1. About Realization
Realization is operated by Realization Unipessoal LDA (NIPC 517298961), a real-estate mediation company licensed by IMPIC under AMI licence 25459. It is the data controller for personal data processed through realization.pt.
2. What data we collect
We collect the following categories of personal data:
- Account data — name, email address, role (owner or investor)
- Property data — addresses, cadastral references, property documents, photographs
- Financial data — transaction references (processed by Stripe; we never see or store card numbers)
- Communications — deal room messages, AI conversation transcripts
- Technical data — IP address, browser type, access timestamps
2a. Waiting list
If you join our waiting list, we store your email address, whether you are an owner, investor or professional, your preferred language, and — only if you provide them — your name and municipality, together with the date and wording of your consent.
- Purpose — to tell you when Realization opens and when we can take on your case. Nothing else.
- Legal basis — your consent (GDPR Art. 6(1)(a)), confirmed through the link we email you. Unconfirmed sign-ups are not contacted again.
- Leaving — every email we send contains a link to leave the list, which takes effect immediately. You can also write to privacy@realization.pt.
- Retention — until you leave the list or until 12 months after we open, whichever comes first. We keep a record that you left, so we do not contact you again.
- Processors — Supabase (database, EU region) and Resend (email delivery). Rate-limiting uses a one-way hash of your IP address; the address itself is not stored.
3. How we use your data
- To provide and operate the platform services
- To process transactions via Stripe
- To generate AI-assisted analysis (professional solution paths, match scoring)
- To communicate about your account and deal status
- To comply with legal obligations, including AMI regulatory requirements
4. Legal basis
We process your data under the following legal bases as defined by the General Data Protection Regulation (GDPR):
- Contract performance — necessary to deliver services you have requested
- Legal obligation — AMI licensing requirements and Portuguese real estate law
- Legitimate interest — platform security, fraud prevention, service improvement
- Consent — for the waiting list and any marketing communications (when applicable)
5. Data storage and security
All data is stored in the European Union (Supabase, Ireland — eu-west-1 region). We use encryption in transit (TLS) and at rest. File uploads are stored in private buckets with signed-URL access that expires after 5 minutes. Passwords are hashed with bcrypt.
6. Third-party processors
- Supabase (EU) — database, authentication, file storage
- Vercel (EU-restricted) — hosting and deployment
- Stripe (EU) — payment processing
- Google (EU) — AI model inference (Gemini)
- Resend — transactional email delivery
7. Your rights
Under GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure of your data
- Restrict or object to processing
- Data portability (receive your data in a structured format)
- Withdraw consent at any time
To exercise any of these rights, contact us at privacy@realization.pt.
8. Data retention
We retain your data for as long as your account is active or as needed to provide services. Property and deal data is retained for the duration required by Portuguese real estate law and AMI regulatory requirements (typically 5 years after deal completion). You may request deletion at any time, subject to legal retention obligations.
9. Cookies
We use only essential cookies: to keep you signed in and to remember your language. We do not use analytics, advertising or tracking cookies. We measure use of the service with our own server-side records, which do not use cookies. You can clear cookies at any time in your browser settings.