Last updated: August 26, 2026
Growth Estate
1. Who the controller is
Growth Estate is an AI-powered real estate marketing agency. We are the controller of the personal data collected through this website and through the contact channels we link to from it (forms, email, WhatsApp and the AI demos).
You can reach us about any privacy matter at the email address at the end of this policy. We have not appointed a Data Protection Officer: given the volume and nature of our processing this is not mandatory, so requests are handled directly by the team.
2. Scope of this policy
This policy is global. It covers anyone who interacts with us, wherever they live, and describes a single set of processing practices for everyone.
Different regions grant different rights on top of that. Section 10 sets out the additional rights you have depending on where you are: the European Union and United Kingdom (GDPR and UK GDPR), Spain (LOPDGDD), California (CCPA/CPRA), Brazil (LGPD), the Dominican Republic (Law 172-13), Mexico (LFPDPPP), Canada (PIPEDA) and other jurisdictions with equivalent laws.
Where your local law grants you a broader right than the one described here, local law prevails. We never ask you to waive a right in order to use the site.
3. What data we collect
We only collect what we need to reply to you, deliver the service and understand which content works. We do not buy data lists and we do not enrich your profile from external sources.
- Data you give us: name, email, phone, company and whatever you write in a contact form, in the chat or over WhatsApp.
- AI demo data: if you start the live demo, the phone number and email you provide, plus the content of the WhatsApp conversation, the recording and transcript of the voice call, and the generated email. See section 13.
- Technical browsing data: IP address (truncated or handled as an identifier by our analytics providers), device and browser type, language, operating system, pages viewed, time on page and the site you arrived from.
- Advertising attribution data: UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the Google click identifier (gclid), the Meta click identifier (fbclid) and the landing page. These are stored in your browser and attached to the form if you contact us, so we know which ad or article produced the enquiry.
- Local preferences: light/dark theme and interface state, stored in your own browser and never sent to our servers.
We do not collect special categories of data (health, ethnic origin, beliefs, sexual orientation, biometrics for identification) or payment details through this site. If you send them to us unprompted in a free-text message, we delete them as soon as we notice.
4. What we use it for, and on what legal basis
Every processing activity has a specific purpose and a legal basis. In the EU, the UK and equivalent jurisdictions, those bases are the ones in GDPR Art. 6.
- Replying to your enquiry and providing a quote or diagnosis — basis: pre-contractual steps taken at your request (Art. 6(1)(b)) or our legitimate interest in responding to people who contact us (Art. 6(1)(f)).
- Delivering the contracted service and managing the commercial relationship — basis: performance of a contract (Art. 6(1)(b)).
- Running the AI demo you explicitly request (WhatsApp, voice call and email) — basis: your consent, given when you start the demo with your details (Art. 6(1)(a)).
- Sending you content and marketing communications — basis: your consent, or our legitimate interest in direct marketing to existing customers about similar services. You can unsubscribe from any message, at no cost and without giving a reason.
- Measuring audience, site performance and the effectiveness of our ads — basis: your consent for non-essential cookies and technologies; legitimate interest for aggregate statistics that cannot identify you.
- Security, abuse prevention and rate limiting — basis: our legitimate interest in protecting the infrastructure and its users (Art. 6(1)(f)).
- Meeting legal, accounting and tax obligations, and responding to lawful requests from authorities — basis: legal obligation (Art. 6(1)(c)).
Where the basis is consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
6. Who we share it with
We do not sell personal data. We do not hand it to third parties for their own marketing either.
It is processed on our behalf by the providers we need in order to operate, each bound by a data processing agreement and limited to our documented instructions:
| Provider | Purpose | Where |
|---|---|---|
| Vercel | Site hosting, audience analytics and speed metrics | US / global |
| Google (Analytics, Tag Manager, Ads) | Audience analytics and ad conversion measurement | US / global |
| Meta Platforms | Conversion measurement for Facebook and Instagram ads | US / global |
| Resend | Sending the notification email when you submit a form | US / EU |
| FlowEstate | Our own CRM, where the enquiry is logged and followed up | US / global |
| Supabase | Database holding the state of the AI demo | US / EU |
| Kapso | Sending and receiving the demo's WhatsApp messages | US / global |
| Vapi | Orchestrating the demo's AI voice call | US |
| ElevenLabs | Synthesising the voice you hear on that call | US |
| WhatsApp / Meta | Carrying the messages when you write to us on WhatsApp | US / global |
We may also disclose data to legal or accounting advisers bound by professional secrecy, to authorities where a law or order requires it, and to an acquirer in the event of a merger or sale of the business — in that last case we would notify you before your data became subject to a different policy.
7. International transfers
We work with clients and providers in several countries, so your data may be processed outside your country of residence, including in the United States.
