Privacy policy

The controller for the processing described here is the company that operates heimdalo.com.

Write to [email protected] with anything about your data: a question, a request for a copy, a deletion. A person reads that mailbox.

If you think we have handled your data badly, tell us first and we will try to fix it. You also have the right to complain to the data-protection supervisory authority in the country where you live or work.

Three things, and nothing else:

Your searches

The city, price range, filters and map area you look at. These are processed to return results and, in aggregate, to see which markets people want. They are not tied to a name.

Technical request data

Your IP address, browser and operating system, the page you asked for, the page you came from, and the time. This is the ordinary record any web server keeps, and it is what lets us serve the site, keep it up and block abuse.

Your email address, only if you give it

Saved searches and price alerts need somewhere to send the email. If you never ask for one, we never have one.

We do not ask for your name, your address, your income or your financial details, and there is nowhere on this site to enter them. We do not buy personal data and we do not sell it.

To run the site

Legitimate interest (GDPR Art. 6(1)(f)): serving pages, keeping them fast, and defending against abuse cannot be done without processing requests.

To send you alerts you asked for

Performance of a contract, or your consent (Art. 6(1)(a)/(b)). Either way it starts with you asking and stops when you unsubscribe.

To measure and improve

Consent for the analytics cookies described below; legitimate interest for aggregate figures that do not identify anyone.

To meet legal obligations

Where the law requires us to keep or hand over something, we comply with the law, and no more than it asks for.

Two small things are stored on your device by the site itself, and neither identifies you: a cookie remembering which language you chose, and a browser storage entry remembering your theme and currency. Both exist so the site does not ask you the same question twice.

On the live site, two third-party services also run:

Google Analytics 4

Google Ireland Limited. Which pages are visited and roughly from where, so we can tell what is worth building. Not used to identify you.

Google Analytics for Firebase (apps)

Google Ireland Limited. In the Heimdalo iOS and Android apps: that the app was opened, which screens were used, and the device type and rough location, counted per app installation so we know how many people use it. No advertising identifiers are collected, and it is not used for ads or to identify you.

Sentry

Functional Software, Inc., with data stored in its EU region (Germany). When a page breaks: the error, the page it happened on, and your browser and device type, so we can fix it. Your IP address is not stored and no account details are sent; at most the country and city it points to.

Crisp chat

Crisp IM SAS (France). Runs the chat widget. It only holds what you type into it.

Both are loaded only on heimdalo.com itself and never on a development or preview build. Nothing else runs: there is no advertising pixel on this site, and the browser sends no crash or error reports to us or to anyone else.

Being straight about a gap: at present the analytics tag loads when the page does, rather than after you have agreed to it. Under the ePrivacy rules they should be gated behind your consent, and a consent banner that actually holds them back is on the list of things to build. Until it exists, you can block it with your browser’s tracking protection or an extension, and the site will work exactly as well.

The processors named above, each for the one job described, under a data-processing agreement. Besides them: our hosting and email providers, for the same reason.

Nobody else. We do not sell personal data, we do not trade it, and we do not pass your search history to estate agents. When you contact an agent about a property, you do that on their site, under their privacy policy.

Some of these providers are American companies. Where data reaches the United States, the transfer rests on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses.

Server logs

Up to 30 days, then deleted.

Analytics data

Up to 14 months in Google Analytics, which is that product’s shortest retention setting.

Your email address for alerts

Until you unsubscribe, or after two years of an alert that nobody opens, whichever comes first.

Chat conversations

Up to 12 months, so we can pick up a thread you started.

Under the GDPR you can ask us for a copy of your data, for it to be corrected, for it to be deleted, for processing to be restricted, for your data in a portable form, and you can object to processing we base on legitimate interest. Where we rely on your consent, you can withdraw it at any time without that affecting what happened before.

Send any of those to [email protected]. We answer within a month, free of charge. We will ask enough to be sure the request is really yours, usually just that it comes from the address we hold, and no more.

One honest limitation: if you have never given us an email address, a request to "delete my data" has almost nothing to act on, because nothing we hold is linked to you. We will say so rather than perform a deletion.

Heimdalo is a tool for buying property and is not aimed at children. We do not knowingly collect data from anyone under 16. If you believe we have, write to us and it will be deleted.

This page changes when what the site does changes. That is the rule we hold ourselves to, and the date at the top is when the current version took effect.

If a change materially affects people who gave us an email address, they hear about it by email before it takes effect.