Privacy Policy

This Policy describes how ByDomu LLC (“Domu”, “we”, “us”) collects, uses, shares and protects the personal data of people who use our website, applications, API and services (collectively, the “Services”). It applies globally and is interpreted alongside any laws applicable to each user, including — without limitation — the GDPR (EU), UK GDPR (United Kingdom), CCPA/CPRA and other U.S. state privacy laws, LGPD (Brazil), PIPEDA (Canada), Colombia Law 1581 of 2012 and Decree 1377 of 2013, LFPDPPP (Mexico), Law 25.326 (Argentina), Law 19.628 (Chile), Law 29.733 (Peru) and other equivalent regulations.

Table of contents

1. Data controller
2. Roles under GDPR and equivalent laws
3. Data we collect
4. Sensitive data and special categories
5. Legal bases for processing
6. How we use the data
7. AI features and automated decisions
8. Who we share data with
9. Subprocessors
10. International data transfers
11. Retention
12. Your rights
13. How to exercise your rights
14. Account and data deletion
15. Cookies and tracking technologies
16. Security
17. Incident notification
18. Children
19. Region-specific notices
20. Changes to this Policy
21. How to contact us

1. Data controller

ByDomu LLC, a company organized under the laws of the State of Delaware, United States.

• Primary operations: Complex Llanogrande, L7 primer piso, Rionegro, Antioquia 050001, Colombia.
• U.S. registered agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.
• Privacy contact: contact@bydomu.com · +57 314 203 1119

EU / UK representative (GDPR Art. 27). When we designate an EU and/or UK representative under GDPR Art. 27, their details will be made available on request by writing to contact@bydomu.com. In the meantime, EU/UK data subjects may exercise their rights by contacting that same address directly.

2. Roles under GDPR and equivalent laws

• Controller: for personal data of users who create accounts on Domu, visit our sites, contact our team or receive communications from us (prospects, newsletter subscribers, event attendees).
• Processor: for Customer Content, i.e., personal data of End Contacts (owners, tenants, buyers, bidders, commercial prospects, etc.) that our customers (real estate agencies and professionals) upload or manage on the platform. In that role, the Customer is the Controller and we process the data solely on their documented instructions and under the Data Processing Agreement (DPA).

3. Data we collect

3.1 Data you give us

• Identification: first and last name, email, phone and, where applicable, government ID.
• Agency / professional data: legal name, tax ID, address, country, website, portal domain, contracted plan and RUT / EIN where required for invoicing.
• Customer Content: properties, contacts, documents, contracts, messages, images, audio and any other content you upload to the platform (processed in our Processor role — see Section 2).
• Payment data: processed directly by our payment providers (Stripe, Wompi). We do not store full card numbers or CVV.
• Communications: support messages, surveys and replies you send us.

3.2 Data collected automatically

• Technical data: IP address, device identifiers, browser, OS, approximate country (IP geolocation), language, timezone.
• Usage data: pages viewed, session times, actions taken, errors and performance metrics.
• Cookies and similar technologies: see Cookie Policy.

3.3 Third-party data

When the Customer enables a supported integration, Domu may receive the data included in that feature from the connected system, such as properties, photographs, contact information and source identifiers. The data actually received depends on the connector and authorized configuration. Importing does not itself establish marketing consent. Domu processes Customer Content under the DPA; disconnection and deletion are separate actions.

• Payment providers: transaction status, fraud signals.
• Messaging providers: delivery, bounce, open, template identifiers.
• Social authentication providers (Google, etc.) when you choose to sign in with them.
• Public data available from lawful sources.

4. Sensitive data and special categories

Domu does not knowingly collect special categories of personal data (sensitive data under Colombia Law 1581 Art. 5; special categories under GDPR Art. 9; sensitive personal information under CPRA), such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, data concerning health, sex life or sexual orientation, nor data of children.

However, Customers may, in the course of their real-estate activity, upload to the Service documents containing sensitive data or personal information of End Contacts (e.g., ID copies, employment certificates, financial data, photographs, data of minors in tenant family groups, medical certificates for accessibility cases). With respect to such content:

• The Customer acts as Controller and is responsible for obtaining the prior, express, specific and informed authorization of the data subject for processing sensitive data where applicable law requires it (Colombia Law 1581 Art. 6; EU GDPR Art. 9(2)(a); Brazil LGPD Art. 11).
• Domu processes such data as Processor, applying enhanced technical and organizational measures (role-based access control, encryption at rest, audit logging) and exclusively to provide the Service to the Customer.
• The Customer undertakes not to upload sensitive data whose processing purpose exceeds authorized real-estate activity, and not to use AI Features on such data where that may contravene applicable law.

