Privacy Policy

2The personal data we collect

We collect the following categories of personal data.

2.1 Information you provide to us

• Account and profile data — name, email address, phone number, job title or role, profile photo, and the agency you belong to.
• Authentication data — credentials used to sign in to your account, managed through our secure identity infrastructure.
• Agency and subscription data — agency name, branding, subdomain, plan and subscription details.
• Billing data — information required to process payments. Card and payment-instrument details are collected and processed by our payment provider (see Section 6); we do not store full card numbers on our systems.
• Support and communications data — information you share when you contact us, request support, or respond to surveys.

2.2 Data from connected messaging channels (Meta platforms)

When an agency connects its Facebook Page, Instagram professional account, and/or WhatsApp Business account to Homespot, we receive and process data exchanged through those channels so the agency can manage conversations from a single inbox. This includes:

• the content of messages sent to or from the connected account (text, images, files and other media);
• the sender's name and profile information as made available to us by the platform;
• platform-assigned identifiers (such as page-scoped or app-scoped user IDs) used to associate messages with a conversation;
• timestamps and message metadata.

This data is received through the official Meta APIs and webhooks and is processed on behalf of the connected agency (our processor role), in line with our agreement with the agency and with Meta's Platform Terms and policies. We only use this data to provide the messaging and CRM features of the Service, and never to build advertising profiles or for any purpose not described in this Policy.

You can request deletion of data we hold that originated from these channels at any time — see Section 10 and our Data Deletion page.

2.3 Contact, lead and listing data processed on behalf of agencies

On the instructions of subscribing agencies, we process data the agency collects about its contacts, leads and clients (for example contact details, property preferences, interaction history and notes), and data about property listings the agency manages. As noted in Section 1, the agency is the controller of this data.

2.4 Calendar and scheduling data

If a user connects a Google Calendar account, we process the calendar data needed to schedule and display meetings and appointments within the Service, in accordance with the permissions granted at the time of connection.

2.5 Information we collect automatically

When you use the Service or visit our websites, we may automatically collect:

• Technical data — IP address, device type, browser, operating system, and language settings.
• Usage data — pages and features viewed, actions taken, and the dates and times of access.
• Cookies and similar technologies — see Section 5.

We do not intentionally collect special categories of personal data (such as data revealing health, religious beliefs or political opinions) and ask that you do not submit such data through the Service unless strictly necessary and lawful.

3How and why we use personal data, and our legal bases

We use personal data for the purposes below. Where Homespot is the controller, we rely on the legal bases indicated.

Where we process data as a processor on behalf of an agency, we do so only on that agency's documented instructions and for the purposes the agency has determined.

We will only send you commercial or marketing messages where we have a lawful basis to do so, and you can opt out at any time using the unsubscribe link or by contacting us.

4Cookies and similar technologies

Our websites and the Service use cookies and similar technologies to keep you signed in, remember your preferences, keep the Service secure, and understand how the Service is used.

• Strictly necessary cookies are required for the Service to function (for example, authentication and security).
• Functional cookies remember your settings.
• Analytics cookies help us understand usage so we can improve the Service.

Where required by law, we ask for your consent before setting non-essential cookies, and you can manage your preferences through our cookie banner or your browser settings.

5How we share personal data

We do not sell personal data. We share personal data only as described below.

• With the relevant agency. Where we act as a processor, the controlling agency has access to the data we process on its behalf.
• With service providers (sub-processors) who process data on our behalf under appropriate contractual safeguards. Our key providers include:
  • Amazon Web Services (AWS) — cloud hosting, databases, file storage and message queuing.
  • Meta Platforms (Facebook, Instagram, WhatsApp) — to receive and send messages through connected channels.
  • Google — calendar integration, where enabled by the user.
  • Flitt — payment processing.
  • Email / notification provider, if any — to send transactional emails and notifications.
• With professional advisers, auditors and authorities where necessary to comply with law, enforce our terms, or protect our rights, users or the public.
• In connection with a corporate transaction such as a merger, acquisition or sale of assets, subject to appropriate confidentiality protections.

A current list of our sub-processors is available on request at contact@homespot.ge. We require all sub-processors to provide an adequate level of data protection.

6International data transfers

The Service is operated using cloud infrastructure that may store and process personal data outside Georgia. Where personal data is transferred outside Georgia, we take steps to ensure it remains protected to a standard consistent with the Law of Georgia on Personal Data Protection, including by using providers that offer appropriate safeguards and by entering into appropriate contractual protections where required.

You may contact us for more information about the safeguards applied to international transfers.

7How long we keep personal data

We retain personal data only for as long as necessary for the purposes set out in this Policy, including:

• Account data — for the duration of your account and for a reasonable period afterwards.
• Messaging and CRM data processed on behalf of agencies — for as long as the agency maintains its account and instructs us to retain it, after which it is deleted or returned in accordance with our agreement with the agency.
• Billing and transaction records — for the period required by applicable Georgian accounting and tax law.
• Technical and usage logs — for a limited period for security, troubleshooting and analytics.

When personal data is no longer required, we delete it or irreversibly anonymise it. Specific retention periods are available on request.

8How we protect personal data

We implement appropriate technical and organisational measures to protect personal data, including:

• encryption in transit using TLS/HTTPS;
• encryption at rest of stored data;
• role-based access controls and authentication, so that staff and users can access only the data they need;
• hosting within secure, access-controlled cloud infrastructure;
• logging and monitoring to detect and respond to security events.

No system is completely secure, but we work continuously to protect personal data and to limit the risk of unauthorised access, loss or misuse. In the event of a personal data breach, we will act in accordance with our legal obligations, including notifying the supervisory authority and affected individuals where required.

9Your rights

Subject to the conditions and exceptions in the Law of Georgia on Personal Data Protection, you have the right to:

• be informed about how your data is processed;
• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• request erasure ("right to be forgotten");
• request restriction of processing;
• object to certain processing, including direct marketing;
• request data portability;
• withdraw consent at any time, where processing is based on consent (this does not affect processing carried out before withdrawal); and
• lodge a complaint with the supervisory authority.

To exercise your rights where Homespot is the controller, contact us at contact@homespot.ge. Where your data is processed by an agency through Homespot (our processor role), please direct your request to that agency, and we will assist them as required.

We will respond to requests within the timeframes required by law. We may need to verify your identity before acting on a request.

If you have connected a messaging channel or your data was received through one, you can request deletion of that data via our Data Deletion page.

10Children's privacy

The Service is intended for businesses and professional users and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at contact@homespot.ge and we will take appropriate steps to delete it.

11Third-party services and links

The Service integrates with third-party platforms (such as Meta and Google) and our websites may link to third-party sites. Those third parties process data under their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policies of any third-party services you use, including Meta's and Google's.

12Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Service or by other reasonable means. We encourage you to review this Policy periodically.

13How to contact us

If you are not satisfied with how we have handled your personal data, you have the right to contact the supervisory authority: