Politika e privatësisë

Trovela is a real estate marketplace and CRM platform operated by ENTRIKS LLC (Lot Vaku L2.1, 10000 Prishtina, Republic of Kosovo).

This policy explains how we process personal data when you browse listings, create an account, contact sellers, use TROVELA CRM, or use related features on trovela.eu and associated TROVELA services.

Depending on how you use TROVELA, we may process:

• Account data: email address, name, password hash (if you register with email), profile image, account type (private or business), and session/authentication tokens.
• Social-login profile information: if you sign in with Google or Facebook, we receive basic profile information those providers share with us for authentication (such as name, email, and profile picture), according to your provider settings. This social-login profile information is separate from Google API / Gmail data described below.
• Google API / Gmail data (TROVELA CRM): if you voluntarily connect a Google account to TROVELA CRM for Gmail sending, we access the basic Google account identity and Gmail send permission authorized by you so the CRM can send emails you explicitly request. This Google connection does not read or synchronize your Gmail inbox. See section 4 (Google API Services and Google User Data).
• Google Calendar data (TROVELA CRM): if you voluntarily connect Google Calendar in TROVELA CRM, we may access calendar-related Google user data permitted by the OAuth scopes you authorize to create and sync CRM appointment calendars/events. See section 4.
• Listing and profile content: property details, photos, location fields, and contact details you choose to publish when creating listings.
• Inquiry and message data: name, email, phone number, message text, and related metadata when you contact a seller or submit an inquiry form.
• Favorites: listings you save to your watchlist while logged in.
• Lead and interaction events: for example when you click “Chat on WhatsApp”, reveal a phone number or email, or submit an inquiry — we log these events to improve the service and route leads appropriately. These marketplace lead-attribution and analytics events do not include Google user data obtained through Google APIs.
• Technical data: IP address, browser type, device information, and server logs needed to operate and secure the platform.
• CRM workspace data (business accounts): if you use TROVELA CRM as an agency, we process contacts, deals, appointments, internal messages, notifications, and email content stored or synchronized through separately configured business mailboxes. Google send-only connections do not import Gmail inbox content.

Saved search alerts: the dashboard may reference saved searches in the future. If we launch email or in-app search alerts, we will update this policy and describe what is stored and how you can opt out.

We process personal data to:

• Provide the marketplace: search, view listings, maps, and property details.
• Create and manage user accounts (private sellers and business/agency accounts).
• Deliver inquiries and messages between visitors and listing owners.
• Route business listings to the correct agency CRM workspace (contacts and deals) and private listings to the owner’s in-app message inbox.
• Operate TROVELA CRM for authorized business users, including optional Google/Gmail (and, where enabled, Google Calendar) connections that you voluntarily request.
• Provide optional, user-requested AI assistance features powered by the OpenAI API (see section 5), including CRM email writing/improvement. Other optional AI features may help with listing copy, search assistance, translation, or social captions where enabled; those features do not automatically process Google Workspace or Gmail API data.
• Record WhatsApp click events and contact reveal events for analytics, fraud prevention, and lead attribution (we do not receive the content of your WhatsApp messages). These analytics, marketing, and lead-attribution purposes apply to marketplace interaction data only — not to Google user data obtained through Google APIs.
• Operate favorites and account dashboards.
• Authenticate users, maintain sessions, and protect against abuse.
• Comply with legal obligations and respond to support or privacy requests.

Important: general statements in this policy about analytics, lead attribution, marketing, product improvement, or similar purposes do not authorize use of Google user data obtained through Google APIs for those purposes. Google user data is used only as described in sections 4 and 5.