5. Legal bases for processing

6. How we use the data

• Create, authenticate and protect your account.
• Operate, maintain, personalize and improve the Services.
• Process payments, subscriptions and invoicing.
• Send operational notifications (verification, plan changes, security alerts, planned maintenance).
• Deliver the AI Features described in Section 7.
• Provide support and handle data-subject requests.
• Detect, prevent and respond to abuse, fraud or security incidents.
• Comply with legal, tax and accounting obligations and respond to competent authorities.
• Perform aggregated and de-identified analysis.

We do not sell or rent your personal data. We do not “share” it for cross-context behavioral advertising in the sense of CPRA.

7. AI features and automated decisions

Domu integrates AI-powered features, including the Noa conversational assistant, auto descriptions, suggestions and matching of End Contacts with properties (the “AI Features”).

Nature of processing. AI Features may include algorithmically generated assessments, recommendations or matches about End Contacts. In such cases, the Customer (the agency) makes the final decision with substantive human review and retains the ability to override the suggestions. However, these algorithmic assessments may influence decisions affecting the End Contact (commercial prioritization, viability as a prospect, etc.).

End Contact rights (GDPR Art. 22, LGPD Art. 20 and equivalents). Where an End Contact is subject to a decision based significantly on automated processing, they have the right to:

• Request human intervention in the decision.
• Express their point of view on the assessment.
• Contest the decision and request review.
• Receive reasonable information about the logic involved, its significance and the envisaged consequences.

These rights are exercised, in the first instance, vis-à-vis the Customer (Controller). Domu will provide the Customer with reasonable technical assistance to respond to such requests.

AI providers. AI Features are delivered through external providers under the commercial terms applicable to their enterprise APIs: Anthropic (Claude models, the main provider); OpenAI (audio transcription, vector embeddings for search, image editing and voice); and DeepInfra and Cloudflare Workers AI, which run alternative and fallback models (currently the team’s internal copilot and market-price search). Each provider receives the content the feature needs to process, which may include contact data and messages, including those received through WhatsApp, Messenger or Instagram. Per those terms and the privacy policies published by such providers:

• Content submitted to their APIs is not used to train their foundation models.
• Providers may temporarily retain content for abuse and security monitoring (typically up to thirty days) before deleting it.
• Customers requiring specific zero data retention configurations or other additional restrictions may contact us to evaluate availability.

Web search. To estimate market prices we use Exa, a web search engine. We only send it queries about the property or the area (property type, operation, city, neighborhood, size and bedrooms); never contact data, messages or data received from Meta. Under its policy, Exa may use those queries to improve its services.

Regulatory flag (EU AI Act). Certain uses may be subject to Regulation (EU) 2024/1689. Where an AI Feature may qualify as a high-risk AI system under Annex III of the EU AI Act, Domu and the Customer will cooperate in good faith to comply with the obligations applicable to their respective roles (provider / deployer).

Google user data (Google API Services)

When you choose to connect your Google account to Domu, we access Google API data only to the extent necessary to provide the features you request. We only request the strictly required scopes:

• Calendar (https://www.googleapis.com/auth/calendar.events): to create, update and delete in your Google Calendar the events for appointments and visits you schedule within Domu, and to detect when those events are cancelled or changed. Domu only manages the events it creates; we do not read, analyze or store the rest of your calendar.
• Basic profile and email (openid, email, profile): to let you sign in with Google and identify your account.

How it is used. This data is used solely to operate the features described above (appointment sync and sign-in). We do not use data obtained from Google APIs for advertising, we do not sell it, and we do not transfer it to third parties except as strictly necessary to provide the feature (e.g., Google’s own infrastructure) or as required by law. We also do not use this data to train artificial intelligence models.

Retention and disconnection. You can disconnect the Google integration at any time from Settings → Integrations within the app. When you disconnect the integration or delete your account, we revoke access and delete the associated Google tokens and data, in line with the retention periods in Section 11.

Limited Use. Domu’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data received from Meta (WhatsApp, Facebook and Instagram)

When an agency connects its WhatsApp number, Facebook Page, Instagram professional account or Meta ad account, we receive from Meta:

• From the person who connects the account: their Meta user ID, the access tokens for the Pages, numbers, Instagram accounts and ad accounts they authorize, and their names.
• From people who message the agency: their profile name, their ID for that Page or account, their WhatsApp number, and the messages and comments they send.
• From ads: the status of the campaigns the agency creates from Domu and their aggregated metrics (spend, impressions, reach, clicks and conversations started).

