Privacy Policy
1. Data Controller
Casalert is operated by Timur Kharenkov, trading as part of the Travel Assistant suite of services ("we", "us", "our"). We are the data controller for the personal data described in this policy.
- Email: info@travel-assistant.online
- Phone: +353 877 514 541
- Website: casalert.online
2. What Data We Collect
We collect the following data from letting agents and estate agencies that register with Casalert:
2.1 Account Data
- Business WhatsApp phone number
- Agency name (if provided)
- Account status (active/paused)
- Subscription expiry date
- Timestamp of last interaction
2.2 Search Criteria
- Target locations (city, area)
- Price range (maximum monthly rent)
- Property specifications (bedrooms, bathrooms, type)
- Source preference (private landlord / agency listings)
- Keywords to include or exclude
2.3 Interaction Data
- WhatsApp messages exchanged with our bot (commands and responses)
- Bot conversation state (idle / awaiting confirmation)
2.4 Website Data
- Cookie consent preference (stored in browser localStorage)
- No analytics or tracking cookies are used on this website
3. Legal Basis for Processing (GDPR Article 6)
We process your data on the following legal bases:
| Data | Legal Basis | Detail |
|---|---|---|
| Account data | Contract performance (Art. 6(1)(b)) | Necessary to provide the Casalert service you subscribed to |
| Search criteria | Contract performance (Art. 6(1)(b)) | Required to match listings against your preferences |
| WhatsApp messages | Contract performance (Art. 6(1)(b)) | Required to process your bot commands and deliver alerts |
| Consent timestamp | Legal obligation (Art. 6(1)(c)) | Required to demonstrate valid consent under ePrivacy Directive |
4. How We Use Your Data
We use your data solely to:
- Deliver property alert notifications via WhatsApp
- Match new Daft.ie listings against your saved search criteria
- Process your bot commands (ADD, LIST, PAUSE, RESUME, STOP, DELETE, HELP)
- Maintain your account and search preferences
- Send service-related communications (e.g., subscription reminders)
We do not use your data for marketing to third parties, profiling, or automated decision-making that produces legal effects.
5. Data Processors (Sub-processors)
We use the following third-party services to operate Casalert. Each acts as a data processor under GDPR Article 28:
| Processor | Purpose | Data Shared | Location | DPA |
|---|---|---|---|---|
| Google (Workspace) | Data storage (Google Sheets) | Account data, search criteria | EEA | Google Workspace DPA with SCCs |
| Twilio | WhatsApp message delivery | Phone number, message content | US (SCCs in place) | Twilio Data Protection Addendum |
| Anthropic (Claude AI) | Property listing analysis | Listing data only (no personal data) | US (SCCs in place) | Anthropic Commercial ToS DPA |
| OpenAI | Natural language parsing of search criteria | Message text (search criteria only) | US (SCCs in place) | OpenAI DPA |
Property listing data analysed by AI is sourced from Daft.ie and is publicly available. No personal data from agencies is sent to AI services for analysis.
6. International Data Transfers
Some of our sub-processors (Twilio, Anthropic, OpenAI) are based in the United States. These transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission, included in each processor's Data Processing Addendum.
7. Data Retention
We retain your data only as long as necessary for the purposes described above:
| Data Type | Retention Period | Basis |
|---|---|---|
| Active account data | Duration of active subscription | Contract performance |
| Search criteria | Duration of active subscription | Contract performance |
| Pending criteria (unconfirmed) | 48 hours, then automatically deleted | Data minimisation |
| After STOP command | 30 days grace period, then deleted | Storage limitation |
| After subscription expiry | 90 days, then deleted | Storage limitation |
| Payment records | 6 years | Irish tax law (Taxes Consolidation Act 1997) |
| Twilio message logs | 30 days (Twilio default) | Processor policy |
When data is deleted, it is permanently removed from our Google Sheets storage. We do not retain backups of deleted customer data.
8. Data Security
We implement appropriate technical and organisational measures to protect your data:
- Data stored in Google Workspace with enterprise-grade encryption (in transit and at rest)
- Access restricted to the data controller only
- WhatsApp messages encrypted end-to-end by WhatsApp/Twilio
- API keys and credentials stored as environment variables, not in code
- Regular review of access controls and processor security practices
9. Your Rights Under GDPR
Under GDPR and the Irish Data Protection Act 2018, you have the following rights:
- Right of access (Art. 15) - Request a copy of all personal data we hold about you
- Right to rectification (Art. 16) - Request correction of inaccurate data
- Right to erasure (Art. 17) - Request deletion of your data ("right to be forgotten")
- Right to restriction (Art. 18) - Request that we limit processing of your data
- Right to data portability (Art. 20) - Receive your data in a structured, machine-readable format
- Right to object (Art. 21) - Object to processing based on legitimate interests
- Right to withdraw consent - Where processing is based on consent, withdraw at any time
To exercise any of these rights, contact us at info@travel-assistant.online. We will respond within one calendar month of receiving your request, as required by GDPR Article 12(3).
You also have the right to lodge a complaint with the Data Protection Commission (Ireland):
- Website: www.dataprotection.ie
- Phone: +353 (0)761 104 800
- Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28
10. Cookies and Local Storage
This website does not use analytics, advertising, or tracking cookies. We use:
- Google Fonts - loaded from Google servers, which may set technical cookies necessary for font delivery
- localStorage - to remember your cookie consent preference (key: "ca-cookie")
No personal data is collected through these mechanisms. You can clear localStorage at any time through your browser settings.
11. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the Data Protection Commission within 72 hours of becoming aware of the breach (GDPR Article 33)
- Notify affected data subjects without undue delay where the breach is likely to result in a high risk (GDPR Article 34)
- Document the breach, its effects, and remedial actions taken
12. Changes to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available at this URL. We will notify active customers of material changes via WhatsApp with at least 14 days' notice.
13. Contact
For any privacy-related questions, data subject requests, or complaints, please contact:
Timur Kharenkov
Email: info@travel-assistant.online
Phone: +353 877 514 541