Certain TROVELA CRM features allow you to voluntarily connect a Google account (for example Gmail functionality, and where available Google Calendar). When you do so:

• You choose to connect your Google account; TROVELA does not access Google API user data unless you complete that authorization.
• TROVELA accesses only Google data permitted by the OAuth scopes you authorize.
• Google user data is used only to provide or improve the user-facing Google/Gmail (and, where connected, Google Calendar) functionality you request within TROVELA CRM — for example identifying the connected Google address, sending emails you explicitly request, and syncing CRM appointments to a connected calendar. The Gmail integration does not read or synchronize the connected account's inbox.
• Google user data is not used for advertising, retargeting, marketing profiling, lead attribution, data brokerage, selling personal data, or other unrelated purposes.
• General analytics, marketing, lead-attribution, and product-improvement provisions elsewhere in this Privacy Policy do not apply to Google user data obtained through Google APIs.
• TROVELA does not sell Google user data.
• Google user data is not transferred or disclosed to third parties except as necessary to provide or secure the requested functionality, to comply with law, or as otherwise permitted by Google’s policies and applicable law. Infrastructure subprocessors that host or operate TROVELA may process such data solely to run the service under appropriate protections. The only AI/ML transfer of text that may relate to Gmail compose content is the optional OpenAI email-writing feature described in section 5, which requires an explicit user action.
• Access to Google connection settings and tokens is restricted to authorized server-side processes and authorized CRM users/admins for the relevant workspace, consistent with TROVELA’s authentication and access controls.

TROVELA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You may disconnect Google/Gmail (or Google Calendar) from TROVELA CRM settings, which removes stored Google OAuth tokens for that connection from TROVELA. You may also revoke TROVELA’s access at any time in your Google Account permissions (Google Account → Security → Third-party access / connections). After revocation or disconnection, TROVELA will no longer use Google APIs with those credentials. Records of emails sent at your request and calendar records already created in your CRM workspace may remain as business records until deleted by your team or pursuant to a deletion request, subject to legal retention requirements.

TROVELA uses the OpenAI API for optional, user-requested AI assistance features. OpenAI is the only third-party AI/ML service provider used by TROVELA. With respect to Google Workspace APIs and Gmail user data:

• Regarding Google Workspace / Gmail user data, TROVELA uses the OpenAI API only for an optional, user-requested email writing feature. This feature may help users improve, rephrase, or polish the subject and body text of an email they are composing before sending.
• TROVELA does not use the OpenAI API to automatically process, analyze, summarize, classify, train on, or extract data from Google Workspace or Gmail user data.
• Gmail data is not sent to OpenAI unless the user explicitly chooses to use the email body improvement feature for text they are composing. In that case, only the compose subject/body (and any instruction the user provides) are sent to OpenAI to generate improved draft text — not the user’s full mailbox, Gmail metadata, or attachments, and not for automatic scanning of synced Gmail messages.
• TROVELA may also use the OpenAI API for other optional, user-requested features that do not process Google Workspace / Gmail API data (for example listing copy assistance, search assistance, translation, or social caption tools where enabled).
• Google Workspace API data, including Gmail messages, metadata, attachments, and derived data, is not used to create, train, or improve generalized AI or machine learning models.
• Google Workspace API data is not sold, transferred, or used for advertising.

TROVELA has not opted in to allow OpenAI to use API inputs or outputs for model training or improvement.

The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where applicable under GDPR, we rely on:

• Performance of a contract — providing the service you request (account, listings, inquiries, CRM features you use).
• Legitimate interests — security, product improvement, lead routing, and limited analytics for marketplace and non-Google-API data.
• Consent — where required (for example certain cookies, optional marketing in the future, voluntary connection of Google accounts for CRM Gmail/Calendar features, or optional AI assistance features you choose to use).
• Legal obligation — when we must retain or disclose data by law.

For Google user data obtained through Google APIs, processing is limited to providing or improving the requested Google-integrated functionality (and related security/compliance), not for unrelated analytics, advertising, marketing profiling, or lead attribution. Optional OpenAI email improvement applies only when you explicitly request it for compose text, as described in section 5.

