# Casafari API and MCP Platform: Privacy Notice

> **Casafari is the AI agent-native real estate data intelligence platform.** The most complete property index in Europe: a deduplicated, cleaned property graph of residential and commercial property, for sale and for rent, in 16 countries. Every property is one record with its full price and market history. [How the property graph is built](/docs/property-graph).

*Version 1.0 - effective 14 October 2026*

This Notice explains how CASAFARI SPAIN SL treats personal data when you use the Casafari API and MCP Platform at platform.casafari.com (accounts, console, API and MCP servers — the "Platform") and the public developer documentation at developers.casafari.com (the "Documentation"), and your rights under the General Data Protection Regulation (GDPR) and Spanish data protection law. The www.casafari.com Privacy Policy does not apply to these two sites.

The Platform is for business use and is not aimed at children; you must be 18 or over to open an Account.

Words with a capital letter (Account, Organisation, Member, Credentials, Connected App, Results, Unit, Credits, Payment Link, and the plans Free, Agent and Custom) have the meaning given in the Casafari API and MCP Platform Terms of Use at https://developers.casafari.com/legal/platform-terms.

## 1. Controller and contact

1.1 The controller is CASAFARI SPAIN SL, tax identification number (NIF) B10567162, with registered office at Avenida Doctor Arce, nº 14, Bajo, 28002 Madrid, España ("Casafari", "we", "us"). Casafari is part of the Casafari group, meaning Casafari Europe Ltd and the companies it controls.

1.2 Privacy contact: write to Casafari at the registered office in section 1.1. We have not appointed a data protection officer, and we have not designated a representative in the EU or in the UK.

## 2. Who this Notice covers

2.1 This Notice covers:

(a) Account owners, Members, and people invited to an Account;

(b) people whose sign-up was started by an AI assistant or other software through the sign-up API, whether or not they completed it;

(c) Members with the owner or billing role who sign in to pay a Payment Link sent to an AI agent or other software (section 3, "Billing records");

(d) people who apply for business verification;

(e) visitors to developers.casafari.com (section 12);

(f) real estate agents and agencies in Germany whose professional data is in AgentGraph AI (section 13).

## 3. Personal data we collect on the Platform

3.1 We collect the following personal data on the Platform:

| Category | Details | Source |
|---|---|---|
| Identity and contact | Name, email address | You; the person who invited you; or the AI assistant or other software that started your sign-up (email address only, together with the name and version of the software that asked) |
| Sign-in data | Sign-in provider identity: Google (account identifier and verified email address; a Google Workspace domain, if any, is recorded but not required), Microsoft work or school account (tenant and user identifier) or GitHub (numeric user identifier and primary verified email address); email sign-in codes (6 digits, valid 10 minutes, up to 5 attempts), stored only as a hash — we never store the code itself; sign-up records (the Terms version accepted, when, and how: console, sign-up API code or OAuth consent); sessions, including when you last re-authenticated for a sensitive action; pending OAuth requests | You; the sign-in provider; generated by the Platform |
| Organisation data | Invitations (email address, role, invitation link valid 7 days), Member roles | Account owner or admin |
| Credentials metadata | API key metadata (never the key itself); OAuth clients; OAuth grants to Connected Apps; access and refresh tokens issued to them | You; generated |
| Usage records | Which operations your Account called, when, the Units used and from which source (the Free allowance, the allowance of your Plan, or Credits); raw event identifiers kept briefly to avoid double counting; daily usage per Account; the places named in requests, counted for the daily distinct-places limit | Generated |
| Audit log | Who did what in an Account (for example added a Member, created a key, changed the spending cap, attempted an automatic top-up), with the acting user's email address | Generated |
| Verification applications (AgentGraph AI) | Legal name, registration country, EU VAT id or company registration number, website, address, stated intended use (free text), outcome of the VIES check and of staff review | You |
| Billing records | Billing name and address, tax ids, payment status, invoices, payment-provider events; automatic top-up settings and spending cap; Payment Links created when a call needs payment (reason, status, who may pay, expiry after 24 hours); card details are held by Stripe, not by us | You; Stripe; Invopop |
| Payment card fingerprint | An opaque identifier Stripe assigns to a payment card (never the card number), kept to notice the same card being used on more than one Account | Stripe |
| Email preferences and email log | Your tips-and-usage opt-out, your news opt-in, when you last changed them; which lifecycle emails have been sent to your Account | You; generated |
| Network data | Network addresses are stored only as a keyed hash, used for sign-up and abuse limits; we do not keep the address itself | Generated |
| Use-pattern signals | Flags raised when an Account repeatedly hits the distinct-places limit or touches most of the places in one region, or when one card or one network spans several Accounts; staff alerts about them carry Account identifiers and numbers only | Generated |
| Communications | Support emails and legal notices you send us | You |

3.2 We do not process special categories of personal data on the Platform.

3.3 The query inputs you send to the Platform (places, areas, property criteria, a webhook address for Alerts) are not personal data entrusted to Casafari for processing on your behalf; the places named in requests are recorded only as part of the usage records and use-pattern signals above. Results flow from Casafari to you. Personal data contained in Results, in particular AgentGraph AI, is described in section 13.

