Privacy policy

This Privacy Policy explains how the operator of ParaguayInmo, the AMC360 real-estate intelligence service (“ParaguayInmo”, “we”, “us” or “our”), processes personal data through paraguayinmo.com, related accounts, professional workspaces and support channels. ParaguayInmo determines the purposes and means of this processing and acts as controller, except where we process an agent’s third-party client records only to provide that agent’s private workspace.

Privacy questions and rights requests may be sent to contact@amc360.com.py. This Policy applies to visitors, account holders, owners, agents, agency members, clients whose data is entered by an authorized professional, people named in public listings, and people who contact us. It does not govern a third-party portal or professional acting independently.

Depending on how you use the Service, you may provide an email address, name, profile photo, language, role, account and agency details, team invitations, public business contact details, listing descriptions and photos, property address and exact coordinates, reports and corrections, saved properties, support communications, and other form content. Professional workspace users may also enter client names, phone numbers, email addresses, requirements, appointment details, negotiations, amounts and notes. Please provide only data you are authorized to use and that is necessary for the stated purpose.

We collect property listings and related information from public real-estate portals, broker and agency pages, user submissions and other lawful sources. This can include names, professional contact details, listing text, images, source identifiers and URLs, advertised price, property attributes, address, coordinates, publication dates and source status. We also derive normalized fields, translations, zone assignments, duplicate matches, quality signals and change history.

Public availability does not remove privacy rights. We use this material to provide search, provenance, correction and market analysis, and we respond to substantiated privacy, accuracy and removal requests. Where data came from another portal, the source may remain independently responsible for its own copy.

Our systems and infrastructure providers receive technical data needed to deliver and secure requests, such as IP address, date and time, requested URL, response status, browser and device information, language, approximate country, referrer and security signals. Authentication, load balancing, abuse prevention and server logs may be generated automatically.

Only after you consent to Measurement, our first-party analytics records page paths, searches contained in URLs, listing and zone identifiers, clicks, referrer, time, IP address, browser/device data, approximate country, language and a pseudonymous visitor key. If you are signed in, the event may be linked to your account ID and name or email. Google Analytics also receives measurement events, approximate location, device/browser data and cookie identifiers under Google’s terms. We do not send listing-form content, CRM notes or your account email to Google Analytics.

We process data to deliver requested pages; create and secure accounts; authenticate users; remember choices; operate saved properties, publishing, moderation, agency and professional-workspace features; communicate service and security messages; respond to support and rights requests; aggregate and update listings; geocode and map properties; generate comparables, estimates, reports and market statistics; detect duplicates, errors, fraud and abuse; enforce terms; maintain audit records; establish or defend legal claims; comply with law; and improve reliability and accessibility.

Depending on the context and applicable law, we rely on performance of a contract or steps you request before one; compliance with legal obligations; our legitimate interests in operating, securing, measuring and improving the Service and protecting users and rights; your consent for optional measurement technologies; and, where applicable, publication or use of data you or another source made manifestly public. We balance legitimate interests against individual rights and honor valid objections. We do not use consent where the processing is actually mandatory for a requested service or legal obligation.

Strictly necessary technologies support security, authentication, consent records and features you expressly request. They include the `consent` cookie (your choices and policy version, 6 months), Clerk authentication/session technologies (duration varies by session and security setting), `locale` and `display_currency` cookies and the display-currency local-storage mirror (1 year after you select them), and the signed-in active-workspace cookie (1 year). The service worker stores only a minimal offline shell; it does not cache live listing or account pages.

Measurement is off until you opt in. If enabled, the first-party analytics described above sends events to us without adding its own browser identifier cookie, and Google Analytics may set `_ga` and `_ga_<stream-id>` cookies to distinguish users and sessions. We configure Google Analytics cookies not to exceed the consent period and disable Google Signals and advertising-personalization signals. No marketing or personalized-advertising tag is currently enabled.

The first layer offers equally accessible “Accept all” and “Reject all” actions, and the preferences panel leaves optional measurement off by default. Refusal does not reduce access to the Service. We retain the choice for approximately 6 months, then ask again; a material purpose or provider change also invalidates the old choice. Open “Cookies” in the footer to change or withdraw consent at any time. Withdrawal acts prospectively and does not make earlier consent-based processing unlawful.

To demonstrate and enforce your choice, we keep an append-only consent record containing a random consent ID, decision, enabled categories, policy version, language, time, user ID if signed in, user agent and—only when a private salt is configured—a salted IP hash. Rejection and withdrawal are recorded as carefully as acceptance. This evidence is used for compliance, dispute resolution and preventing optional tags from loading contrary to your choice; it is not used for advertising.