We do not sell your personal data. We may share data with:

• Listing owners and agencies — when you submit an inquiry, click WhatsApp, or reveal contact details, the relevant seller or assigned agent receives the information needed to respond. Agency listings are routed to the team’s CRM workspace (contact and deal records).
• Google — (a) as an authentication provider when you choose Google social login; and (b) when you voluntarily connect Google/Gmail (or Google Calendar) in TROVELA CRM, in which case Google and TROVELA exchange information needed to authorize the connection and provide the requested Google-integrated functionality, limited to the scopes you approve.
• Facebook — when you choose Facebook social login (and, where separately enabled, other Facebook integrations you authorize).
• OpenAI — when you explicitly use an optional AI assistance feature, we send the inputs needed for that feature (for example compose subject/body and your instruction for email improvement) to OpenAI to return the requested AI output. OpenAI is not used to automatically process Google Workspace / Gmail mailbox data. See section 5.
• Infrastructure providers — hosting, database, email, storage, and analytics subprocessors that help us run TROVELA (under appropriate data protection terms). Analytics subprocessors are not used to analyze Google user data obtained through Google APIs for advertising, retargeting, marketing profiling, or lead attribution.
• Authorities — when required by law or to protect rights and safety.

Sharing described above that relates to analytics, lead attribution, or marketing does not apply to Google user data obtained through Google APIs, except where necessary to provide or secure the requested Google-integrated functionality, to comply with law, or when you explicitly request optional AI email improvement for compose text as described in section 5.

TROVELA applies technical and organizational measures appropriate to the sensitivity of the data, including Google OAuth credentials and other sensitive connection data:

• Data in transit is protected using HTTPS/TLS when you access TROVELA over the public internet.
• Google OAuth access and refresh tokens are encrypted before storage using industry-standard authenticated encryption (AES-256-GCM).
• Encrypted tokens are decrypted only by authorized server-side processes when required to refresh access or call Google APIs for the connected feature; tokens are not exposed in ordinary client responses.
• Authentication and authorization controls protect access to accounts and CRM workspaces. Connecting or disconnecting Google mailbox settings requires an authorized CRM administrator for the relevant team.
• Access controls restrict sensitive information (including Google connection credentials) to what authorized systems and workspace users need to operate the requested functionality.
• Sensitive Google credentials and Google user data access are limited to what is necessary for the requested Gmail/Calendar functionality and the OAuth scopes you authorize.
• We maintain reasonable technical and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

TROVELA uses cookies and similar technologies to keep you signed in, remember preferences, and secure the platform. Session cookies are essential for login. You can control non-essential cookies through your browser settings; disabling them may limit some features.

We keep personal data only as long as needed for the purposes described in this policy, including active accounts, open inquiries, CRM records for business customers, and legal or accounting requirements. When data is no longer required, we delete or anonymize it within a reasonable period, unless a longer retention period is required by law.

Google OAuth tokens and related connection credentials are retained while the Google connection remains active and are removed from TROVELA when you disconnect the integration in CRM settings (or when the connection record is otherwise deleted). The Google Gmail integration does not import inbox messages. Records of emails sent at your request and calendar-linked appointment records are retained as workspace business records until deleted by authorized users or pursuant to a verified deletion request, subject to legal retention needs. Restrictions on use of Google user data in sections 4 and 5 continue to apply for as long as such data remains in TROVELA.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. You may also withdraw consent where processing is consent-based.

To exercise these rights or ask questions, contact us at it.entriks@gmail.com. You can also read our Udhëzimet për fshirjen e të dhënave.

For Google connections specifically, you can withdraw access by disconnecting Google in TROVELA CRM settings and/or revoking access in your Google Account. Withdrawal stops further Google API access with those credentials; it may not automatically erase records of emails previously sent at your request or calendar records already created in the CRM unless you also request deletion of that data. You can also simply choose not to use optional AI email improvement features.

Our service providers may process data in the European Union and other countries. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers outside your jurisdiction. When you use optional OpenAI features, relevant inputs may be processed by OpenAI in accordance with OpenAI’s terms and this Privacy Policy.

TROVELA is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top indicates the latest version. Continued use of TROVELA after changes means you accept the updated policy.

ENTRIKS LLC
Lot Vaku L2.1, 10000 Prishtina, Republic of Kosovo
Telefon: +383 43 889 344
Privatësia: it.entriks@gmail.com
E përgjithshme: kontakt@entriks.com