Terms of use

1. What CasaPrivat is

CasaPrivat is a listing website and a software tool that home owners use themselves to sell their own home. CasaPrivat is not an estate agent, broker or intermediary (agent immobilier, agente inmobiliario). We do not search for buyers on your behalf under a mandate, we do not negotiate, we do not represent the seller or the buyer, and we never represent both sides.

2. No commission, no success fee

Publishing a listing is free. CasaPrivat takes no commission and no fee that depends on whether the home is sold or on its price. If paid options are offered in the future, they will be fixed prices for a specific service, announced in advance, never a percentage or a success fee.

3. No client money

CasaPrivat never receives, holds or transfers deposits, the purchase price or any other money between seller and buyer. Payments are made through the notary or directly between the parties, as you agree in the contracts you sign.

4. Owner responsibilities

As the owner you are responsible for: being the owner or having the consent of all co-owners; the accuracy of all information, including the energy label (Spain: RD 390/2021) or DPE (France), the Géorisques information, Carrez area and co-ownership details; having the right to publish the photos; answering buyers, organising viewings, deciding on offers, and choosing and working with the notary; taxes and costs of the sale. You confirm each step yourself before it takes effect. You post on other portals yourself, from your own account and under their rules.

5. Buyers and their agents

Messages from buyers, including requests sent by AI agents through our MCP endpoint, are passed to the owner. They create no booking, offer or contract. CasaPrivat does not check the identity or financing of buyers.

6. Fraud warning

Never pay a deposit or any money before a viewing, and never to a private account on request by message. Be careful with listings far below market price, with owners who cannot show the home, and with requests to move the conversation elsewhere quickly. CasaPrivat never asks anyone for money for a home. Report suspicious listings with the “Report this listing” link on each listing (see section 10).

7. Open data

Published listings (without the street address, the owner's name or email) are available to everyone free of charge on the website, in the JSON feed and through MCP. We do not sell lists of properties or access to a database.

8. Personal data and how long we keep it

The controller of personal data is Nukehive OÜ (details in section 9). We process: the owner's name, email and listing data; messages and viewing requests from buyers, which are passed to the owner of the home they write to; and, if you create an account: your email address (when you sign in by email link or Google), the public key of your passkey (your fingerprint, face or PIN never leave your device), your sessions (we store only a hash of the session cookie and the browser name), a sign-in log (time, method, success, country, browser, IP address) and a customer activity log (sign-ins and key actions such as listing created, edited, published or withdrawn, buyer message received, reply draft saved, data downloaded). Requests from apps and AI agents to the JSON feed, the API and MCP are only counted, without IP addresses or personal data. Sign-in works with a passkey, Google or a one-time email link; there are no passwords. Retention: IP addresses in the logs 90 days, then erased; sign-in log 12 months; sessions 30 days; email log (what kind of email was sent and when, without its content) 400 days; buyer messages and reply drafts 12 months; accounts not used for 24 months are deleted after a warning email. Customer activity log 12 months; request statistics 90 days. Reports about listings, including the name and email of the person who reports, 12 months after our decision; our decisions about a listing (statement of reasons) as long as the listing exists, then deleted with it. We keep personal data no longer than necessary for these purposes (GDPR art. 5(1)(e)). Legal bases (GDPR art. 6(1)): for listings, your account, sign-in, sessions, passkeys and sign-in emails, the performance of our contract with you (point (b)); for buyer messages and viewing requests, including those sent through MCP, the consent given in the form (point (a)), which can be withdrawn at any time by writing to info@casaprivat.com without affecting messages already passed on; for the sign-in log, the email log, sending limits and the customer activity log, our legitimate interest in keeping accounts secure and preventing abuse and fraud (point (f)); for handling reports about listings and giving reasons for our decisions, our legal obligation under the Digital Services Act, Regulation (EU) 2022/2065, arts. 16 and 17 (point (c)); for handling requests to access, export or delete data, our legal obligation under the GDPR (point (c)). We use no analytics or marketing tools and set only the cookies needed for sign-in and the chosen language. In My account you can download your data as a JSON file (GDPR art. 15 and 20) and delete your account yourself (art. 17); deletion removes your listings, photos, buyer messages, reply drafts, decisions about your listings and activity log, and removes your name, email and IP address from the sign-in log. Recipients and transfers outside the EU: the site, its database and photo storage run on Cloudflare (Cloudflare, Inc., San Francisco, USA), which acts as our processor. The database (Cloudflare D1) and photo storage (Cloudflare R2) are restricted to the EU jurisdiction, so the data in them is stored in the European Union; requests to the site are handled in Cloudflare's global network. Sign-in emails are sent from noreply@login.casaprivat.com through Resend (Plus Five Five, Inc., San Francisco, USA), also our processor; Resend receives your email address and the content of the sign-in email and processes them mainly in the United States. For transfers to the USA, both companies use the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and both are certified under the EU-U.S. Data Privacy Framework (dataprivacyframework.gov, checked on 31 October 2026). Sources: cloudflare.com/cloudflare-customer-dpa, resend.com/legal/dpa, resend.com/legal/subprocessors. If you sign in with Google, Google confirms your Google account ID, email address and name to us; Google handles your sign-in under its own privacy policy (policies.google.com/privacy). Questions and requests about your data: info@casaprivat.com.

