How PropBot handles your data

PropBot ("we", "us") is the 24/7 WhatsApp property assistant operated by Synaptica Consulting. PropBot acts on behalf of property owners and agencies ("owners") to qualify rental leads in WhatsApp groups they already belong to.

This policy explains what data we process, why, and the rights you have. It covers two groups of people: owners who sign up to use PropBot, and renters who exchange messages with a PropBot-assisted owner account.

When you sign up with Google, we receive the email address and profile name Google shares with us. We create an owner record scoped to your account.

You provide property details (location, price, amenities, photos), reference contract Q&A, and your tone-of-voice preferences. You connect your own WhatsApp number by scanning a QR code; the WhatsApp session stays on our hosting and is treated as a secret.

Billing is handled by Stripe. We store your Stripe customer ID and subscription status; we never see or store your full card number — that stays with Stripe.

When a renter posts in a monitored group or replies to a PropBot-assisted owner account, PropBot reads the message, the sender's WhatsApp name and phone number, and any media the owner chooses to surface (property photos the owner uploaded).

We store the conversation — messages, intent, qualification slots (budget, dates, area), and handoff notes — so the owner can follow up and so PropBot stays consistent across turns. Conversations are scoped to the owner whose account handled them.

The landing page lets visitors leave an email and city to be notified about early access. We store only that email and optional city — no account, no message content — and use it solely to send launch updates. You can request removal at any time.

Before booking a demo, visitors go through an 11-question assessment: role, market, portfolio size, monthly enquiries, response speed, primary gap, missed opportunities, deal value, decision role, and timeline. We use these answers to understand whether PropBot fits your business and to prepare a relevant demo — we do not use them for advertising profiling.

If you request a demo we also collect the contact details you give us: name, email, phone, company, and company website.

We record which step of the assessment you reach and where you stop (funnel/abandonment events), and we capture standard marketing attribution when present in the URL or referrer — UTM parameters, fbclid, gclid, and the referring page — so we know which channel a lead came from. This attribution data is tied to the assessment submission, not to anonymous browsing.

The assessment funnel uses three identifiers stored only in your own browser, never sent to Meta or any advertiser:

`propbot_private_visitor_id` — stored in localStorage, persists across visits so we can reconnect an abandoned assessment if you come back. `propbot_private_session_id` and `propbot_private_session_token` — stored in sessionStorage, scoped to one funnel run, used to authenticate your in-progress assessment answers to our backend and cleared when you close the tab.

These are functional identifiers, not advertising cookies — they exist to make the assessment work (resume progress, prevent tampering with your own answers) and are covered by legitimate interest, not the consent banner's "marketing" category. You can delete them at any time by clearing your browser's site data for propbot.synapticacnsltg.com, which simply means a resumed assessment will start over.

When you book a demo, the scheduling step is handled by Cal.com. We pass your name, email, and the assessment context needed to prepare for the call; Cal.com processes the booking (date, time, calendar invite) under its own privacy policy — see cal.com/privacy.

We do not send your assessment answers to Cal.com beyond what is needed to identify and prepare for your booking.

We use the Meta Pixel and Meta Conversions API on the public landing page to measure whether Meta ads lead to visits, signups, and purchases, and to improve campaign delivery. This only runs after you accept the "marketing" category in the cookie banner described below.

For this measurement we may share limited event data with Meta: email address hashed with SHA-256 when available, IP address, browser user agent, and Meta click or browser identifiers such as fbclid, _fbp, and _fbc. We do not send message content or property-owner documents for advertising measurement.

We also use Vercel Analytics and Vercel Speed Insights to measure aggregate page views and site performance (load times, Core Web Vitals). These run under the "analytics" category, use privacy-preserving aggregate measurement rather than individual ad-tech cookies, and never leave Vercel's infrastructure.

You can accept or reject each category independently in the cookie banner (see "Cookies and consent" below), or object at any time by adjusting your choice there, using your browser's privacy controls, or adjusting your Meta ad preferences. You can also contact privacy@propbot.app for help with a data request.

