Privacy Policy
Dernière modification: 27th March 2026
Introduction
At Trackstone, protecting your personal data is a priority and one of our core values.
The purpose of this privacy policy is to inform you about how we process your personal data in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "GDPR").
1. Who are we?
Trackstone is a simplified joint-stock company (société par actions simplifiée) with variable share capital of €1,331.26, registered office at 19 Quai de rive neuve, 13007 Marseille, registered in the Marseille Trade and Companies Register under number 893 431 585, represented by Mr. Florent Vaudelin in his capacity as Chairman ("Trackstone").
Trackstone has developed a platform (the "Platform"), accessible at https://www.trackstone.fr/ (the "Site"), enabling its users to search for, buy, and sell tenanted real estate properties for rental investment.
You can contact Trackstone by email at: contact@trackstone.fr.
2. What is personal data?
When you use the Trackstone website (the "Site"), we may ask you to provide personal data about yourself in order to use our services.
Personal data means any information relating to an identified or identifiable natural person — for example, your name, postal or email address, or indirectly, a user identifier, IP address, browsing data, etc.
3. Who is the data controller?
The data controller is Trackstone, a simplified joint-stock company registered in the Marseille Trade and Companies Register under number 893 431 585, with its registered office at 19 Quai de rive neuve, 13007 Marseille (hereinafter "we" or "us").
4. What data do we collect and under what circumstances?
As part of our business, we collect certain information about you. This information falls into the following categories:
- Identification data (including your name, email address, postal address, and phone number)
- Connection data (e.g. IP address, logs)
- Data relating to your prospecting requests (including your name, email address, and sale address)
- Data relating to your investments
When you upload the documents relating to your property to the document library of your seller area (title deed, identity document, technical diagnostics, condominium minutes and bylaws, property tax notice, calls for funds and charges, leases and rent receipts, etc.), we collect the data contained in those documents:
- Seller identity data (your identity document may include your photograph, the document number, and your date and place of birth);
- Asset and financial data relating to the property (price, property tax, charges);
- Data concerning third parties appearing in the documents (co-owners named in general meeting minutes, tenants mentioned in leases and rent receipts, the notary, the managing agent).
The documents required to list the property for sale are clearly indicated to you at the time of upload.
This data may be collected when you log in to our Site and when you use our Services.
For clarity, mandatory fields are clearly indicated when you provide your data.
5. Use of your personal data
On what legal basis is your data collected and used?
Contract:
This processing is necessary to perform the contract entered into when you use our Services on our Platform.
Legitimate interest:
When you voluntarily provide personal data, we collect it to better respond to your information requests on our Site.
Legal obligation:
When processing your data is necessary to comply with a legal obligation to which we are subject.
Summary table of the purposes for which Trackstone collects and processes your personal data, along with the corresponding legal basis:
| Purpose | Legal Basis |
|---|---|
| Creating your user account on the Platform | Performance of the contract binding you to Trackstone (i.e. the Platform's terms of use) |
| Sending the newsletter | Your consent |
| Responding to your information requests | Trackstone's legitimate interest in maintaining its service |
| Handling requests to exercise your rights | Legal obligation |
| Handling account deletion requests | Performance of the contract binding you to Trackstone (i.e. the Platform's terms of use) |
| Platform maintenance | Trackstone's legitimate interest in maintaining the Platform |
| Receiving and storing the property documents uploaded to the seller area | Performance of the contract binding you to Trackstone (i.e. the sale mandate) |
| Verifying your identity as a seller | Legal obligation (anti-money-laundering obligations applicable to our activity as a real estate agent) |
| Automatic classification of documents and metadata extraction (see the dedicated section on automated processing) | Trackstone's legitimate interest in organising and ensuring the reliability of the processing of sale files |
| Making the documents available to our team in charge of the sale | Performance of the contract (sale mandate) |
| Sharing documents with qualified buyers, under access control and traceability | Trackstone's legitimate interest in seeing the transaction through to completion |