## 4. Purposes and legal bases

4.1 We use personal data for the following purposes and on the following legal bases:

| Purpose | Data | Legal basis |
|---|---|---|
| Opening and running your Account, signing you in, issuing Credentials, metering usage, delivering Results, sending transactional emails (sign-in code, invitations, payment failed, automatic top-up failed, Free plan ending, allowance used up, invoice issued) | Identity, sign-in, Credentials metadata, usage | Performance of the contract (Art. 6(1)(b)); for Members added by an Organisation, our legitimate interest in providing the service the Organisation contracted (Art. 6(1)(f)) |
| Charging you, operating Payment Links, and issuing legal invoices under VERI*FACTU | Billing | Contract (Art. 6(1)(b)); legal obligation under Spanish tax and invoicing law (Art. 6(1)(c)) |
| Evidence of acceptance of the Terms and of what each Member did in an Account | Sign-up records, audit log | Legitimate interest in proving the contract and resolving disputes (Art. 6(1)(f)) |
| Preventing abuse, fraud and circumvention of limits; detecting bulk extraction and multi-account use; securing the Platform | Hashed network addresses, sign-in data, usage, Turnstile result, payment card fingerprint, use-pattern signals | Legitimate interest in security and preventing misuse (Art. 6(1)(f)) |
| Business verification for AgentGraph AI, including recording your stated intended use | Verification applications | Legitimate interest in supplying AgentGraph AI only to businesses with a lawful purpose and in documenting that assessment (Art. 6(1)(f)) |
| Lifecycle emails to customers (welcome, plan-related notices, tips, use cases) | Email address, usage, email preferences | Legitimate interest in informing existing customers about the service they signed up for (Art. 6(1)(f)), with an opt-out at sign-up, in your email settings on the Platform and in every tips and use-case email (section 5) |
| News emails | Email address, email preferences | Consent (Art. 6(1)(a)) |
| Improving the Platform using aggregated usage statistics | Usage (aggregated) | Legitimate interest (Art. 6(1)(f)) |
| Responding to your requests and legal claims; complying with authorities | Any | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |

4.2 Where we rely on legitimate interests we have balanced them against your rights. You can ask for a summary of that assessment by writing to us (section 1.2).

## 5. Emails we send

5.1 **Transactional emails** (sign-in code, invitations, payment failed, automatic top-up failed, Free plan ending, allowance used up, invoice issued) are part of the service and cannot be unsubscribed from while your Account is open. They are sent from no-reply@platform.casafari.com.

5.2 **Lifecycle emails** are sent about the Platform you signed up for, without prior consent, on the basis of our legitimate interest as your service provider. The welcome email and the tips and use-case emails are sent to Account owners; the plan-related notices are sent to Members who manage billing (the owner and billing roles). They are of two kinds:

(a) **welcome and plan-related notices** — a welcome email when your Free Account opens, a notice when 80% of the Units of your Free allowance are used, a welcome to the Agent plan on your first Agent subscription, and a suggestion to talk to us about Custom when your use is heavy — sent on the same transactional email stream as the emails in 5.1;

(b) **tips and use-case emails** — getting-started suggestions, use cases and tips — sent as product updates on a separate broadcast email stream, each with an unsubscribe link.

You can opt out at sign-up ("Don't send me tips and usage emails"), in your email settings on the Platform, and through the unsubscribe link in every tips and use-case email, without affecting the service. An unsubscribe through the link is recorded by our email provider, Postmark, and an opt-out at sign-up or in your settings is recorded by us; either stops the tips and use-case emails. The opt-out does not stop the welcome and plan-related notices in (a). Replies to lifecycle emails go to platform@casafari.com.

5.3 **News emails** (Casafari news, new products, offers) are sent only if you opt in. You can withdraw your consent at any time by writing to us (section 1.2).

