This policy explains how personal data is handled in the Houzit mobile app and the Houzit web platform at app.houzit.com.
1. Who we are
The Houzit mobile app ("the app") and the Houzit web platform at app.houzit.com (together "Houzit") are operated by:
Worldom Ltd.
Vjal Ir-Riħan, Cali House, 3rd Floor, San Ġwann SGN 9020, Malta
Company registration number C 94516 (Malta Business Registry, EUID MTROC.C94516)
In this policy, "we", "us" and "our" mean Worldom Ltd.
Data protection contact: send any question or request about your personal data to info@houzit.com.
Houzit is a CRM for real-estate agencies. Agencies subscribe to Houzit. Their agents and managers use the app to manage property listings, buyer and tenant clients, property owners, viewings and deals.
2. Our role: agency vs Houzit
Houzit handles two kinds of personal data. Our role is different for each.
| Data | Who decides why and how it is used (controller) | Our role |
|---|---|---|
| Your own account as an agent, manager or agency administrator: login, profile, bank details, documents you upload about yourself, app usage | We do. Your agency approves your account and manages what you can access within it. | Controller |
| Business records your agency keeps: clients (buyers and tenants), property owners, listings, viewings, deals, notes, and documents about them | Your agency | Processor, acting on the agency's instructions |
We have a data processing agreement (Art. 28 GDPR) in place with each agency that subscribes to Houzit.
If you are a client or property owner whose details an agency has entered into Houzit, contact that agency about your data. We will help the agency answer you.
3. What we collect and why
3.1 Your account (agents, managers, administrators)
| Data | Where it comes from | Why we use it | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Name, email address, password (stored only as a hash by our authentication provider) | You, when your account is created or when you register | To create your account and sign you in | Contract (6(1)(b)) |
| Phone number, profile photo, date of birth, gender, nationality, languages spoken, short bio | You, in your profile | To show your profile to colleagues, and to clients on listings you handle; to match you with clients | Contract (6(1)(b)) |
| Agency, team, role, seniority, specialisation (sales or lettings), the cities you cover | You and your agency | To give you the right access and to route clients to you | Contract (6(1)(b)) |
| Employment details: address, ID-card number, VAT status and number, work-permit number, real-estate licence number, apprenticeship details | You or your agency administrator | Agency onboarding and compliance; commission payouts | Contract (6(1)(b)); legal obligation where agency or licensing rules require it (6(1)(c)) |
| Identity and onboarding documents you upload (for example a copy of your ID card or passport, police conduct certificate, due-diligence document, service agreement) | You or your agency administrator | Agency onboarding and compliance checks | Legal obligation (6(1)(c)); legitimate interests of the agency in checking who works for it (6(1)(f)) |
| Bank details (bank name, IBAN, SWIFT/BIC) | You | To pay your commission | Contract (6(1)(b)) |
| Social links (Facebook, Instagram, LinkedIn, YouTube, TikTok, X, website) | You (optional) | To show them on your public agent profile | Consent (6(1)(a)); you can remove them at any time |
| Credits, targets, activity history (for example "claimed a client", "added a listing"), last time you used the app | Created as you use Houzit | Operating the app's features (credits, onboarding checklist, agency reports) | Contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Push-notification token for your device | Your device, when you allow notifications | To send you notifications (new leads, approvals, listing updates) | Consent, given through your device's notification prompt (6(1)(a)) |
| Notification and e-mail preferences, language | You | To respect your choices | Contract (6(1)(b)) |
| Messages you send through "Contact Us" | You | To answer you | Legitimate interests (6(1)(f)) |
3.2 Records you enter about other people (processed for your agency)
When you use Houzit you enter information about clients (buyers and tenants) and property owners. This includes names, phone numbers, email addresses, nationality, occupation, date of birth, what property they are looking for, budgets, notes, viewing and deal history, and documents such as ID copies, reservation agreements and preliminary agreements. It also includes listings: property addresses, descriptions, photos and videos.
We process this data for your agency, which is the controller (see section 2). Only people at your agency with the right access can see it. Agency rules decide who sees an owner's contact details, for example through the credit-based "unlock".
3.3 Camera, photos, location and contacts
- Camera: used only when you choose to take a photo, for example of a property for a listing.
- Photo library: used when you choose photos or videos to add to a listing or to your profile, and when you save listing photos to your device.
- Photo metadata: when you upload a photo, our servers remove its embedded metadata (EXIF, XMP and IPTC), including any GPS position your phone recorded, before the photo is stored or shown.
- Location: the app never collects your device location. Maps in the app show property locations only.
- Contacts: the app does not read your address book.
3.4 App analytics
The app uses Google Firebase Analytics to count app opens and the use of some features, such as downloading listing photos. Analytics data is not linked to your name or account, and the app does not show ads.
- iOS: the app does not use the advertising identifier (IDFA) and does not track you across other companies' apps or websites.
- Android: the app declares the Android advertising ID permission, so Firebase Analytics may read the device's advertising ID. We do not use it for advertising, for personalised ads, or to track you across other companies' apps or websites. You can reset or delete your advertising ID at any time in your device's settings.
Google may derive an approximate region from your IP address. Legal basis: our legitimate interests in understanding how the app is used so we can improve it (6(1)(f)).
We do not use crash-reporting or advertising SDKs in the app.
3.5 Service logs
Our servers keep technical logs (for example failed sign-in attempts and server errors, with the time, the IP address used and the app version) to keep Houzit secure and working. Legal basis: legitimate interests (6(1)(f)).