6. Who receives your data?
The following parties will have access to some of your personal data, solely for the purposes of the processing described in this policy:
(i) Our team,
(ii) Our sub-processors: hosting provider (Google Cloud Platform, EU), audience measurement and analytics provider (Google LLC / Google Analytics, United States), in-app messaging and communication provider (Customer.io, United States), product analytics and session recording provider (PostHog Inc., United States), newsletter provider, CRM tool, customer support tool provider, error tracking tool (Functional Software Inc. / Sentry, United States), SMS verification provider (Twilio Inc., United States), authentication provider (Google LLC / Firebase, United States), mapping provider (Google LLC / Google Maps, United States), customer review provider (Trustpilot A/S, Denmark), bot protection provider (Google LLC / reCAPTCHA, United States),
(iii) Public and private bodies, solely to meet our legal obligations.
This also includes legal auxiliaries (bailiffs, notaries, etc.), ministerial officers, and debt-collection agencies.
For the seller area's document library, the following parties will also have access to your data:
(i) Our team in charge of the sale, on a restricted and logged-access basis;
(ii) Where applicable, qualified buyers, according to defined access rules limited to the documents that are necessary;
(iii) Our artificial intelligence providers handling the processing of documents (currently Google / Gemini and Mistral AI), as well as our hosting provider (Google Cloud, European Union).
Your personal data will never be sold, rented, or exchanged with third parties.
7. For what purposes is your data collected and used?
- To provide the services available on our Site
- To maintain a database of users, subscribers, and prospects
- To manage the customer relationship and respond to information requests
- To send newsletters, solicitations, and promotional messages
- To personalize responses to your information requests
- To comply with the legal obligations applicable to our business
- To handle requests to exercise your rights
8. How long do we keep your personal data?
Data collected to provide our services on the Site
Your data is kept for the duration of your account plus a further 3 years from the date your account is deleted.
Data collected to manage the customer relationship, conduct prospecting, and develop and promote our business
Data is kept for the duration of the commercial relationship and deleted 3 years after that relationship ends.
Data collected for prospecting purposes
Data is kept for 3 years from your last contact with us.
Data needed for legal and evidentiary purposes
Data is archived for evidentiary purposes for 5 years. Invoices and mandates are archived for 10 years.
When you exercise your rights
If we ask you for proof of identity: we keep it only for as long as is necessary to verify your identity. If you exercise your right to object to prospecting: we keep that information for 3 years.
Documents uploaded to the seller area
The documents relating to your property and the associated metadata are kept for as long as is necessary for the sale. Thereafter, they are kept in accordance with our legal and professional obligations: mandates are archived for 10 years, and documents needed for legal and evidentiary purposes are archived for 5 years. The raw text extracted from the documents is not retained: only the description and metadata produced by the automated processing are stored.
9. Cookie and tracker policy
What is a cookie or tracker?
A cookie is a small text file that is downloaded to your computer when you visit certain websites. It allows a website to recognize a user's computer. Cookies help users navigate websites more efficiently, enable certain features, and provide information to website owners.
Cookies are the most widely used tracking technology, but other technologies also exist for analyzing a user's connections. These are collectively called "trackers" (local storage, local shared objects, etc.).
Which cookies and trackers are used on the Site?
