Privacy Policy

This policy explains how SYSTEMER LLC (ТОВ «СИСТЕМЕР», Ukrainian company code 46112328, "we") processes personal data when you use Realtory: the realtory.app website, the CRM, agency and office addresses, property and selection pages for clients, and the emails the service sends.

We process data in line with the Law of Ukraine "On Personal Data Protection" and, for people in the European Union, the General Data Protection Regulation (GDPR).

1. Who is responsible for the data

Realtory has two roles, and they decide whom to contact.

• Account and billing data (who registered the agency, who signs in to the CRM, the plan and payments): SYSTEMER LLC is the controller.
• Data the agency keeps in the CRM (owners, clients, properties, developers, tasks, notes, deals, finances): the agency is the controller. We process it only as a processor, on the agency's instructions, so that the CRM works. If you are a client or a property owner and want to know what is recorded about you or have it deleted, contact the agency first. We will help the agency handle your request.

Data questions: hello@realtory.app.

2. What data we receive

From you and your agency

• Account: name, email, password (stored only as an irreversible hash), phone and profile photo if you add them, role and access in the team, office.
• Agency: name, offices with their addresses and languages, brand identity (logo, mark, colours, fonts).
• CRM records: what the team enters or imports from a file: names and phone numbers of owners and clients, properties with addresses and photos, tasks, contact history, selections, deals, financial operations, refusal reasons, custom fields.
• Messages to us: emails you send and our replies.

When you sign in with Google

If you click "Sign in with Google" or "Continue with Google", Google gives us your name, email address and profile photo. We use them only to create your account or recognise you when you sign in. We get no access to your Gmail, contacts, calendar, Drive or other Google data.

Realtory's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When an agency shares a page with a client

An agency can send a client a link to a property or a selection. When the client clicks "I want to see it", "I will think" or "Not interested", we record that answer and show it to the client's agent.

When you pay

Payment takes place on the plata by mono page. The card number, expiry date and CVV are entered on the bank's side; we neither see nor store them. The bank tells us the amount, the payment status, the invoice or subscription identifier and, where needed, the masked card number.

Automatically

• Cookies needed for the service to work: the sign-in session (Supabase), the office whose login you came through, and the language of its pages. Signing in does not work without them. We use no advertising or analytics cookies, and the site has no ad trackers or third-party analytics.
• Browser local storage: interface preferences on this device (recent searches, collapsed blocks, a saved list view). This data does not leave your browser.
• Technical logs: IP address, browser type, time and address of the request. Our hosting providers keep them for security and debugging.

3. Why we process data

• Create an account, let you sign in, show the CRM with the agency's data: performance of the contract (the Terms of Service).
• Send service emails (email confirmation, password reset, invitations, access requests, payments, end of the trial): performance of the contract.
• Send notifications, the morning task list and "What's new in the CRM": performance of the contract; each of these can be turned off.
• Take payments and keep payment records: performance of the contract, accounting law.
• Protect the service from abuse, find and fix errors: our legitimate interest.
• Answer your messages: your consent or performance of the contract.

We do not sell personal data, do not use agencies' data for advertising and do not train artificial intelligence models on it.

4. Who we share data with

Only with providers the service cannot work without, and only as much as their job needs:

• Supabase: database, sign-in, photo storage;
• Vercel: hosting of the website and the CRM;
• Resend: sending emails;
• Google: Google sign-in, if you choose it;
• JSC Universal Bank (monobank, plata by mono): taking payments.

These providers' servers may be located outside Ukraine, including in the EU and the USA. We work with them on terms that require data protection no weaker than Ukrainian law and the GDPR (including the EU Standard Contractual Clauses).

We may also disclose data to public authorities when the law requires it, and to a new owner of the service in a reorganisation, provided they keep to this policy.

Inside an agency, data is visible to its team according to the roles and access the head sets up.

5. How long we keep data

• Agency and account data is kept while the agency uses Realtory. When a trial or paid period ends, the CRM closes, but the records are kept so the team can carry on where it left off after paying.
• At the request of the agency's owner we delete the agency and all its records within 30 days. Before that, the owner can export the database in Settings → Import and export. Data disappears from backups as they rotate, and no later than 90 days.
• A person whose access the agency turned off no longer signs in to the CRM; the records they kept stay with the agency.
• Payment data is kept as long as accounting and tax law requires.
• Technical logs are kept for up to 90 days.

6. How we protect data

• Connections to the website and the CRM are encrypted (HTTPS).
• The database itself checks who may see what: a person gets only their agency's records, within their role.
• Passwords are stored only as hashes.
• Service access keys are kept apart from the code and never reach the browser.

No protection is absolute. If a breach affects your data, we will tell you and, where the law requires, the Ukrainian Parliament Commissioner for Human Rights and the competent supervisory authority.

7. Your rights

You have the right to:

• know what data of yours we process, why and who receives it;
• get a copy of your data;
• correct inaccurate data (most of it can be changed in Settings → My profile);
• ask for your data to be erased or its processing restricted;
• object to processing based on our legitimate interest;
• withdraw consent where processing relies on it;
• turn off optional emails in Settings → My profile → Emails or with the link at the bottom of an email;
• complain to the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, to your country's data protection authority.

To use a right, write to hello@realtory.app from the address you sign in to Realtory with. We will answer within 30 days. If the request concerns records an agency keeps, we will pass it on to the agency.

8. Children

Realtory is a work tool for real estate professionals. It is not meant for people under 18, and we do not knowingly collect their data.

9. Changes to this policy

When we change the policy, the new version appears on this page with a new date. We will tell the agency's owner about material changes by email in advance.

10. Contact

SYSTEMER LLC (ТОВ «СИСТЕМЕР»), company code 46112328. Email: hello@realtory.app.