What it is used for. Only for the features the agency turns on: receiving and answering messages and comments in the inbox, publishing the listings the user chooses, and creating, pausing and measuring its ads. We do not sell this data, use it for our own advertising or build profiles across agencies.

• We do not use it to train artificial intelligence models. The AI providers that process it (Section 7) do not train on what we send them, and we do not send Meta data to Exa.
• We do not use it to decide a person’s eligibility for housing, a rental, credit, employment or insurance. The optional tenant screening uses the ID number the person provides and authorizes us to check; it does not use Meta profiles or messages. Agencies may not use it for that purpose either (Terms, Section 11).

Retention. Tokens are stored encrypted while the connection is active and are deleted immediately when the agency disconnects the account in Settings → Integrations, when the person who connected it removes the app in Facebook or Instagram, or when they ask Meta to delete their data. Messages, comments and contact data are Customer Content: they are kept while the agency has its account and for up to thirty (30) days after (rotating backups up to 90 days), unless their deletion is requested earlier.

Deletion. Instructions are at bydomu.com/en/data-deletion and in Section 14.4.

8. Who we share data with

• Subprocessors providing infrastructure, payments, messaging, AI and complementary services (see Section 9).
• Professional advisors: lawyers, auditors, accountants, subject to confidentiality.
• Authorities: when required by applicable law, valid judicial or administrative order, or to protect the rights, safety or property of Domu, the Customer or third parties.
• Corporate transactions: in a merger, acquisition, financing, restructuring or sale of assets, data may be transferred to the successor under this same Policy. We will notify data subjects by email and/or prominent notice before the transfer takes effect.

9. Subprocessors

We maintain an up-to-date list of subprocessors. As of the effective date of this Policy, the main ones are:

We will notify material changes to the subprocessor list at least fifteen (15) days in advance, giving the Customer the option to object before the new subprocessor begins processing their data. If the Customer reasonably objects, the parties will negotiate in good faith; failing that, the Customer may terminate the contract with a pro rata refund of unused prepaid fees.

10. International data transfers

We operate globally and process data primarily in the United States, supported by subprocessors in the EU and Latin America. When we transfer personal data outside the data subject’s jurisdiction, we rely on appropriate legal mechanisms based on the origin:

• From the EEA and United Kingdom:
  • EU–US Data Privacy Framework (DPF) for certified U.S. subprocessors (including, to date, AWS, Vercel, Stripe; verifiable at dataprivacyframework.gov).
  • Standard Contractual Clauses (SCCs) approved by the European Commission for non-certified providers, supplemented by post-Schrems II transfer impact assessments (TIAs) and additional technical measures.
  • UK International Data Transfer Addendum for transfers from the United Kingdom.
  • Adequacy decisions where available.
• From Colombia: declaration of conformity and mechanisms set out in SIC External Circular 005 of 2017, supplemented by the data subject’s authorization where applicable under Decree 1377 of 2013.
• From Brazil: equivalent safeguards under Art. 33 LGPD (SCCs, standard clauses or ANPD authorization as appropriate).
• From Mexico, Argentina, Chile and Peru: equivalent mechanisms under local law.

You may request a copy of the clauses or mechanisms applicable to your transfer by writing to contact@bydomu.com.

11. Retention

The periods above are maximum retention objectives, not automatic deletion dates. Irreversible deletion or anonymization is carried out upon a valid erasure request or during our periodic retention reviews, once the applicable period has elapsed and provided there is no legal basis to keep the data.

Retention periods may be extended where applicable law requires longer retention, where litigation is pending or upon a valid request from a competent authority.

12. Your rights

Subject to applicable law, data subjects have the right to:

• Access their data and information about the processing.
• Rectification of inaccurate or incomplete data.
• Erasure / deletion when there is no legal basis to retain the data.
• Restriction and objection to processing based on legitimate interest or direct marketing.
• Portability in a structured, commonly used, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Not be subject to automated decisions with legal or significant effects without human intervention (GDPR Art. 22, LGPD Art. 20 and equivalents).
• Non-discrimination for exercising rights (CCPA/CPRA).
• Opt-out of sale or “sharing” (CCPA/CPRA): Domu does not sell or share for cross-context behavioral advertising.
• Lodge a complaint with a supervisory authority — your national DPA in the EEA/UK; the SIC in Colombia; the ANPD in Brazil; the INAI in Mexico; the AAIP in Argentina; your state Attorney General in the U.S.; and equivalent authorities.

13. How to exercise your rights

To exercise any of the above rights, write to contact@bydomu.com with the subject “Privacy Request” and your applicable jurisdiction.

