Privacy Policy

Last updated: October 21, 2026

1. Data Controller

The controller of the personal data collected through the Ryflux platform is Ryflux (hereinafter "we" or "Ryflux"). For any questions related to data protection, you may contact our Data Protection Officer (DPO) via the email [email protected].

2. Personal Data Collected

As part of your use of the platform, we may collect and process the following personal data:

  • Identification data: full name, email address, phone number.
  • Professional data: AMI license number (Portugal) or CRECI (Brazil), associated real estate agency.
  • Location preferences: geographic zones of interest for buying, selling, or renting properties.
  • Property data: features, photographs, prices, and conditions of properties listed on the platform.
  • Commercial terms: commission and sharing terms between agents.
  • Usage data: access logs, actions on the platform, and session data.
  • Link security identifiers: when you open a link sent through Ryflux (a visit request, feedback, a proposal, a deal confirmation, among others), we record an irreversible fingerprint (hash) of the network you opened it from and a random browser identifier, never the IP address itself. They are used solely to stop whoever sends a link from answering it on behalf of the person who received it, on the basis of our legitimate interest in preventing fraud.

3. Processing Purposes

Personal data is processed for the following purposes:

  • Automatic matching: correspondence between buyer clients and properties available on the network.
  • Notifications: sending alerts about new matches, visit requests, and deal updates.
  • Scoring and classification: evaluation of match quality and prioritization of results.
  • Analytics and statistics: generation of aggregated reports on platform activity.
  • Contract management: billing, subscription management, and customer support.

4. Legal Bases for Processing

The processing of your personal data is based on the following legal grounds, as applicable:

  • Contract performance: processing necessary for providing the contracted services (account creation, matching, deal management).
  • Consent: where applicable, for marketing communications and optional features.
  • Legitimate interest: platform improvement, fraud prevention, and system security.
  • Legal obligation: compliance with applicable tax and regulatory obligations.

5. Rights of Data Subjects

Under the General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD), you have the right to:

  • Access: obtain confirmation as to whether your data is being processed and access such data.
  • Rectification: request the correction of inaccurate or incomplete data.
  • Erasure: request the deletion of your personal data, where applicable.
  • Portability: receive your data in a structured and machine-readable format.
  • Restriction: request the restriction of processing of your data in certain circumstances.
  • Objection: object to the processing of your data based on legitimate interest.

To exercise any of these rights, contact us via [email protected]. You also have the right to lodge a complaint with the competent supervisory authority (CNPD in Portugal or ANPD in Brazil).

6. Data Retention Periods

  • Session data: 30 days after last activity.
  • Deal records: 7 years for users in Portugal (tax obligations) and 5 years for users in Brazil (legal obligations).
  • Account data: retained until deletion of the account by the user or until a deletion request is made.
  • Link security identifiers: 180 days after the link was last used.

7. International Data Transfers

The Ryflux platform uses Cloudflare infrastructure, which may involve processing data on servers located in different jurisdictions. Transfers between the European Union and Brazil are carried out under adequacy decisions and standard contractual clauses, in accordance with the GDPR and LGPD.

8. Subprocessors (Data Processors)

We use the following service providers that may process personal data on our behalf:

  • Cloudflare: infrastructure, CDN, and security.
  • Stripe: payment processing and billing.
  • Resend: transactional email and notifications delivery.

All subprocessors are bound by data processing agreements that ensure adequate levels of protection.

9. Cookies

The Ryflux platform exclusively uses a strictly necessary session cookie for the functioning of the service (authentication and session maintenance). This cookie does not collect data for marketing or tracking purposes. No third-party cookies, analytics cookies, or advertising cookies are used.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS), access controls, and continuous monitoring.

11. Changes to this Policy

We reserve the right to update this privacy policy at any time. Changes will be published on this page with the revised update date. We recommend periodically reviewing this page.

12. Contact

For any questions about this policy or the processing of your personal data, contact our Data Protection Officer: [email protected].