Privacy policy
What we collect, why, for how long, and what you may require of us.
1. Controller
The controller is Res Procuratio Sàrl, Route de Zampillon 12, 1965 Savièse, Switzerland, CHE-248.431.090.
EU and UK representative (Art. 27 GDPR): Prighter Group, reachable via https://app.prighter.com/portal/investpilot-app
Contact for any data protection matter: contact@investpilot.co
We have not appointed a Data Protection Officer, not being required to do so.
2. Data we collect
Account data — email address, password (hashed), language, plan.
Financial profile — the figures you enter to model your capacity: income, outgoings, existing loans, savings, household composition and, on the Complete profile, identity and asset details.
Estimate data — the address of a property, exact or approximate, and its characteristics, such as the number of bedrooms and bathrooms, aspect, balcony or cellar.
Usage data — listings viewed, reports generated, credits consumed.
Billing data — subscription and invoices. Card details are handled by Stripe and do not reach us.
Technical data — logs, IP address, browser, for security and diagnostic purposes.
Your financial profile and the addresses you submit are the most sensitive data you entrust to us. They are used to produce your analyses and for no other purpose. They are not sold, and they are not passed to banks, estate agents or brokers.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: account, analyses, reports, estimates | Performance of the contract |
| Billing, invoicing and accounting obligations | Legal obligation |
| Security, fraud and abuse prevention | Legitimate interest |
| Support and correspondence | Performance of the contract |
| Audience measurement | Consent (cookie banner) |
| Newsletter and product emails | Consent, withdrawable at any time |
| Product improvement | Legitimate interest, on aggregated data |
4. Recipients
We use service providers, and only to the extent required:
- Stripe — payments and subscriptions.
- Hosting, database and deployment providers — operation of the application.
- Property market data providers — we query them. We do not send them your financial profile or your account data.
- Analytics and error monitoring — measuring usage and diagnosing faults.
- Email — transactional messages and, subject to your consent, marketing messages.
We do not sell your data and we do not share it with advertisers. There is no advertising on InvestPilot.
5. Transfers outside the EU
We are established in Switzerland, which the European Commission recognises as providing an adequate level of protection.
Certain providers process data outside the European Union. Where they do, the transfer is covered by an adequacy decision or by standard contractual clauses.
6. Retention
| Data | Active | Then |
|---|---|---|
| Account | Term of the contract | 3 years after last login, then deleted |
| Financial profile | Term of the contract | 5 years after last update, then deleted |
| Estimate data | Term of the contract | 3 years after last update, then deleted |
| Generated reports | While subscribed | 3 years after cancellation, then deleted |
| Invoices and accounting records | While active | 10 years (legal obligation) |
| Technical logs | 30 days | Deleted automatically |
| Error monitoring | 90 days | Deleted automatically |
| Support emails | 2 years after last contact | Deleted |
| Analytics | 14 months | Deleted automatically |
| Marketing consent | Until withdrawn | Record of withdrawal kept 3 years |
These are maximum periods. You may ask us to delete sooner, and we will do so except where the law requires retention.
7. Your rights
You may request a copy of your data, its rectification, its erasure, the restriction of its processing, or its portability. You may object to processing based on legitimate interest. You may withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
Write to contact@investpilot.co. We respond within one month.
If our response does not satisfy you, you may lodge a complaint with the supervisory authority of your country. In Spain, this is the Agencia Española de Protección de Datos (AEPD).
8. Security
Data is encrypted in transit and at rest. Access is restricted to those who require it. Passwords are hashed and never stored in clear text.
In the event of a breach presenting a risk to your rights, we notify the supervisory authority within 72 hours and inform you.
9. Minors
InvestPilot is intended for adults. We do not knowingly collect data from persons under 18. Where we become aware that we have, we delete it.
10. Amendments
Where we amend this policy materially, we notify you before the amendment takes effect.
Last updated : 17 August 2026