Privacy
Cookie Policy & Data Processing Notice
Secret Properties S.L. · C/ de la Llotgeta 14, AT, 07002 Palma de Mallorca · NIF: ES-B72424104
This notice explains how Casa Uno (operated by Secret Properties S.L.) uses cookies, tracking technologies, and third-party data processors on this website and within the Casa Uno owner portal and messaging services. We are committed to transparency about what data we collect, why, and with whom it is shared.
1. What are cookies?
Cookies are small text files placed on your device by a website. They serve a variety of purposes: keeping you logged in, remembering your preferences, measuring how the site is used, and delivering relevant communications. Some cookies are set by us; others are set by third-party providers whose services we embed.
2. Legal basis
We rely on the following legal bases under the GDPR and Spanish LOPDGDD:
- Consent — for all non-essential cookies and marketing trackers. You may withdraw consent at any time via the cookie manager in the footer.
- Legitimate interests — for fraud prevention and security logging within the owner portal.
- Contract performance — for data processed to deliver the Casa Uno service to existing clients.
- Legal obligation — where retention is required under Spanish law.
3. Cookies we use
Required always activeConsent only if you acceptLegitimate interest can be objected to
| Cookie / provider | Category | Basis | Purpose | Retention |
|---|---|---|---|---|
| Supabase — session & auth (owner portal only) | Strictly necessary | Required | Keeps you signed in to the owner portal. Stores an encrypted session token. No personal data is exposed. | Session / 7 days |
| CSRF & security (owner portal only) | Strictly necessary | Required | Protects forms and authenticated requests against cross-site request forgery. | Session |
Consent preferencecasa-uno-consent | Strictly necessary | Required | Stores the tier you chose in the MYLO banner so we do not ask again on every visit. Kept in your browser's local storage, not in a cookie, and never sent to a server. | 12 months |
Google Analytics 4_ga, _ga_* | Analytics | Consent | Measures which pages and sections are read, which buttons are used, and whether enquiries complete. Google Consent Mode v2 is active: until you choose 'Familiar' in the MYLO banner, no _ga cookies are written and only cookieless pings are sent; choosing 'Anonymous' stops those too. Google Signals and ads personalisation are disabled, so no advertising profile is built. Data goes to Google Ireland Ltd. and may be transferred to the US under Standard Contractual Clauses. | Up to 24 months |
| Live chat widget | Strictly necessary | Required | Powers the MYLO chat on this site. The chat runs on Casa Uno's own proxy — no third-party widget and no cookies, and no transcript of your conversation is stored on our servers. To answer you, the text you type is sent to Google's Vertex AI (Gemini) service in the EU; see 'Google Vertex AI' below. If you ask MYLO to hold a time for a call, the details you give for that booking are written to our calendar — see 'Google Calendar' below. | Session only (booking details are kept separately — see section 4) |
4. Third-party data processors (beyond cookies)
The following services receive or process personal data as part of delivering the Casa Uno service. They do not set cookies on this website but process data you provide or that is generated through your use of our services.
WhatsApp Business (Meta)
We use WhatsApp Business as a primary communication channel with property owners and guests. Messages, phone numbers, and any property information exchanged via WhatsApp are processed by Meta in accordance with their Business Terms of Service. By contacting us via WhatsApp, you acknowledge that message content is processed by Meta.
Google Vertex AI (Gemini language models)
Two things use Gemini models. First, the MYLO chat on this website: what you type is sent to Gemini so it can answer you. Second, our internal service delivery workflow, where property-related information and service requests may be processed to help our team draft communications and summarise owner requests.
Both run against Google's EU multi-region endpoint, so the model processing of this data is committed to the EU rather than transferred to the United States. Google is a US-parent company, so US-authority access to data held by its group cannot be excluded outright; the EU commitment is given under Google's Cloud Data Processing Addendum. We do not send sensitive personal data (financial details, passport numbers) to AI models, and the website chat has no access to any owner account, property record or address.
Google Calendar (discovery-call bookings)
If you ask MYLO to hold a time for a 30-minute call, we write a provisional entry to Casa Uno's own Google Calendar. That entry carries the details you gave for the booking: your first and last name, your email address, and — only if you chose to mention them — the area and type of your property and any note you added. We keep that entry for 90 days. You are not added as a calendar guest, so Google does not email you an invitation; we write to you ourselves.
Google processes this booking under Casa Uno's data-processing agreement with Google. Google Calendar is still a different Google service from Vertex AI above, though: it does not carry the same EU multi-region processing commitment that governs the MYLO chat, and we have not separately verified where Google stores this calendar data — we would rather say so than imply a guarantee we have not confirmed.
Contact form and chat enquiries (PII collection)
The contact form on this website collects your name, your email address, and any note you choose to add; you tick a box to confirm we may write back. A booking made through the chat collects the details described under “Google Calendar” above. This data is used solely to respond to your enquiry and assess whether Casa Uno services are a fit. It is not shared with third parties for marketing purposes, and it is not added to any owner database. We keep it only for as long as it takes to deal with your enquiry, and you may ask us to delete it at any time — see section 7.
5. How to manage your preferences
You can change your choice at any time via “Manage cookies” in the footer of this website. You may also control cookies directly in your browser:
To opt out of Google Analytics across all websites: Google Analytics Opt-out.
6. International data transfers
Some of our third-party providers are based outside the European Economic Area (EEA), including in the United States. In such cases, transfers take place under the EU Standard Contractual Clauses (SCCs) or an EU adequacy decision. For details, refer to the privacy policies of the respective providers linked above.
The Gemini models behind the MYLO chat are an exception worth stating plainly: that processing is committed to Google's EU multi-region rather than transferred to the United States, so it does not rely on the SCCs. Google Calendar, used only for call bookings, is a separate service and we have not verified its storage location — this is described under “Google Calendar” in section 4.
7. Your rights
Under the GDPR and LOPDGDD you have the right to: access your personal data; request rectification or erasure; object to or restrict processing; withdraw consent at any time; and lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.
To exercise any of these rights, contact us at office@mycasauno.com or in writing to our registered address.
8. Changes to this policy
We may update this Cookie Policy as our services evolve or legal requirements change. The date of the most recent revision is shown at the top of this page. Continued use of our website after an update constitutes acceptance of the revised policy.