Privacy notice
What we keep, what we don't.
Last updated April 2026. The short version: we only collect what we need to advise you on a property, we don't sell it, and we delete it when the deal closes or you ask.
Who we are
Nathan op Tenerife ("we", "us") is a buyer's-agency operated by Nathan, based in Los Cristianos, Tenerife. We act on behalf of buyers — not sellers, not estate agencies. Contact: hello@nathanop.tenerife.What we collect
- Account: email address + password (hashed), any name you provide.
- Buyer profile: the criteria you enter during onboarding — budget, timeline, regions, property type. You fill these in; we don't infer anything you haven't told us.
- Deal documents: whatever you upload during a deal (passport copy, nota simple, escritura, etc.). Stored encrypted on Supabase Storage.
- Communication: messages you send us through the portal.
- Technical: IP address + browser user-agent on each request, so we can keep the service secure. Not linked to your profile for any other purpose.
Why we collect it
Legal basis under GDPR Art. 6:- Contract performance (Art. 6(1)(b)) — account, profile, documents, messages are needed to deliver buyer-advisory services you've contracted us for.
- Legitimate interest (Art. 6(1)(f)) — IP + user-agent logging for security and abuse prevention.
- Legal obligation (Art. 6(1)(c)) — some records (invoices, AML checks) we're required by Spanish law to retain, regardless of your deletion request, for up to 10 years.
Who we share it with
- Supabaseour database and auth provider (servers in the EU).
- Vercelhosts the website (EU region).
- OpenRouter / Anthropic — we send anonymised property descriptions and photos to language-model providers for valuation analysis. We do not send your personal details (name, email, documents).
- Your solicitor, notary, bank — only with your explicit instruction, on a specific deal.
How long we keep it
- Account + profile: while your account is active, plus 12 months after you ask us to delete it.
- Deal documents: 10 years after deal close, to meet Spanish tax + notary retention rules.
- Chat history with us: 3 years after last message, then purged.
- Server access logs: 90 days, then rotated out.
Your rights
Under GDPR you can ask us to:- See everything we hold about you (SAR)
- Correct anything that's wrong
- Delete your account and data — we'll honour this except where law requires us to retain (see above)
- Export your data to a portable file
- Object to or restrict processing