Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

This Privacy Policy explains how we collect, use, and protect your personal data when you use our real estate auction aggregator service at lastprice.cc (the "Service"), in accordance with the General Data Protection Regulation (GDPR) and Portuguese data protection law.

2. Data We Collect

2.1 Data You Provide

• Account data: name, email address, and password when you register
• Third-party authentication: name, email, and profile picture if you sign in with Google
• Preferences: saved searches and favorite properties

2.2 Data Collected Automatically

• Server logs: IP address, browser type, pages visited, timestamps
• Session cookies: strictly necessary for authentication (see our Cookie Policy)

3. Legal Bases for Processing

Under Article 6 of the GDPR, we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): processing your account registration, managing saved searches and favorites, and providing the Service
• Consent (Art. 6(1)(a)): non-essential cookies (when applicable) and marketing communications. You can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)): error monitoring, security, preventing abuse, and improving the Service. Our legitimate interest does not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)): complying with applicable laws and regulations

4. Third-Party Services

We use the following third-party services to operate the Service. Each processes data as described:

• Google OAuth (Google LLC, US) — authentication. When you sign in with Google, we receive your name, email, and profile picture.
• Resend (Resend Inc., US) — transactional email delivery (e.g., password resets, email verification). Processes your email address.
• LaunchDarkly (Catamorphic, Co., US) — server-side error monitoring and observability. Processes error logs and request metadata (no personal data is intentionally sent).
• Cloudflare Images (Cloudflare Inc., US) — hosting and serving property images via CDN.
• Google Fonts (Google LLC, US) — web typography. Your IP address is shared with Google when fonts are loaded.
• OpenStreetMap / Leaflet (OpenStreetMap Foundation, UK) — map tiles for property locations. Your IP address is shared when map tiles are loaded.
• Render (Render Inc., US) — hosting infrastructure for the application and database.

We do not sell your personal data to any third party.

5. Cookies

We use strictly necessary cookies for authentication and session management. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

6. Data Retention

We retain your data for the following periods:

• Account data: until you delete your account
• Server logs: 90 days
• Error monitoring data: 30 days
• Session cookies: expire when you close your browser or after the session timeout

When data is no longer needed, it is securely deleted or anonymized.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encrypted data transmission (TLS), secure password hashing, and access controls. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. International Data Transfers

Some of our third-party service providers are based in the United States (Render, Cloudflare, Resend, LaunchDarkly, Google). Your data may be transferred to and processed in the US. These transfers are protected by appropriate safeguards, including the EU-US Data Privacy Framework where applicable, and standard contractual clauses approved by the European Commission.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15): request a copy of your personal data
• Rectification (Art. 16): request correction of inaccurate data
• Erasure (Art. 17): request deletion of your data
• Restriction (Art. 18): request restriction of processing
• Portability (Art. 20): receive your data in a structured, machine-readable format
• Objection (Art. 21): object to processing based on legitimate interest
• Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@lastprice.cc. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. We encourage you to review this page periodically.

11. Contact

For questions about this Privacy Policy or your personal data: