Privacy Policy

The controller responsible for data processing under the GDPR is:

NewWays AI Development & Consulting GmbH (i.Gr.)
Bahnweg 3d, 9220 Velden am Wörthersee, Austria
Email: info@vividomo.com
Telephone: +43 676 6607054

When you use Vividomo®, we process the following categories of personal data:

• Account data: Email address, password (encrypted), name, profile picture, role in the real estate agency
• Company data: Name of the real estate agency, company name, country/market, logo, branding settings
• Properties and contacts: All property data and contact details entered by the user (prospective buyers or tenants, owners, etc.)
• Connected mailboxes: Mailbox address, email metadata and message content, insofar as a member activates the optional Gmail or Google Workspace integration
• Usage data: Login timestamps, actions performed in the app (audit log), device information and technical performance metrics for the web interface
• Billing data: Plan, billing period, payment history (payment method details are managed exclusively by Mollie)
• AI inputs: Content submitted for AI-assisted text, image and video editing (property descriptions, property photos, etc.)

We process personal data for the following purposes:

• Performance of a contract (Art. 6(1)(b) GDPR): Operation and provision of the Vividomo® platform, billing, support, and synchronisation and sending through a connected mailbox initiated by the member
• Legitimate interests (Art. 6(1)(f) GDPR): Platform security, fraud prevention, technical improvements, anonymised usage statistics
• Consent (Art. 6(1)(a) GDPR): Email notifications about trial expiry and product news (consent may be withdrawn at any time)
• Legal obligation (Art. 6(1)(c) GDPR): Retention of accounting documents under the Austrian Commercial Code (UGB) and Federal Fiscal Code (BAO)

Where a real estate agency processes personal data relating to its prospective buyers or tenants, owners or other contacts in Vividomo®, the agency is generally the controller for this business data. We process this data on behalf of the agency. The required data processing agreement forms part of the contractual data protection documentation.

We use the following service providers. Depending on the service and processing activity, they act as processors or independent controllers under their respective terms of use and privacy policies. Required data processing agreements and third-country safeguards are concluded or reviewed before production use:

Connecting a Google Workspace or Gmail mailbox is voluntary and is initiated exclusively by the respective member through the Google OAuth dialogue. Immediately before it starts, we display a notice about access to, use, storage and visibility of Google data. Vividomo® requests only the gmail.readonly permission for read-only access to Gmail messages and gmail.send for sending emails written by the member.

Data retrieved technically: For contact matching, complete Gmail messages in Raw MIME format, including headers, text and HTML content, and technically included attachment data, are temporarily retrieved and analysed on the server. During the initial synchronisation, up to 20 messages from the last 30 days are currently checked; subsequently, newly added messages are retrieved in limited, regular runs. Messages and attachments that cannot be clearly assigned to a CRM contact are not stored permanently.

Data stored permanently: For matched CRM messages, we store the mailbox address, message and thread identifiers, sender, primary recipient, subject (up to 500 characters), sending or receiving time, and the message content converted to plain text (up to 50,000 characters).

Purpose: Assigning emails to CRM contacts, displaying communication in the contact history, avoiding duplicate entries, and sending emails that the member has written in Vividomo®. Google data is not used for advertising, retargeting, profiling or creditworthiness decisions, or to create, train or improve AI or machine-learning models.

Visibility: The mailbox connection and its technical metadata are visible only to the member who connects it. Synchronised messages become part of the tenant-wide CRM contact history and are visible there to authorised members of the same real estate agency.

Storage and security: Synchronised CRM messages are stored in the EU-hosted Vividomo® database. OAuth access and refresh tokens are encrypted with AES-256-GCM and processed exclusively on the server. The Google password is neither requested nor stored. The server functions used for OAuth, synchronisation and sending are configured for Vercel’s Frankfurt region; possible third-country access is described in Section 6.

Sharing and human access: The data is processed only by Google to provide the Gmail service, by Vercel for server-side execution and by Supabase for database storage. It is not sold or shared with advertising networks, data brokers or other unrelated third parties. Human access occurs only with express consent for a specific support case, where necessary for security and abuse prevention, or pursuant to a legal obligation.

Disconnection and deletion: Disconnecting the mailbox deletes the OAuth tokens stored by Vividomo®; further synchronisation and sending through Vividomo® stop. This does not automatically revoke the Google authorisation in the Google account. Messages already synchronised remain in the CRM contact history until the associated contact or the entire tenant is deleted, or a valid erasure request sent to info@vividomo.com has been processed.

Managing or deleting Google data:

1. Under Settings → Email mailboxes, select the relevant connection and confirm “Disconnect”.
2. If needed, also revoke the remaining Google authorisation under Connections in your Google account.
3. Remove previously imported CRM messages by deleting the associated contact or tenant, or send a valid erasure request to info@vividomo.com.