9. Operator

CasaPrivat is operated by Nukehive OÜ, a private limited company (osaühing) registered in the Estonian e-Business Register, registry code 14647290, registered address Masina tn 20, 10113 Tallinn, Estonia. The company is not VAT-registered. Publication director: Sulev Seppik. Contact: info@casaprivat.com. Applicable law and courts: these terms are governed by Estonian law. If you are a consumer, this choice does not deprive you of the protection of the mandatory rules of the country where you have your habitual residence (Rome I Regulation (EC) No 593/2008, art. 6(2)). If you are a consumer living in the EU, you may bring proceedings against us in the courts of Estonia or of the country where you live, and we may bring proceedings against you only in the courts of the country where you live (Brussels I bis Regulation (EU) No 1215/2012, art. 18).

10. Notices and removals

Anyone can tell us about a listing they consider illegal or contrary to these terms with the “Report this listing” link on each listing or on the page /en/report. Please give the exact web address (URL) of the listing, explain why you consider the content illegal, give your name and email, and confirm that you believe in good faith that your report is accurate and complete (Digital Services Act, Regulation (EU) 2022/2065, art. 16). If the report concerns child sexual abuse material, you do not have to give your name or email. After you send the report you see a confirmation on screen with a reference number and a private link where you can follow its status and read our decision. We do not send emails about reports.

A person at CasaPrivat reviews every report; we do not use automated tools to detect content or to take decisions. We handle reports in a timely, diligent, non-arbitrary and objective manner. We may keep the listing, restrict it (it no longer appears in search results, lists, the feed, the API or MCP, but its own address still works) or remove it. We may also act on our own initiative when a listing breaks the law or these terms (sections 4 and 6). If we restrict or remove a listing, we give the owner a statement of reasons (art. 17) in My account and on the page of the listing, with the facts, the legal or contractual ground and the ways to challenge the decision.

If you disagree with our decision, whether you sent the report or own the listing, write to info@casaprivat.com within six months and give the reference number (N-… or D-…). A person reviews the decision again and we tell you the result. You can also go to court (section 9) and lodge a complaint with the Digital Services Coordinator of the EU country where you live or are established (art. 53).

If we become aware of information that gives rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform the law enforcement or judicial authorities of the EU country concerned or, if we cannot tell which country that is, the Estonian authorities or Europol (art. 18). If a life is in danger, call 112 first.

Single point of contact (arts. 11 and 12): authorities of the Member States, the European Commission, the European Board for Digital Services and users of the service can contact us directly at info@casaprivat.com. You can write in English, Estonian, Spanish or French. A person reads every message; replies are not automated.