Privacy Policy

This Privacy Policy explains how we collect, use and protect personal data when you visit our website, join our waitlist, or use the Marta service.

We take privacy seriously for two groups of people: our customers (tenants looking for a home in Spain) and the landlords and agents we contact on our customers’ behalf. This policy covers both.

1. Who we are

Data controller: SteelKiwi Inc. 160 Greentree Drive, Suite 101 Dover, DE 19904, USA

Email: privacy@callmarta.com Website: https://callmarta.com

We operate the Marta service (“Marta”, “we”, “us”, “our”) from the United States. We offer the service to people located in Spain and elsewhere in the European Economic Area, and we therefore apply the standards of Regulation (EU) 2016/679 (GDPR) to that processing, alongside applicable United States law.

All enquiries about privacy and all requests concerning your personal data should be sent to privacy@callmarta.com.

2. What Marta does, in privacy terms

Marta is a service that calls landlords and estate agents on behalf of a tenant, using an AI voice assistant supported by a human team. To do this we:

• collect information about you (the tenant) and your search;
• collect the contact details published in the property listings you send us, or that we find for you;
• place phone calls in Spanish on your behalf, disclosing at the start of the call that the caller is an AI assistant acting for you;
• record and/or transcribe those calls so we can report the outcome back to you and improve service quality;
• report results to you and, where you ask us to, add confirmed viewings to your calendar.

3. Data we collect

3.1 Website visitors and waitlist

• Email address
• City / area you are searching in
• Move-in date or timeline
• Budget range
• Your main difficulty in the search (free text)
• Whether you are renting or buying
• Technical data: IP address, browser and device type, pages viewed, referring source (see Section 11 on cookies)

3.2 Customers

• Name, email, phone number, and (where relevant) messaging handle (e.g. Telegram)
• Search criteria: area, price range, number of rooms, move-in date, pets, parking, etc.
• Tenant qualification information you choose to give us so we can present you well to a landlord — for example employment status, type of contract, proof of income (nóminas), willingness to take rent-default insurance (seguro de impago), guarantor availability
• Documents you choose to upload to your account, filed by type: payslips, an employment contract, bank statements, a tax return, a passport or national ID, a NIE/TIE or residence permit, a landlord reference, a guarantor’s documents, a pet passport, a mortgage pre-approval, proof of funds, and anything you add under “other” with your own one-line description. Uploading is optional. An identity document is held only to pass on to a landlord or agent who asks for it, and is never used to verify you ourselves.
• Property listings you send us (links, reference numbers)
• Records of calls made for you: outcomes, notes, transcripts and, where applicable, recordings
• Appointment details, and calendar access if you connect a calendar
• Payment data: we use a third-party payment provider. We never see or store your full card number. We keep the transaction reference, amount, date and billing details required for invoicing.

We ask you not to send us special category data (health, religion, political opinions, trade union membership, etc.). We do not need it and do not want it.

3.3 Landlords, estate agents and other call recipients

When we call about a property, we process:

• the phone number published in the listing;
• the name of the person or agency, where published or given during the call;
• the listing reference and property details;
• the content of the call: availability, requirements, viewing times, and similar;
• a recording and/or transcript of the call.

Source of this data: public property listings on portals such as Idealista, Fotocasa, Habitaclia and pisos.com, or listings supplied directly by our customer. We collect this information on a per-request basis, for the specific search of a specific customer. We do not build or sell a general database of landlord contacts.

3.4 Connected calendars (Google Calendar, Microsoft Outlook)

Connecting a calendar is optional and happens only when you click “Connect” on the Calendar page of your account and grant access on Google’s or Microsoft’s own consent screen. When you do, we use that access for two purposes only:

• To add your viewings to your calendar. For each viewing booked for you, we create an event in your primary calendar with the address, time, the agent’s name and phone number, and a link to the listing in your account. We update or delete that event if the viewing changes or is cancelled. We only ever change or delete events that Marta created; your other events are never modified.
• To avoid booking viewings when you are busy. We read the start time, end time and title of the events in your primary calendar for the next 45 days. Events marked as “free”, cancelled events and invitations you declined are ignored. We do not read event descriptions, attendees, attachments or locations. You see your own events next to your viewings in your account. Our team, who help schedule viewings, see only that you are “busy” during a period — never what the event is.