On first visit we show a cookie banner with three choices: Accept all, Reject non-essential, or Preferences (to pick categories individually). Essential functionality (like the local identifiers above) always runs; analytics and marketing only run after you accept them.

Your choice is stored in your browser's localStorage as `propbot_consent_v1` and respected on every later visit until you change it. You can change or withdraw your consent at any time from the same banner, reachable from the footer of any page.

To operate the service: connect WhatsApp, answer renters on the owner's behalf, qualify leads, and hand off to the owner.

To bill for the service through Stripe and keep subscription state.

To improve PropBot's responses for the owner whose data it is. We do not train foundation models on your conversations.

To evaluate and follow up on demo requests from the assessment funnel, and to schedule the demo you asked for.

Owner account data, billing, and the WhatsApp connection: processed to perform our contract with you.

Renter conversation data: processed on the owner's behalf, under our contract with the owner, and under the owner's own legitimate interest in qualifying leads in groups they participate in.

Assessment answers and demo contact details: processed based on your consent when you submit the assessment, and subsequently under contract once a demo or subscription is agreed.

Functional local identifiers (visitor/session IDs): legitimate interest — the assessment cannot function without them.

Meta Pixel advertising measurement and Vercel Analytics: consent, collected through the cookie banner described above. Security logging and fraud prevention: legitimate interest.

Each owner sees only their own data. Row-level security in our database enforces owner scoping; renter conversations are visible only to the owner whose account handled them.

Sub-processors: Anthropic (conversation reasoning), Supabase (database and storage, as our processor), Stripe (billing and payments, as our processor), Vercel (web hosting and analytics), Railway (backend hosting), Cal.com (demo scheduling), Meta (advertising measurement, only with consent). Each processes data only to deliver the service or, for Meta, only after you accept the marketing cookie category.

We do not sell data. We do not share renter conversations with other owners.

Some sub-processors above (including Anthropic, Stripe, and Vercel) may process data outside the European Economic Area, principally in the United States. Where that happens we rely on their Standard Contractual Clauses or an equivalent recognized transfer mechanism to keep your data protected to EU standards.

Owner data and conversations are kept while the subscription is active and for up to 30 days after cancellation to allow for export or reinstatement, then deleted unless retention is required by law.

Waitlist emails are kept until you ask us to remove them or until we stop operating the waitlist.

Assessment answers and demo contact details are kept for up to 24 months from your last interaction, or until you become a subscribed owner (after which owner-data retention applies) or ask us to delete them sooner.

The `propbot_private_visitor_id` local identifier persists in your browser until you clear site data or it expires (12 months); the session identifiers are cleared when you close the tab or finish the assessment.

Internal endpoints are authenticated. Owner-scoped data is protected by row-level security. WhatsApp auth state is treated as a secret and never logged. Payment integrity is enforced with idempotent, atomic Stripe webhooks.

No system is perfectly secure. If a breach occurs we will notify affected owners without undue delay.

If you are in the EEA, UK, or another jurisdiction with similar data-protection law, you have the right to: access the personal data we hold about you; correct (rectify) inaccurate data; request erasure ("right to be forgotten"); receive a portable copy of data you gave us; object to processing based on legitimate interest; restrict processing in certain cases; and withdraw consent at any time for anything based on consent (this does not affect processing done before withdrawal).

Owners and renters can request access to, correction of, or deletion of their personal data, and can object to or restrict certain processing. Renters should contact the owner whose account they messaged first; owners, demo requesters, and assessment visitors can contact us directly.

To exercise a right, email privacy@propbot.app. We respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

Questions about this policy or data requests: privacy@propbot.app.

Operator: Synaptica Consulting ([[TO CONFIRM: registered address and VAT/company registration number — see /terms for the same placeholder]]). This policy may change; we will update the "last updated" date above when it does.