## 6. Who we share personal data with

6.1 **Processors acting on our instructions**

| Processor | What they do for us | Data involved | Location |
|---|---|---|---|
| Cloudflare | Hosting of both sites, database, email security check, request logs, Turnstile on browser sign-in and sign-up | All Platform data; request data of visitors to developers.casafari.com | Global network — see section 7 |
| Stripe | Card payments and Stripe Checkout, card verification, fraud screening (Stripe Radar), Stripe Tax, VAT id check against the EU VIES service, customer portal, card fingerprints. The production Stripe account is "Casafari API and MCP Platform", in the name of Casafari Spain S.L. | Billing data, email address, tax ids, payment card fingerprint; card data is collected by Stripe directly and never reaches our systems | See section 7 |
| Invopop | Issuing legal invoices under VERI*FACTU (Spanish AEAT) and reporting them to the Spanish tax authority | Billing and invoice data | See section 7 |
| Postmark | Sending transactional and lifecycle emails; keeping the list of addresses that unsubscribed from the broadcast stream | Name, email address, email content | See section 7 |

6.2 **Other recipients:** Casafari group companies, for internal administration; your Organisation's owner and admins, who can see Members' names, email addresses, roles and the audit log, and any Member, who can see which Members may pay a Payment Link; the Spanish tax authority (AEAT), which receives invoice records under VERI*FACTU; the EU VIES service, which receives your VAT id (through Stripe) to confirm it; courts, authorities and professional advisers where required; a buyer of the business, if Casafari is sold. Staff alerts about security and abuse carry Account identifiers and numbers only (no names or email addresses) and are posted to an internal Slack channel.

6.3 **Connected Apps:** if you authorise an AI assistant or other application to call the Platform on your behalf, that provider sees the calls it makes for you and the Results. The provider is not our processor; its own privacy policy applies.

6.4 We do not sell personal data.

## 7. International transfers

7.1 Hosting is on Cloudflare's global network. Where personal data is transferred outside the European Economic Area — including to the United States, where Cloudflare, Stripe and Postmark are headquartered — we rely on the EU–US Data Privacy Framework where the provider is certified under it and otherwise on the European Commission's Standard Contractual Clauses, together with the provider's data processing addendum. You can ask for a copy of the safeguards by writing to us (section 1.2).

## 8. How long we keep personal data

8.1 The first eight periods below are enforced automatically by daily deletion jobs.

| Data | Kept for | Why |
|---|---|---|
| Sign-in codes (hashed) and pending sign-in / OAuth requests | 7 days after they expire | Troubleshooting failed sign-ins, abuse detection |
| Access tokens | 7 days after they expire | Security investigations |
| Refresh tokens | 30 days after they expire | Security investigations |
| Raw usage event identifiers | 3 days | Avoiding double counting |
| Daily usage per Account | 25 months | Billing disputes, usage history, year-on-year comparison |
| Audit log | 25 months | Evidence, security, disputes |
| Payment-provider events | 90 days | Reconciliation, dispute handling |
| Legal invoices and billing records | 10 years | Spanish tax and commercial record-keeping |
| Sign-up records (Terms version accepted, date, time and how) | Life of the Account plus 5 years | Proof of the contract within the limitation period for contractual claims |
| Account identity data (name, email address, Members, invitations, Credentials metadata, OAuth grants, email preferences, lifecycle email log) | Life of the Account; on erasure, anonymised or deleted as described in section 9.4, except what the rows above require | Running the service |
| Sessions | Expire after 7 days without use, and in any case 30 days after sign-in; ended at once on sign-out | Keeping you signed in; security |
| Verification applications (AgentGraph AI), including stated intended use | Life of the Account plus 5 years | Accountability for the legitimate-interest assessment and for any claim |
| Hashed network addresses | 30 days | Sign-up and abuse limits |
| Payment Links | Expire 24 hours after creation | Letting an AI agent's call be paid for and retried |
| Use-pattern signals | The record of distinct-places limit hits covers at most the last 7 days, and the region record the last 30 days | Detecting bulk extraction and multi-account use |
| Support and legal correspondence | 5 years after the matter is closed | Claims and complaints |

8.2 If you ask us to delete your personal data earlier, we will, unless we must keep it for one of the reasons above; in that case we will tell you what we keep and why.

## 9. Your rights and how to exercise them

9.1 You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent (for news emails) at any time without affecting earlier processing. You may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority of your country of residence.

9.2 **Account owners** can export the Account's data and delete the Account on the Platform, after signing in again (re-authentication), or by writing to us (section 1.2). The export is a JSON file of every record that references the Account or your user, with secrets and hashes removed. Deletion closes the Account. To delete your own user while you are the only owner of an Organisation that still has other Members, you must first appoint another owner or remove the other Members.

9.3 **Members and any other individual** (including someone whose sign-up was started by an AI assistant but never completed, an invited person who never joined, or a professional included in AgentGraph AI) can write to us (section 1.2). We verify your identity, normally by sending a code to the email address on record, and respond within one month (extendable by two months for complex requests, in which case we tell you).

9.4 **What erasure does.** When a user is erased, the user record is anonymised (the email address is replaced by a placeholder), sign-in identities and sessions are deleted, and billing and legal-invoice records are kept for as long as the law requires (section 8).

9.5 Where you are a Member of an Organisation's Account, some requests (for example deleting your entries in the audit log) may need to be routed through the Organisation, because the log is kept to protect the Organisation's own interests; we will tell you if so.

## 10. Security

10.1 Platform traffic is encrypted in transit (TLS on every host, with HTTP Strict Transport Security). Sign-in codes are stored only as hashes; API keys are never stored in clear; network addresses are kept only as keyed hashes; card details never reach our systems. We do not write credentials, codes, tokens, email bodies, payment or invoicing payloads, or request and response bodies to our logs — only identifiers. Sensitive actions in the console (deleting an Organisation, making a Member an owner, creating a confidential OAuth client, rotating an OAuth client secret, raising the spending cap above twice the Plan's default, exporting or erasing data) require you to sign in again. Access by Casafari staff is restricted to what their role requires. Data is deleted on the schedule in section 8.

## 11. Cookies

11.1 Neither site uses analytics or advertising cookies, and neither shows a cookie banner, because every cookie used is either strictly necessary or set only when you choose a setting.

| Cookie | Site | Purpose | Set when | Duration | Identifier? |
|---|---|---|---|---|---|
| __Host-cf_session | platform.casafari.com | Keeps you signed in to the console (strictly necessary); Secure, HttpOnly, SameSite=Lax | You sign in | 7 days without use (renewed at most once an hour while you use the console), and in any case 30 days from sign-in; ended on sign-out | Session reference only |
| casafari_theme | developers.casafari.com and platform.casafari.com (domain .casafari.com, so both sites show the same theme) | Remembers your light, dark or system display preference (functional, user-chosen) | Only when you choose a theme | 1 year | No — contains only "light", "dark" or "system" |
| Cloudflare Turnstile | platform.casafari.com browser sign-in and sign-up pages | Tells humans from bots on browser sign-in and sign-up (strictly necessary) | You open the sign-in or sign-up page | Set by Cloudflare | Set by Cloudflare |

11.2 Because casafari_theme is set on .casafari.com, your browser also sends it to www.casafari.com; it contains nothing but the theme word.

## 12. Visitors to developers.casafari.com

12.1 The Documentation has no accounts, sign-in, forms or payments. Reading it involves only the standard request data (IP address, browser user agent, pages requested) that Cloudflare processes on our behalf to serve and protect the site, on the basis of our legitimate interest in running a secure website (Art. 6(1)(f)). We do not use them to identify or profile visitors. The only cookie is casafari_theme, described in section 11. If you follow a link to sign up or sign in, the Platform sections of this Notice apply from that point.

## 13. Real estate professionals in Germany whose data is in AgentGraph AI

13.1 This section is the information under Article 14 GDPR for agents and agencies included in AgentGraph AI.

13.2 **What we hold:** professional data about real estate agents and agencies in Germany.

13.3 **Why and on what basis:** Casafari is the controller of the compilation and relies on its legitimate interest in providing business-to-business market intelligence to verified real estate businesses (Art. 6(1)(f)), having balanced that interest against your rights and the professional nature of the data.

13.4 **Who receives it:** only businesses that have passed verification (EU VAT id matched against VIES with a matching registered name, or review by Casafari staff) and have told us their intended use. AgentGraph AI is delivered only through the Platform's MCP server. Each customer becomes an independent controller once it receives the data and is bound by contract to use it only for business-to-business purposes within the real estate sector (contacting agents and agencies in their professional capacity, market analysis, partner or recruitment search), never for bulk unsolicited messaging, to respect objections and to delete it within 12 months of receipt.

13.5 **Suppressed records:** a suppressed record is kept only as a suppression marker so that you are not re-added.

13.6 **Your rights:** access, rectification, erasure, restriction and, in particular, the right to object at any time. Write to us (section 1.2). On objection we suppress your record and tell every customer that received it in the previous 12 months to delete it. You may complain to the AEPD or to the data protection authority of your German state.

## 14. Updates

14.1 We post changes here with a new date and email Account owners about material changes.

## Questions about this

- [Is there an SLA, and what are the contract terms?](/docs/faq/sla-and-contract-terms)