We automatically normalize, translate, geocode, classify, score and compare property listings and may flag duplicates, quality issues or suspicious activity. The ParaguayInmo/AMC360 index and estimates concern properties and advertised market data, not a person’s creditworthiness. Moderation or security systems may restrict content or access, with human review where appropriate. We do not make solely automated decisions about individuals that produce legal or similarly significant effects unless we provide the notice, safeguards and rights required by applicable law.

Listings, agency profiles and selected professional contact details are intended for public display and may be indexed, copied, cached or shared by search engines, source portals and other users. Exact coordinates are displayed only according to the Service’s location-precision rules, but a user who publishes an exact location should assume it can reveal a property address. Private account data, favorites, consent choices and professional CRM records are not intentionally public. Do not publish personal data you do not want made public or lack authority to disclose.

We disclose data only as needed to operate the Service, follow your instructions, complete a business transaction, protect rights and safety, or comply with law. Recipient categories include hosting and application infrastructure (currently Vercel); database and worker infrastructure (currently Railway); identity and authentication (Clerk and its subprocessors); object and image storage/delivery (Cloudflare R2); measurement after consent (Google Analytics); map/tile and geocoding services (MapLibre/OpenFreeMap and Nominatim/OpenStreetMap infrastructure); source portals, image CDNs and proxy/network providers involved in retrieving public listing material; professional workspace members you authorize; advisers, auditors, insurers, courts and competent authorities.

Hotlinked listing images and map tiles are requested from their providers by your browser; those providers consequently receive ordinary connection data such as IP address and user agent. We use no-referrer controls where implemented, but their own policies govern their independent processing. We do not sell personal data, and we do not currently share it for cross-context behavioral advertising.

Some providers and their subprocessors operate outside Paraguay and may process data in the United States, Europe or other countries whose rules differ from yours. Where required, we use an applicable adequacy mechanism, contractual protections, provider data-processing terms, necessity for the requested service, or another lawful safeguard. You may ask for information about the safeguard relevant to your data. Public listing material may be accessible globally by its nature.

We keep personal data only for the purpose described and for legal, security, backup and dispute periods. Account and profile data is generally kept while the account is active; public and source listing data follows its availability, provenance, moderation and market-history needs; private workspace records remain until the authorized professional deletes them or the workspace/account is closed; support, security and legal records remain for the time needed to resolve the matter and establish or defend claims.

Consent choices remain in the browser for about 6 months, while consent evidence may be retained longer for the applicable limitation and regulatory period. Analytics events are stored in time-based partitions and retained only while needed for audience measurement, security and trend comparison, after which they should be deleted or anonymized; Google Analytics data follows the retention setting configured for our property. Provider logs and backups expire on provider schedules. We may retain a minimal suppression, fraud-prevention or legal-hold record after deletion where necessary and lawful.

We use proportionate technical and organizational safeguards such as access controls, authenticated administration, encrypted transport, role checks, input validation, restricted credentials, backup and logging practices. No Internet service or storage system is completely secure, and we cannot guarantee absolute security. Keep magic links and devices private and notify us of suspected compromise. Where required by law, we will assess and notify a qualifying personal-data incident.

Subject to applicable law and valid exceptions, you may request confirmation and access; a copy; correction or completion; deletion; restriction; objection, including to legitimate-interest processing; portability; withdrawal of consent; information about sources, recipients, transfers, retention and relevant automated logic; and review of a qualifying automated decision. You may also complain to the competent data-protection authority or use available habeas data and court remedies.

Send a clear request to contact@amc360.com.py from the relevant account email where possible. Specify the right, affected data and relevant URLs. We may request proportionate identity or authority evidence and will not disclose another person’s data. Requests are free unless applicable law permits a reasonable charge or refusal for a manifestly unfounded, excessive or repetitive request. We aim to respond within 30 calendar days or any shorter mandatory period, and will explain a lawful extension or denial.

If an owner, agent or agency gives us another person’s data, that contributor is responsible for having a lawful basis, giving required notice, respecting objections and keeping it accurate. For private CRM records, the professional decides why the client data is entered and must answer the client’s relationship-specific request; we provide the workspace and may assist with access, export or deletion. Contact us if you cannot identify or reach the contributor. We may remove data while a dispute is reviewed without admitting liability.

The Service and accounts are intended for adults aged 18 or over and are not directed to children. Do not submit a child’s data, image or precise location unless strictly necessary, lawful and supported by the required parental or guardian authority. If you believe we hold a child’s data improperly, contact us so we can investigate and delete or restrict it as appropriate.

We may update this Policy to reflect legal, provider, security or feature changes. We will post the revised date and give additional notice or seek fresh consent where required. Material changes apply prospectively. For privacy questions, rights requests, source corrections or complaints, email contact@amc360.com.py and include enough detail to locate the data. If a request concerns a third-party source, you may also need to contact that source directly.