We keep only the latest copy of those start times, end times and titles, replacing it on every sync, together with the access token your calendar provider issued, which is stored encrypted. When you disconnect your calendar, we remove the upcoming viewing events we created, revoke our access with the provider and delete the calendar data we hold. You can also revoke access at any time from your Google Account (Security → Third-party access) or your Microsoft account.

Calendar data is used only to provide this feature to you. It is not sold, not shared with landlords or agents, not used for advertising, and not used to train AI or machine-learning models.

Google user data. Marta’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Why we use your data, and our legal basis

Purpose	Data	Legal basis
Managing the waitlist and telling you when we launch in your city	Waitlist form data	Consent (Art. 6(1)(a)) — withdrawable at any time
Providing the service: calling, qualifying, booking viewings, reporting	Customer and search data	Performance of a contract (Art. 6(1)(b))
Presenting you to a landlord as a reliable tenant	Qualification data	Performance of a contract; your explicit instruction
Contacting landlords and agents about a specific listing	Landlord/agent data	Legitimate interests (Art. 6(1)(f)) — responding to a public rental advertisement on behalf of an identified prospective tenant
Recording calls for outcome reporting, dispute resolution and quality	Call audio/transcripts	Legitimate interests (Art. 6(1)(f)); see Section 5
Billing, accounting and tax	Transaction and invoice data	Legal obligation (Art. 6(1)(c))
Service emails (results, receipts, support)	Contact data	Performance of a contract
Marketing emails to existing customers about similar services	Email	Legitimate interests / Art. 21(2) LSSI — opt-out in every message
Security, fraud and abuse prevention	Technical logs	Legitimate interests
Improving prompts, scripts and quality of the assistant	Aggregated or anonymised call data	Legitimate interests

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for a summary of that assessment, and you can object at any time (Section 9).

5. Calls and call recordings

This section matters, so we set it out plainly.

• AI disclosure. At the start of every call, the assistant identifies itself as an AI assistant acting on behalf of a named prospective tenant. We do not hide this, and we do not claim to be a human.
• We are a party to the call. The call is made on behalf of our customer, who is the interested tenant.
• Recording. Calls may be recorded and transcribed so that we can report the outcome to our customer accurately, resolve disputes about what was agreed, and maintain quality. Where required, the recipient is informed at the start of the call and may ask us not to record or to end the call.
• Retention. Audio recordings are kept for 30 days and then deleted. Transcripts and structured outcome notes are kept for 12 months.
• No sale of data. We do not sell, rent or share call data or landlord contact details with third parties for their own marketing.
• Opting out. A landlord or agent who does not wish to be contacted again can tell the assistant during the call, or email us at privacy@callmarta.com. We will add the number to an internal suppression list and will not call or message it again on behalf of any customer. The suppression list stores only the number and the date of the request.

6. Who we share data with

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

We use a small number of service providers who process data only on our documented instructions, under written data processing agreements, and only for the purposes described in this policy. They fall into the following categories:

• Telephony and voice technology — connecting calls, speech synthesis and recognition, transcription
• Language model providers — structuring and summarising the outcome of a call
• Hosting and workflow infrastructure — running our website and internal automation
• Listing data retrieval — obtaining publicly advertised property details
• Encrypted file storage — an object-storage provider holding the documents you upload, in encrypted form only; the key stays with us, so the provider cannot read them
• Payment processing — handled by a PCI-DSS compliant provider; we never receive your full card number
• Email and messaging delivery — sending reports, receipts and service notices, including viewing confirmations sent over WhatsApp (operated by Meta Platforms), which contain the appointment details and the contact name and phone number each party needs to reach the other
• Calendar services — only where you choose to connect a calendar
• Analytics and advertising measurement — see Section 11

We also work with human assistants and contractors who may review a call, or take over a conversation where the assistant cannot handle it. They are bound by confidentiality obligations and act on our instructions.