We may ask for reasonable additional information to verify identity. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request, explaining the decision.

Response timelines:

• GDPR / UK GDPR: one (1) month, extendable by two additional months for complex requests (Art. 12.3).
• CCPA / CPRA: forty-five (45) days, extendable by an additional forty-five.
• Colombia Law 1581 of 2012: ten (10) business days for queries and fifteen (15) for claims, extendable by eight additional days (Decree 1377 Arts. 14–15).
• LGPD (Brazil): fifteen (15) days for immediate responses, extendable.
• Other jurisdictions: deadlines under local law.

If you act as an End Contact (i.e., your data was uploaded by a Domu customer, not by you directly), your request will first be directed to the Customer as Controller. If you do not obtain a satisfactory response, Domu will technically assist the Customer or, ultimately, handle the request directly where required by law.

14. Account and data deletion

You may delete your Domu account and all associated personal data at any time. This section describes the procedure and applies to accounts created with email, social sign-in (Google, Apple, Facebook) or the WhatsApp Business integration. The procedure implements the erasure / cancellation rights set out in Section 12 and enables Domu to fulfill its Processor obligations under the DPA.

14.1 How to request deletion

1. Email contact@bydomu.com from the address used to register, with the subject line “Account and data deletion”.
2. Indicate the email or phone associated with the account and, where applicable, the name of your organization / agency.
3. We will verify your identity (we may ask for one additional data point to prevent impersonation; see Section 13) and process the request within the deadlines applicable to your jurisdiction — by default, thirty (30) calendar days, subject to the specific deadlines of Decree 1377 (Colombia), GDPR, CCPA and other applicable laws described in Section 13.
4. Once processed, you will receive a confirmation email indicating what was deleted, what is retained due to legal obligations (see Section 14.2) and the deletion timeline for rotating backups (up to 90 days).

Alternatively, you may delete your account from Settings → Account → Delete account in the application, when available for your plan and role. In-app deletion triggers the same workflow described above.

14.2 What is deleted and what is retained

• Deleted: your account and profile data, Customer Content (properties, contacts, documents, contracts, messages, images, audio), integration tokens (Meta/WhatsApp, Google, MLS, etc.), active sessions, preferences and associated AI Feature records.
• Retained only where required by law: billing and tax-supporting records (up to 10 years, per Section 11), strictly necessary security and anti-fraud logs (up to 12 months), consent records (subscription term + 5 years for burden of proof), and pseudonymized or aggregated data that no longer identifies you.
• Rotating backup copies are overwritten within a maximum of ninety (90) days after the request.
• Electronic signature evidence is retained while the signed document remains hosted on the Services, plus ten (10) years, per Section 11.

14.3 If you are an End Contact

If your data was uploaded by an agency that uses Domu (you are their customer, owner or tenant), that agency is the Controller per Section 2. Address your deletion request to that agency first. If you do not obtain a response within a reasonable time, we can assist — write to contact@bydomu.com with the subject “Account and data deletion”: we will redirect the request to the Controller and, ultimately, handle it directly where law requires.

14.4 Specific deletion of Meta data (WhatsApp / Facebook / Instagram)

To request the deletion of data received through Meta (WhatsApp Business, Facebook, Instagram) without deleting the rest of your account, write to contact@bydomu.com with the subject “Meta data deletion” indicating the WhatsApp number, Facebook page ID or Instagram username. We will process the request within thirty (30) days. If Meta notifies us via a Data Deletion Callback for your account, we will delete the associated information with no further request needed. Full instructions (disconnect in Domu, remove the app in Facebook or Instagram, or email support) are at bydomu.com/en/data-deletion.

14.5 Effects of deletion

Account deletion is irreversible and entails:

• Termination of access to the Services and revocation of access for your Authorized Users.
• Cancellation of the active subscription at the end of the current billing period. The annual modality does not give rise to a partial refund except as provided in Section 4.6 of the Terms.
• Inability to recover Customer Content after the backup periods described in Section 14.2.

15. Cookies and tracking technologies

We use strictly necessary cookies for session and security, and optional cookies for analytics and product improvement. You can manage your preferences from the cookie banner or your browser settings. More details in our Cookie Policy.

Global Privacy Control (GPC). We honor Global Privacy Control signals sent by your browser as a valid opt-out of sale / sharing under CCPA/CPRA and, where applicable, as a refusal of non-necessary cookies.