When we transfer data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with the supplementary technical and organisational measures identified by our transfer impact assessment. Several of our US providers are additionally certified under the EU–US Data Privacy Framework.
You can request a copy of the safeguards in place by emailing us at the contact address.
8. How long we keep it
We keep each piece of data only for as long as it serves the purpose it was collected for, then delete or anonymise it.
- Enquiries that do not become customers: up to 24 months from the last interaction, so we can pick the conversation back up.
- Customers: for the duration of the contract, then for the limitation period for legal claims and the applicable tax obligations, which in most of the jurisdictions we operate in is 5 to 10 years.
- AI demo data, including recordings and transcripts: 90 days from the demo run.
- Content subscribers: until you unsubscribe, then the minimum record of the opt-out so we do not email you again.
- Analytics: up to 14 months in Google Analytics; aggregate data that no longer identifies you is kept indefinitely.
- Technical and security logs: up to 12 months.
9. How we protect it
We apply technical and organisational measures proportionate to the risk: encryption in transit (TLS) across the site and our API calls, encryption at rest in our providers' databases, role-restricted access and two-factor authentication on every tool holding personal data, and cryptographic signing on the demo's approval links so they cannot be replayed or forged.
No system is infallible. If a security breach occurs that presents a high risk to your rights, we will notify you and report it to the supervisory authority within the deadlines set by the applicable law — 72 hours under the GDPR.
10. Your rights
Wherever you live, you can ask us for access to your data, its correction, its deletion, and to stop sending you marketing. On top of that, depending on your region:
- European Union, United Kingdom, Switzerland and Spain: access, rectification, erasure, restriction of processing, portability, objection (including objection to direct marketing, which is unconditional) and not to be subject to automated decisions with legal effects. You may complain to your supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).
- California: to know what categories of data we collect, sell or share, to access it, delete it, correct it, limit the use of sensitive information, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not sell the information of anyone under 16.
- Brazil: confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about who we share with, and withdrawal of consent (LGPD Art. 18). You may complain to the ANPD.
- Dominican Republic: rights of access, rectification, cancellation and objection under Law 172-13 on the Protection of Personal Data.
- Mexico: ARCO rights — access, rectification, cancellation and objection — and withdrawal of consent, under the LFPDPPP.
- Canada: access to your data and the ability to challenge its accuracy under PIPEDA.
- Other jurisdictions (Argentina, Chile, Colombia, Peru, Panama, Costa Rica, Honduras, Australia, Japan, among others): the equivalent rights granted by your local law.
11. How to exercise your rights
Email us at the contact address stating which right you want to exercise and over which data. No specific form is needed and you do not have to justify the request.
We respond within 30 calendar days at the latest. If the request is complex, or we receive many, we may extend that by as long as your applicable law permits, telling you before the original deadline expires.
We will only ask for extra information where it is strictly necessary to verify that you are who you say you are, and that information is used solely for verification and deleted afterwards. You may act through an authorised agent where your law allows it; we will ask for proof of the authorisation.
Exercising these rights is free. We would only charge a reasonable fee for manifestly unfounded or excessive requests, in particular repetitive ones.
12. Children
This site is aimed at real estate professionals and businesses. It is not intended for anyone under 16 and we do not knowingly collect children's data.
If you believe a child has given us data, email us and we will delete it.
13. The live AI demo
Our demo shows, live, how an AI agent works a lead. It is the part of the site that processes the most data, so we explain it separately.
The demo only runs if you start it and enter your own contact details. In doing so you expressly consent to an automated system messaging you on WhatsApp, calling you with a synthetic voice and emailing you.
The voice call is AI-generated. We tell you so at the start of the call: you are not speaking to a person. The call is recorded and transcribed so the result can be shown to you in the demo console.
No demo fires on its own: every request goes through human approval before the first message is sent.
You can ask us at any time to delete the full record of your demo — messages, recording, transcript and email — without waiting for the 90-day retention period to elapse.
14. Automated decisions
We use AI to draft message copy, prioritise incoming enquiries and run the demo described above.
We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you. Every meaningful commercial decision — who we contact, what we quote, whether we take a project — is made by a person.
15. Third-party links and content
The site links to external platforms such as LinkedIn, Instagram, WhatsApp and our clients' websites. When you follow one of those links you move to a privacy policy we do not control.
This policy only covers what happens on grwestate.com and on the channels we operate ourselves.
16. Changes to this policy
We may update this policy when our services, our providers or the applicable rules change. The last-updated date always appears at the top of the page.
If a change is material and significantly affects you, we will tell you through an appropriate channel before it takes effect, and where the law requires it we will ask for your consent again.
Questions about your data?
Email us and we'll answer. If you're exercising a privacy right, say so in the subject line so we can prioritise it.
bryan@grwestate.com