AI providers and your connected calendar. Our language-model and voice providers process call transcripts and the profile details you enter in the app. They do not receive data from a calendar you connect (Google Calendar or Microsoft Outlook). From your calendar we read the times of your existing events so that we never propose a viewing when you are busy, and we write the viewings we book into it; event titles are shown only to you, on your own calendar page, and are not shared with our staff or any third party. The only calendar-derived information that leaves our systems is the set of busy time intervals (start and end times, nothing else), passed to our voice provider as a scheduling constraint. No data obtained from Google Workspace or Microsoft APIs is used, transferred or sold to create, train or improve any machine-learning or AI model, whether ours or a third party’s. Our AI providers are integrated directly through their own APIs, under terms that prohibit training on our data.

We may disclose data where required by law, court order, or a valid request from a competent authority, and in connection with a merger, acquisition or sale of assets, in which case we will notify affected users.

7. International transfers

We are established in the United States, and several of our service providers are as well. This means that personal data collected in connection with the service — including data about landlords and agents we call on a customer’s behalf — is transferred to and stored in the United States.

Where we transfer personal data out of the European Economic Area, we rely on one or more of the following safeguards:

• the European Commission’s Standard Contractual Clauses (Decision 2021/914), incorporated into our customer terms and into our agreements with providers;
• certification under the EU–US Data Privacy Framework, where the provider concerned is certified;
• supplementary technical and organisational measures, including encryption in transit, access control and minimisation of what is transferred.

You can request a copy of the relevant safeguards at privacy@callmarta.com.

8. How long we keep data

Data	Retention
Waitlist entries	Until you unsubscribe, or 24 months of inactivity
Customer account and search data	Duration of the service + 12 months
Documents you uploaded	Until you delete them, and at the latest 90 days after your search ends
Connected calendar data (event times and titles, access token)	Replaced on every sync; deleted when you disconnect the calendar or close your account
Call recordings	30 days
Call transcripts and outcome notes	12 months
Invoices and accounting records	As required by applicable tax and accounting law (typically up to 7 years)
Suppression list (“do not call”)	Indefinitely, as this is the only way to honour the request
Website analytics	14 months

After these periods, data is deleted or irreversibly anonymised.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing
• Portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interests, including direct marketing
• Withdraw consent at any time, without affecting processing carried out before withdrawal

To exercise any of these, email privacy@callmarta.com with enough detail for us to identify you. We reply within one month. We may ask for proof of identity where the request is not obviously from you.

If you are not satisfied, you may complain to the supervisory authority in the EU country where you live, work, or where the issue arose. If you are in Spain, that is the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).

Landlords and agents: these rights apply to you too. If you received a call from Marta and want to know what we hold, have it deleted, or never be called again, write to privacy@callmarta.com with the phone number concerned.

10. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit, encryption at rest for the documents you upload (each file is encrypted before it is stored and decrypted only when a person on our team opens it or it is sent at a landlord’s request), access control on a need-to-know basis, restricted and logged access to recordings and documents, contractual confidentiality for staff and contractors, and regular review of our providers. No system is perfectly secure, but we treat call data and uploaded documents as sensitive and handle them accordingly. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the AEPD as required by Articles 33–34 GDPR.

11. Cookies and analytics

We use:

• Strictly necessary cookies — required for the site to function. No consent needed.
• Analytics — a privacy-friendly analytics tool to understand how the site is used.
• Advertising and measurement — to measure the effectiveness of our campaigns and show relevant ads.

Analytics and advertising cookies are set by default, and you can turn them off in the cookie banner at any time. You can change your choice at any time via the “Cookies” link at the bottom of every page, and you can block cookies in your browser settings.

12. Automated decision-making

The AI assistant conducts conversations and structures their outcomes. It does not make decisions that produce legal effects or similarly significantly affect you. Decisions about which properties to pursue, and whether to accept a viewing, are made by you. A human on our team reviews problematic calls and can take over a conversation.

13. United States residents

If you are a resident of California or another US state with a comprehensive privacy law, you may have the right to know what personal information we collect and for what purpose, to request deletion or correction, and to opt out of the sale or sharing of personal information for cross-context behavioural advertising.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. To exercise any other right, email privacy@callmarta.com. We will not discriminate against you for doing so.

14. Children

Our service is not directed at people under 18, and we do not knowingly collect their data.

15. Changes to this policy

We may update this policy. The current version is always at https://callmarta.com/privacy/ with the date of the last update at the top. If we make a material change, we will notify customers by email.

16. Contact

Questions about this policy or how we handle data: privacy@callmarta.com