4. Who processes data for us
We use the following service providers. They process data only on our instructions and under data processing terms.
| Provider | What for | Data involved | Location |
|---|---|---|---|
| Supabase | Database and user authentication (sign-in, passwords, sessions) | All account and CRM data | EU (Stockholm, eu-north-1) |
| Amazon Web Services (Elastic Beanstalk, S3, CloudFront CDN, Amazon Location Service) | Hosting the Houzit API and search; storing photos, videos and documents (private documents are not publicly reachable); turning typed addresses into map positions | All data handled by the API; uploaded files; listing addresses | EU (API and search in Stockholm, eu-north-1; file storage in Milan, eu-south-1; address lookup in Frankfurt, eu-central-1) |
| Meilisearch (open-source software, run by us on AWS) | Search across listings, clients and owners | Searchable CRM fields | Our AWS hosting in the EU; no data goes to a third party |
| Google Firebase (Cloud Messaging and Analytics) | Push notifications, which are delivered through Firebase Cloud Messaging; usage statistics (see section 3.4) | Device push token and notification content; app-usage events | Google (United States and other countries) |
| Google Maps Platform | Showing property locations on maps in the app | Map requests (property coordinates, your IP address) | Google (United States and other countries) |
| Twilio SendGrid | Sending e-mails (account e-mails, notifications, and forwarding "Contact Us" messages to our support team) | Recipient e-mail address and e-mail content | United States |
| OpenAI | The optional "AI description" feature: it rewrites or drafts a listing description from the listing's details | Listing details and the text being enhanced. Listings are about properties; we do not send clients' or owners' contact details. | United States |
| Stripe (only if your agency sets it up) | Reservation-deposit payment links an agent sends to a client | The client pays on the agency's own Stripe payment page. Houzit passes only the amount in the link and stores no card data. The agency is Stripe's customer. | United States and other countries |
Agency-chosen integrations. Your agency can connect Houzit to its own website or to property portals, so listings, including the listing agent's name and work contact details, are published there. The agency controls these integrations.
We do not sell personal data and do not share it with advertisers or data brokers.
5. How long we keep data
| Data | How long |
|---|---|
| Your account and profile | While your account exists. When you delete your account, it is deleted straight away (see section 7). |
| Your bank details, ID and onboarding documents, push tokens | Until you remove them, or until your account is deleted |
| Records you created for your agency (listings, clients, owners, deals) | Kept by your agency after you leave or delete your account, under the agency's own retention rules. They belong to the agency. |
| An agency's data after its Houzit subscription ends | Kept for 90 days, then deleted, unless the agency asks us to delete it sooner or the law requires us to keep it longer |
| Server logs | 90 days |
| Backups | Database backups roll over within up to 30 days. Deleted data disappears from backups when they roll over. |
| Analytics | 14 months |
6. Your rights (GDPR)
You have the right to:
- access your personal data and get a copy of it;
- correct it. Most profile data can be edited in the app under Me;
- delete it (see section 7);
- restrict or object to processing based on legitimate interests;
- data portability: receive the data you gave us in a machine-readable format;
- withdraw consent at any time, where we rely on consent. For example, turn off notifications in your device settings or remove your social links;
- complain to a data protection supervisory authority. In Malta this is the Information and Data Protection Commissioner (IDPC), https://idpc.org.mt. You can also complain in the EU country where you live or work, or where the alleged infringement took place.
To use these rights, e-mail info@houzit.com. We answer within one month. If you are a client or property owner, please contact the agency that holds your data first (see section 2).
7. Deleting your account
In the app: open the Me tab, scroll to the bottom, tap Delete Account, and confirm. If your account is still waiting for your agency's approval, tap Delete Account on the "waiting for approval" screen.
When you delete your account:
- your login is deleted immediately: you are signed out and can no longer sign in with that email and password;
- your personal details are erased: name, email, phone, photo, date of birth, nationality, languages, bank details, ID and licence numbers, social links, notification settings and device push tokens;
- the ID and onboarding documents you uploaded are deleted from storage;
- records you created for your agency stay with the agency: listings, owners and deals remain; clients you were handling go back to the agency's shared pool; your name on them is replaced by "Deleted user".
Agency administrators cannot delete their own account in the app, because the agency must not be left without an administrator. Another administrator or Houzit support can close it.
Without the app: e-mail info@houzit.com from the address on your account and we will delete it for you.
8. Security
Data is encrypted in transit (HTTPS/TLS 1.2+) and stored with our providers in encrypted form. Private documents can only be downloaded through short-lived signed links. Access inside an agency is limited by role. Every agency's data is kept separate from other agencies' data at the database level.
9. Children
Houzit is a business tool for real-estate professionals. It is not intended for anyone under 18, and we do not knowingly collect data from children through the app. If you believe a child has created an account, contact us and we will delete it. (Agencies may record information about a client's household, for example that a tenant has children. The agency is responsible for that data as controller.)
10. International transfers
Our main hosting (database, API and file storage) is in the EU. Some providers in section 4 (Google, SendGrid, OpenAI and Stripe) may process data outside the EU/EEA, including in the United States. Where they do, the transfers rely on the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
11. Changes to this policy
We may update this policy when Houzit changes. The date at the top shows the latest version. If a change significantly affects how we use your personal data, we will tell you in the app or by e-mail before it takes effect.
12. Contact
Worldom Ltd.
Vjal Ir-Riħan, Cali House, 3rd Floor, San Ġwann SGN 9020, Malta
E-mail: info@houzit.com