16. Security

We implement reasonable technical and organizational measures to protect personal data:

• Encryption in transit (TLS 1.2+) and at rest where applicable.
• Role-based access control (RBAC) and least privilege.
• Password hashing (Argon2 / bcrypt).
• Automated, encrypted backups.
• Monitoring, alerting, audit logging and periodic vendor reviews.
• Environment segregation (production / staging / development).
• Security testing, code reviews and vulnerability management.

No system is completely infallible. Effective protection also depends on your practices: keep a strong password, enable multi-factor authentication when available and notify us immediately of any unauthorized access.

17. Incident notification

In the event of a security incident affecting personal data:

• When Domu acts as Controller: we will notify data subjects and authorities without undue delay and within the deadlines required by applicable law (72 hours to the authority under GDPR; without undue delay to the SIC under External Circular 002 of 2018; equivalent deadlines in other jurisdictions).
• When Domu acts as Processor: we will notify the Customer (Controller) without undue delay after becoming aware of the incident, per GDPR Art. 33(2) and the DPA, providing reasonable information to enable the Customer to comply with its own notification obligations.

The notification will include, as applicable, the nature of the incident, the categories and approximate volume of data subjects and records affected, the likely consequences and the measures taken or proposed to mitigate it.

18. Children

The Services are intended for users 18 and older. We do not knowingly collect personal data of children under 13 (COPPA, US) or under the higher digital consent age set by applicable law (default 16 under GDPR, with variations by Member State between 13 and 16; 14 in Colombia for the Services).

If we learn that we have collected personal data of a minor without the required legal authorization, we will delete it. If you believe a minor has provided us with data, contact contact@bydomu.com.

Customers who upload data of minors as part of Customer Content (e.g., minor members of a tenant family group) are responsible for obtaining the legal guardian’s authorization and for informing the data subject as required by applicable law.

19. Region-specific notices

European Economic Area and United Kingdom (GDPR / UK GDPR)

You have the right to lodge a complaint with the supervisory authority of your country of residence. When designated, the EU / UK representative under Art. 27 will be made available on request as described in Section 1.

United States — California (CCPA / CPRA)

In the past twelve months we collected the following categories of personal information: identifiers, commercial information, internet or network information (technical and usage data) and approximate geolocation information. We do not sell or share personal information as defined under the CPRA. California residents have the right to know, delete, correct, limit the use of sensitive personal information, opt out of sale or “sharing”, and not be discriminated against for exercising rights. You may designate an authorized agent to submit requests on your behalf.

Other U.S. state privacy laws

We honor equivalent rights established by applicable U.S. state privacy laws, including, without limitation: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa (ICDPA), Indiana, Tennessee (TIPA), Texas (TDPSA), Florida (FDBR), Montana (MCDPA), Oregon (OCPA), Delaware (DPDPA), New Hampshire, New Jersey (NJDPA), Maryland (MODPA), Minnesota, Rhode Island and other equivalent laws that come into effect.

Colombia (Law 1581 of 2012 / Decree 1377 of 2013)

We respond to data-subject requests within the timelines of Decree 1377 (queries: 10 business days + 5; claims: 15 business days + 8). You may file complaints with the Superintendence of Industry and Commerce (SIC) via www.sic.gov.co. Sensitive data requires prior, express, specific and informed authorization under Art. 6 of Law 1581. International transfers are carried out under SIC External Circular 005 of 2017.

Brazil (LGPD)

We honor data-subject rights under Art. 18 of the LGPD. Competent authority: ANPD (www.gov.br/anpd). International transfers under Art. 33 LGPD.

Mexico (LFPDPPP)

We recognize ARCO rights (Access, Rectification, Cancellation, Objection) and the right to withdraw consent. Competent authority: INAI (home.inai.org.mx).

Argentina (Law 25.326)

Competent authority: Agencia de Acceso a la Información Pública (AAIP) (www.argentina.gob.ar/aaip).

Chile (Law 19.628), Peru (Law 29.733)

We honor equivalent rights before the respective data protection authorities (Consejo para la Transparencia / future Agency under the new Chilean law; National Authority for the Protection of Personal Data in Peru).

20. Changes to this Policy

We may update this Policy to reflect legal, technical or Service changes. The current version will be posted at www.bydomu.com/legal/privacidad with its effective date. Material changes will be notified by email or a prominent notice in the Services at least fifteen (15) days in advance. Continued use of the Services after the effective date implies acceptance of the new version.

21. How to contact us

ByDomu LLC
Complex Llanogrande, L7 primer piso, Rionegro, Antioquia, Colombia
U.S. registered agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.
Email: contact@bydomu.com
Phone: +57 314 203 1119

For formal data-subject rights requests, please add “Privacy Request” to the subject line along with your jurisdiction.