If you use the contact form or email us, we process your email address, name (if given), and the content of your message, plus an anti-spam check by Cloudflare Turnstile (which processes your IP address and browser signals). We use this to answer you and follow up. Legal basis: taking steps at your request prior to a contract (Art. 6(1)(b) GDPR); the anti-spam check is our legitimate interest.

We keep contact messages for 12 months after your last contact with us. If you become a client or an active business contact, your correspondence is kept under those longer terms instead (see Sections 3.4 and 6).

3.3 Dashboard account holders

If you have an Olloport account we process your email address, name, role, and a securely hashed password to provide the service (legal basis: contract). When you log in, we also record the IP address and browser (user-agent) of your session for security — detecting account misuse and unauthorised access (legal basis: legitimate interest in security).

We keep account data for the life of your account; when your account is closed, it is deleted (its login sessions are removed with it). Individual session records — including the session's IP address and browser — are deleted when you log out or change your password, and otherwise once the session has expired plus a short security window.

3.4 Business contacts and leads

If you or your company are a current, past, or potential client, we keep business contact details (name, company, email, phone, postal code, and notes about our conversations) in our internal records so we can manage the relationship and contact you about our services. Legal basis: contract (existing clients) or legitimate interest in business-to-business prospecting (leads).

Where we obtained your details from a public source rather than from you directly, we will tell you where we got them the first time we contact you. Every prospecting email we send includes a one-click opt-out link; use it — or simply reply asking us to stop, or email privacy@olloport.com — and we will not contact you again. When you opt out we keep a minimal suppression record — your email address and, where we held it, your phone number (and name) — so we can make sure we never contact you again on either; everything else about you is deleted at that point.

We review lead records and delete stale ones after 24 months with no interaction (the clock resets each time we contact you or you respond).

3.5 People connected to 3D scans

Our product hosts 3D scans of property interiors made for our clients (estate agencies, property owners and managers). Because a scan is tied to a specific property — and so, often, to the person who owns or lives there — the interior can amount to personal data about that person even when no one appears in it. Our practice:

• We capture empty or staged properties; scans should not normally contain people.
• Scans are processed and hosted on behalf of our client, who decides where the scan is published. For personal data visible in a scan, the client is generally the controller and we act as their processor under our terms of service.
• If you appear in a scan, or a scan shows your home and you want it removed or edited, contact takedown@olloport.com. We honour these requests regardless of which client commissioned the scan.
• Scans can be published or kept private by the client; a published scan is visible to anyone with the embed or link.
• Scan lifecycle: we keep the raw capture material for up to 1 year after a scan is processed (and delete it sooner on a valid takedown request). A processed, hosted scan is kept for as long as the client's hosting is active; when the client stops paying for hosting, the scan is archived, and archived scans are deleted after 24 months.
• Our staff can access client scenes (including private ones) for support, quality assurance, and editing work requested by the client. Legal basis: performing our contract with the client and our legitimate interest in service quality.

And three things we deliberately don't do:

• We do not use scan content to identify people, and we collect no biometric data.
• We do not sell scan content, and we do not use our clients' scans to train AI models for third parties or for purposes unrelated to our service. We may use scan data to develop and improve our own capture and 3D-reconstruction technology.
• Our service is not intended to capture special-category ("sensitive") data, and we design our captures to avoid it.

3.6 People who view a scan (embedded viewer)

Our 3D viewer is embedded on our clients' websites. If you view a scan there, we (as the host of the viewer) process minimal technical data to serve and protect it: the scene requested, the website embedding it (Origin/Referer), and your browser's user-agent, in short-lived server logs (our infrastructure provider also processes your IP address to deliver the content). The viewer sets no cookies for anonymous visitors and does not track you across sites; it stores only a cosmetic preference in your browser's local storage. Legal basis: legitimate interest in serving and securing the viewer. The client whose website you're visiting is responsible for their own site's data practices.

4. Who we share data with

We never sell personal data. We share it only with service providers ("processors") that help us run Olloport, under data processing agreements:

We may also disclose data where the law requires it (courts, authorities with a valid legal basis).

5. International transfers

Some of our providers process data outside the EU/EEA. Where data leaves the EU/EEA, the transfer is covered by the European Commission's Standard Contractual Clauses, and by the EU–US Data Privacy Framework where the provider is certified:

• Cloudflare — Standard Contractual Clauses; also EU–US Data Privacy Framework certified.
• Resend — Standard Contractual Clauses; also EU–US Data Privacy Framework certified.
• Anthropic — Standard Contractual Clauses.
• Google — we contract with Google Cloud EMEA Limited (Ireland); Standard Contractual Clauses apply to any onward transfer outside the EEA.

6. How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for, then delete it. Some data we are legally required to keep for a set period, which overrides a deletion request for that data. In summary:

Where a deletion request covers data we are required to keep (for example invoices), we delete everything except that data and explain why, and we delete the rest when its own period ends.

7. Your rights

Under the GDPR and Spanish LOPDGDD you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to its processing, and give you a portable copy. Where processing is based on consent, you can withdraw it at any time.

Write to privacy@olloport.com. We may need to verify your identity, and we will respond within one month.

You also have the right to complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es — though we'd appreciate the chance to resolve things first.

8. AI-assisted processing

We use an AI service (Anthropic's Claude API) to summarise and classify inbound business email so we respond faster. This processing does not make automated decisions with legal or similarly significant effects about anyone; a human reads and decides on every message. Under our Data Processing Addendum with Anthropic, our inputs and outputs are not used to train their models, and API logs are deleted automatically after a short period (7 days by default).

9. Cookies

We use two first-party cookies, both functional. We use no advertising, analytics, or tracking cookies, which is why there is no cookie banner.

10. Security

We protect data with, among other measures: TLS on all connections, hashed passwords, HttpOnly session cookies, access controls on internal tools, and hosting on Cloudflare's infrastructure.

11. Changes to this policy

We will post updates on this page and update the date at the top. For significant changes affecting account holders, we will notify you by email.