Privacy Policy

Voya ("we", "us", "our") operates a Spain property portal at voya.es, connecting property buyers with licensed real estate agents. For data enquiries, contact us at privacy@voya.es.

Buyers — name, email address, saved property preferences, and enquiry history when you create an account or send an enquiry.

Agents — agency name, contact details, logo, profile information, XML feed URLs, and credit transaction history when you register as an agent.

Valuation requests — property address, property details, contact name, email, and phone when you submit a valuation request.

Usage data — pages visited, search queries, and property views, collected via cookies only after you give consent.

• To provide and operate the Voya platform
• To connect buyers with agents and facilitate enquiries
• To send transactional emails (enquiry confirmations, lead notifications, credit alerts)
• To send property alerts matching your saved search criteria (buyers, opt-in only)
• To process payments via Stripe (agent credit purchases)
• To improve the platform using anonymised analytics (with consent)

We process your data under the following lawful bases:

• Contract performance — to deliver the service you signed up for
• Legitimate interests — to prevent fraud, improve our service, and send transactional communications
• Consent — for analytics cookies and marketing emails (you can withdraw at any time)

We share data with the following third parties only as necessary to operate the platform:

• Supabase — database and authentication (EU region)
• Stripe — payment processing (PCI-DSS compliant; we never store card data)
• Resend — transactional email delivery
• Google Analytics — anonymised site usage analytics (only with your cookie consent)
• Cloudflare — hosting and DDoS protection

We do not sell your personal data to any third party.

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are required to retain it for legal or financial reasons (e.g. Stripe transaction records, which are kept for 7 years).

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — for analytics cookies via the cookie banner at any time

To exercise any of these rights, email privacy@voya.es. We will respond within 30 days.

We use the following cookies:

• Essential — authentication session cookies (Supabase). These are required for the platform to function and cannot be disabled.
• Analytics — Google Analytics (only loaded after you accept cookies). These help us understand how users navigate the site. No personally identifiable information is sent.

You can change your cookie preference at any time by clearing your browser's local storage for voya.es.

We use industry-standard security practices including encrypted connections (HTTPS), row-level security in our database, and access controls. Passwords are hashed and never stored in plain text. Payment data is handled entirely by Stripe and never touches our servers.

We may update this policy from time to time. We will notify registered users of material changes by email. Continued use of Voya after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests: privacy@voya.es