The list below sets out the cookies and trackers used on the Site, together with their purpose and retention period:
| Cookie / Tracker | Purpose / Data Collected | Retention Period | Legal Basis |
|---|---|---|---|
| Sentry | Error tracking, performance monitoring, and crash detection for the Platform. Data collected: error traces, browser information, IP address, user identifier, email address. Sub-processor: Functional Software Inc. (United States), covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. | 90 days | Trackstone's legitimate interest in ensuring the security and proper operation of the Platform (Article 6(1)(f) GDPR, Recital 49) |
| Axeptio | Stores your cookie preferences and consent choices. | 12 months | Trackstone's legitimate interest in recording your cookie choices |
| trackstoneutk | Tracks visitor identity on Trackstone. Contains an opaque identifier representing the current visitor. | 6 months | Trackstone's legitimate interest |
| Intercom | Live chat widget and customer messaging. | 9 months | Your consent |
| Customer.io | Audience measurement and personalized in-app messaging. | 12 months | Your consent |
| Google Analytics | Audience measurement and website analytics. | 13 months | Your consent |
| PostHog | Audience measurement, product analytics, session recording | 12 months (events); 30 days (session recordings) | Your consent |
| Google conversion Linker | Links Google Ads conversions and audiences across browsing sessions. | 90 days | Your consent |
| Google Ads | Tracks Google Ads conversions and builds remarketing audiences. | 90 days | Your consent |
| Facebook Pixel | Tracks Facebook Ads conversions and builds remarketing audiences. | 3 months | Your consent |
| HubSpot | Customer relationship management and conversion tracking. | 13 months | Your consent |
| Google reCAPTCHA v3 | Bot protection and fraudulent form submission prevention. Data collected: risk score, action type, IP address. Sub-processor: Google LLC (United States). | Session duration | Trackstone's legitimate interest in ensuring the security of the Platform |
| Google Maps | Map display and property location visualization. Data collected: map interactions, geolocation data. Sub-processor: Google LLC (United States). | Session duration | Performance of the contract |
| Trustpilot | Display of customer reviews and trust ratings. Data collected: business identifier, widget interactions. Sub-processor: Trustpilot A/S (Denmark). | 180 days | Trackstone's legitimate interest in displaying its reputation |
| Twilio Verify | Phone number verification via SMS during registration. Data collected: phone number, verification code. Sub-processor: Twilio Inc. (United States). | Duration of verification | Performance of the contract |
| Firebase Authentication | User authentication and session management. Data collected: user identifier, authentication token. Sub-processor: Google LLC (United States). | Session duration | Performance of the contract |
The retention period for data collected through cookies varies but does not exceed 13 months. Data collected is not sold to third parties or used for any other purpose. Personal data collected via cookies may be retained for a maximum of 25 months, after which it will be deleted.
How do I block or delete cookies?
Your web browser may allow you to block or delete cookies placed by the Site. The Help function of your browser should explain how to do this. Alternatively, you can visit www.allaboutcookies.org, which provides general information about cookies and how to manage them on your computer.
Please note that if you delete a cookie or object to cookies being placed on your device, you may not be able to access certain services on the Site and the Platform.
10. Security and Hosting
We (and our sub-processors) have taken all necessary precautions and appropriate organizational and technical measures to protect the security, integrity, and confidentiality of your personal data.
Your data is hosted and retained for the duration of its processing on Google Cloud Platform servers located within the European Union.
11. Transfers outside the European Union
Although your data is hosted within the European Union (see Section 10), some of our sub-processors (see the section "Who receives your data?") may process or access your data from countries outside the European Union, including the United States, in the context of specific services (error tracking, SMS verification, customer support, conversion tracking, audience measurement and product analytics). These transfers are secured by the following means:
- The EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), where the sub-processor is certified under this framework;
- Standard contractual clauses between a data controller and a data processor approved by the European Commission (Implementing Decision 2021/914).
In addition, a Data Processing Agreement (DPA) pursuant to Article 28 of the GDPR has been entered into with each sub-processor to govern the processing of personal data. Where data is transferred outside the EU, these DPAs are supplemented by the appropriate transfer mechanisms listed above.
With respect to the processing of seller-area documents by our artificial intelligence providers, one of them (Google / Gemini) may process or access your data from a country outside the European Union, including the United States; this transfer is secured by the mechanisms mentioned above (EU-US Data Privacy Framework where the sub-processor is certified, and, failing that, standard contractual clauses). The other (Mistral AI), a French company, processes your data within the European Union by default; depending on the feature used, however, certain data may be subject to occasional transfers outside the European Union, secured by the mechanisms mentioned above (standard contractual clauses).
12. What are your rights over your data?
Right to information
This is precisely why we have written this policy.