The use and transfer of information that Vividomo® receives through Google Workspace APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Most data processing — database, authentication and file storage (Supabase, Frankfurt/Ireland), AI-assisted text and image processing (Requesty EU gateway, Frankfurt), and embeddings for the AI chatbot (Azure OpenAI Service, EU region) — takes place exclusively within the EU/EEA. The content does not leave the EU in these processes.

The contractual partner for the AI gateway is Requesty Ltd, based in the United Kingdom; the European Commission has adopted an adequacy decision for the United Kingdom under Art. 45 GDPR. The data processing itself takes place in the EU (Frankfurt).

A transfer to the USA or access from the USA cannot be ruled out when sending transactional emails (Resend), using the optional Google Workspace/Gmail mailbox integration, or — exclusively with your consent — using optional AI video generation (Vercel AI Gateway / Google Veo). These transfers are based on EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR or an adequacy decision by the European Commission under the EU-US Data Privacy Framework, insofar as the respective provider is certified.

Personal data is stored for as long as an active user account exists or processing is necessary for the contractually agreed purposes. Following a confirmed cancellation or erasure request, operational data is deleted or anonymised through the designated deletion procedure once no contractual or statutory retention grounds remain. The specific details in Section 5 also apply to connected Google mailboxes and CRM messages already imported.

Accounting-related data (invoices, payment receipts) is retained for 7 years under Austrian tax law, including after account deletion.

You have the following rights against the controller:

• Right of access (Art. 15 GDPR): The right to information about stored data
• Right to rectification (Art. 16 GDPR): The right to correct inaccurate data
• Right to erasure (Art. 17 GDPR): The right to deletion of personal data (“right to be forgotten”)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR): The right to receive your data in a machine-readable format
• Right to object (Art. 21 GDPR): The right to object to processing based on legitimate interests
• Withdrawal of consent (Art. 7(3) GDPR): Possible at any time without giving reasons

To exercise your rights, please contact: info@vividomo.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

Vividomo® uses technically necessary cookies that are essential to operate the platform and — exclusively with your consent — optional marketing cookies:

• Session cookie: Authentication and secure login (Supabase)
• Tenant cookie: Storing the active real estate agency when using multiple tenants
• Preference cookies: Display options such as animation settings and sidebar state
• Consent cookie: Stores your marketing measurement decision for 180 days consistently across Vividomo® subdomains

Consent is not required for technically necessary cookies. We use the cookieless analytics tool Umami for audience measurement (see Section 10); no analytics cookies are set. On public acquisition and registration pages, the Meta cookies _fbp and _fbc may be added after your consent. Without consent, the Meta Pixel is not loaded. You can change your decision at any time through “Privacy settings”.

To improve the platform in line with users’ needs, we measure its usage with Umami, a privacy-friendly analytics tool. Umami sets no cookies, creates no cross-device identifiers and creates no personal user profiles. Only aggregated, anonymous metrics are collected (pages visited, approximate origin at country level, device type, referring page).

We also measure the technical Core Web Vitals LCP (loading time of the largest visible content), INP (response time to inputs) and CLS (visual stability). The page path, metric name and rounded value, a quality rating and the type of page visit are transmitted to Umami. The measurement payload contains no names, email addresses, message content, other CRM business data or DOM elements. Measurement serves to detect technical deterioration of the web interface at an early stage.

We self-host Umami on servers within the EU (Hetzner Online GmbH, Nuremberg, Germany). No data is shared with third parties or transferred to third countries; consequently, there is no processing on behalf of a controller within the meaning of Art. 28 GDPR.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising, cookieless audience measurement). Because no cookies are set and users are not individually tracked, no consent is required for this purpose. You can object to this processing at any time (see Section 8).

If you choose “Allow marketing”, we load the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, on public acquisition and registration pages. The authenticated dashboard is deliberately not tracked for advertising purposes.

The Pixel helps us understand whether advertisements on Facebook or Instagram lead to page visits and the start of a Vividomo® trial. In particular, the visited URL, time, browser and device information, and Meta identifiers such as _fbp and _fbc may be processed. We do not transmit registration data such as email addresses or passwords through the Pixel.

Legal basis: Exclusively your voluntary consent under Art. 6(1)(a) GDPR and § 165(3) TKG 2021. If you withdraw consent, we delete the Meta cookies on our domains. Meta may also process data in third countries, particularly the USA, and states that it bases transfers on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Further information is available in Meta’s Privacy Policy.

We reserve the right to update this Privacy Policy in the event of material changes to data processing. Registered users will be informed by email of material changes. The date of the last update is shown above.