Right of access
You have the right to access all of your personal data at any time.
Right to rectification
You have the right to correct any personal data that is inaccurate, incomplete, or out of date at any time.
Right to restriction
You have the right to obtain restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
Right to data portability
You have the right to receive your personal data in a readable format and to request its transfer to a recipient of your choice.
Right to erasure
You have the right to request that your personal data be deleted and to object to any future collection.
Right to lodge a complaint
With a competent supervisory authority (in France, the CNIL), if you consider that the processing of your personal data constitutes a breach of applicable law.
Right to object
You have the right to object to the processing of your personal data. Please note, however, that we may continue processing it despite your objection, for legitimate reasons or for the establishment, exercise, or defense of legal claims.
Regarding prospecting, you may object at any time via the unsubscribe link at the bottom of each of our prospecting emails.
Right to set out instructions for after your death
Relating to the retention, deletion, and disclosure of your personal data, and designating a person responsible for their execution where applicable.
General instructions may be transmitted to a digital trusted third party certified by the CNIL; specific instructions may be sent to the contact details below.
You may modify or revoke your instructions at any time.
You may exercise the above rights by writing to us at privacy@trackstone.fr
Or by post at: Trackstone - 19 Quai de rive neuve, 13007 Marseille
You must provide proof of identity by any appropriate means. If we have doubts about your identity, we may ask for additional information, including, where necessary, a signed copy of an identity document.
13. Automated processing of your documents (seller area)
How are your documents processed automatically?
Each time you upload a document to the document library, your documents are analysed by an automated system relying on artificial intelligence, with a simple purpose: to recognise the type of each document and extract a description and metadata from it, in order to file it correctly in your sale file. To do so, we use artificial intelligence providers (currently Google / Gemini and Mistral AI).
Is a decision made about me automatically?
No. This automated processing is solely an aid to classification. The approval or rejection of your documents is always carried out by our teams. No decision producing legal effects concerning you or significantly affecting you is made on a solely automated basis, within the meaning of Article 22 of the GDPR.
What safeguards apply?
To limit the retention of personal data in clear form, we retain the description and metadata produced by the artificial intelligence, but not the raw text extracted from the documents. Your files are encrypted, hosted in the European Union, and accessible only to the team in charge of the sale and, where applicable, to qualified buyers under controlled access. In accordance with our obligations, the use of artificial intelligence described above does not fall within the scope of the specific transparency obligations of the European Regulation on artificial intelligence applicable to conversational or content-generation systems, as it is an internal classification processing.
14. Data concerning third parties
How do we handle third-party data contained in your documents?
Some of the documents you upload contain data relating to people who did not provide them themselves (co-owners named in general meeting minutes, tenants mentioned in leases and rent receipts, the notary, the managing agent). Where individually informing these people would require a disproportionate effort, for example for co-owners cited in general meeting minutes, this policy serves as the information notice within the meaning of Article 14 of the GDPR. Where possible and proportionate, in particular for tenants whose lease would be shared with a buyer, we limit disclosure to only the necessary data and invite you to inform the persons concerned.
Second alert recipient ("searching as a couple")
When creating an alert, you may add the email address of a second person so that they also receive the properties matching your search. This address is used only to send these alerts and is not linked to any marketing communication. By adding this address, you undertake to have obtained that person's agreement and to inform them of this processing, for which this policy serves as the information notice within the meaning of Article 14 of the GDPR. This address remains linked to yours so that we can handle any request relating to the rights of the person concerned. Both you and the person added can stop the alert at any time via the link in each email or by contacting us at the details below.
15. Amendments
We reserve the right, at our sole discretion, to amend this policy at any time, in whole or in part.
You will be informed of any such update by a notice displayed the next time you use our Site.
Amendments take effect from the date the new privacy policy is published. Your continued use of the Site after the amendments take effect constitutes your acknowledgment and acceptance of the new policy. If the new policy is not acceptable to you, you must stop using the Site.